Privacy Policy

This policy explains how SeyTravel Ltd (C94462), trading as Mesura ("Mesura", "we", "our" or "us"), collects and uses personal data. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Chapter 586). Our competent supervisory authority for data protection matters is the Office of the Information and Data Protection Commissioner of Malta ("IDPC"), without prejudice to any rights you may have to lodge a complaint with another competent supervisory authority under applicable data protection law.

Mesura helps organisations and individuals assess and develop readiness, starting with AI, through Readiness assessments, tools such as surveys, quizzes and games, learning material, and Lenti, an AI assistant. People work in groups. A group can stand for an organisation, a class, a cohort or any other set of people, and can hold smaller groups, folders, survey rounds and tools inside it. A group, folder or tool that sits inside no other item is a top-level item, and everything inside it is its tree.

Capitalised terms used in this Privacy Policy that are not expressly defined here have the meanings given to them in Mesura's Terms of Service. For the purposes of this Privacy Policy, references to "Personal Data", "Processing", "Controller", "Processor" and related data protection concepts have the meanings given to them under applicable data protection law.

Our role. Controller and processor

The owner of a top-level group, folder or tool is the controller of the personal data processed in its tree, whether they act for an organisation or for their own purposes, as a teacher or a consultant might. Our Terms of Service, which they accept with their account, include our Data Processing Agreement for that data, so no separate acceptance is asked. We record who the controller is and which version of the agreement applied when the item was made, and that person is its controller contact. We process the group's data, including Readiness answers, tool answers, reports and Lenti's work on that data, only on the controller's documented instructions, as its processor. The same applies to personal data we process when delivering workshops, interviews, training or other services agreed with an organisation. The controller is responsible for determining the lawful basis for processing, providing appropriate transparency notices to the people it invites, and ensuring that the processing complies with applicable data protection law.

When ownership of a top-level group, folder or tool passes to someone else, the new owner becomes its controller and controller contact at once.

For group data, we act as controller only for accounts and sign-in, billing, and security. We are also controller for our own activities outside any group: your personal Readiness takes and your own use of Lenti, customer support, enquiries sent to us, platform administration, and the improvement of our services. Where we create benchmarking datasets, we use aggregated and/or anonymised information, or information processed in a manner designed to prevent identification of individuals.

Who this policy covers

People who create a group, and the Managers and Viewers given access to it.
Members of a group who are invited to a Readiness round. The invitation signs them in, or creates their account, by an emailed link.
People who answer a tool by a public link, a group link or a participant code, who may not hold an account.
Individuals who sign up directly, take Readiness for themselves, use the learning material or use Lenti.
People who take part in workshops, interviews or training we deliver for an organisation.
People who contact us through our website or by email.

Data we collect

Account details such as name, email, profile photo and the groups you belong to, managed through Firebase Authentication.
Assessment responses, including attitudes, self-assessed knowledge, and free-text answers such as your hopes or concerns about AI.
Answers to tools, such as surveys, quizzes and games, and, where a tool uses one, a participant code that links a person's answers without an account.
Optional survey items such as age range, which are not used to score you and which you may leave blank.
Email addresses of people a group invites, used to send and track invitations.
What you write or say to Lenti, any files you attach, Lenti's replies, and recordings of replies you ask to hear.
Attendance, names, roles, and notes or answers from workshops, interviews and training we deliver for an organisation.
Your name, email, organisation and message when you contact us.
Billing and subscription details, handled by our payment processor.
Technical data such as IP address, device information, browser type, operating system, log information, and limited local browser storage used to keep you signed in and remember preferences.

Sensitive information

We do not intentionally collect special-category personal data and we do not ask you to provide information relating to health, racial or ethnic origin, philosophical, religious, or political information, trade union membership, genetic data, biometric data used for the purpose of uniquely identifying a person, or information concerning sex life or sexual orientation. You should not include such information in free-text answers, in messages to Lenti or in files you attach. If you nevertheless choose to provide such information, we will process it only to the extent necessary for the purposes of operating the service and in accordance with applicable data protection law.

Age and young people

You must be 16 or over to hold a Mesura account, and by creating one you confirm that you are. We do not ask for your age or your date of birth. If we learn that an account holder is under 16, we suspend the account and erase it.

Readiness rounds run by a group are for adults. Whoever runs a round invites only people aged 18 or over to it. Account holders aged 16 or 17 may take Readiness for themselves.

People under 16 can use Mesura without an account in two ways only. They can answer a tool by a group link or a participant code given to them by whoever runs the tool, and they can try the learning tasters that need no account.

Every group, round and tool that collects answers declares its audience: adults, mixed, or under 18. Readiness rounds are always for adults. Where the audience is mixed or under 18, these rules apply:

Answers come only by a group link or a participant code.
The tool does not ask for names or other identifying details in free text.
We run no product analytics.
Lenti does not read the answers, and no files can be given to Lenti about them.
Results can be opened only with a password, and are never shown per person.

Lenti, our AI assistant

Lenti helps you build tools, understand Readiness reports and work through learning material. It is available only to people signed in to an account. Lenti sees only the data that the person asking is already allowed to see, in the form set out below.

Your own results. When you ask about your own Readiness, Lenti reads your own answers.
A group's results. When someone who can open a group's report asks, Lenti reads the same published figures their report shows, which never cover fewer than five people besides the person asking. Comparisons between questions need at least twenty people besides the person asking.
A tool's results. When a tool's owner asks, Lenti reads grouped figures only. For adult audiences it may also read written answers, after names, email addresses and phone numbers have been removed on our servers. It never reads answers from a mixed or under-18 audience.
Files. Files you give Lenti follow the same audience rules, and pass the same removal of names, email addresses and phone numbers before they reach the AI model.
What Lenti makes. Anything Lenti produces from a report or a tool is shared under the same rules as its source. For example, it cannot be opened by an open link when its source is a Readiness report.

To keep the free allowance fair and to prevent abuse, we count Lenti messages per account, device and network address, and free messages need a verified email address.

Lenti's replies come from an AI model provided by Anthropic. When you speak to Lenti, your voice is turned into text by Google Cloud Speech-to-Text and the recording is not kept. When you ask to hear a reply, it is read aloud by Google Cloud Text-to-Speech, and the recording is kept with the conversation. Both Google services run at Google Cloud's EU endpoints. Lenti conversations, and any recordings kept with them, are deleted when you delete the conversation or when the account or group it belongs to is deleted.

Where Lenti works on a group's data, we act as the group's processor. Where you use Lenti for yourself, we act as controller.

How we use it and our legal basis

We use personal data to provide, secure, maintain and improve the service, to generate aggregated analytics and outputs for groups, and to develop our methodology.

Each activity, the data it uses, our role and the legal basis we rely on:

What we do	Data involved	Our role	Legal basis
Run accounts and sign-in	Name, email, scrambled password, the groups you belong to	Controller	Performance of a contract with you or, where a group invited you, our legitimate interest in providing the service it asked for
Run Readiness rounds and tools for a group	Answers, free text, department and optional profile questions, invitation email addresses, participant codes	Processor	Set by the group's controller; we act only on its documented instructions
Send invitations and reminders for a group	Email addresses supplied by the group, delivery status	Processor	Set by the group's controller, as above
Answer questions with Lenti about a group's data	The figures and redacted answers described under "Lenti, our AI assistant", the question and Lenti's reply	Processor	Set by the group's controller, as above
Deliver workshops, interviews, training and other services agreed with an organisation	Names, roles, attendance, interview and workshop notes, workshop survey answers	Processor	Set by the organisation, as above
Run Readiness when you take it for yourself, and Lenti when you use it for yourself	Answers and results, your messages, files and Lenti's replies	Controller	Performance of a contract with you
Bill for paid features	Billing contact, subscription and payment records (card details stay with Stripe)	Controller	Performance of a contract; keeping records is a legal obligation
Provide support and service notices, including planned maintenance and security incident notices	Name, email, the content of your request	Controller	Performance of a contract; incident notices where the law requires them are a legal obligation
Answer enquiries and follow up on interest in Mesura	Name, email, organisation, the content of your message and our replies	Controller	Our legitimate interest in responding to people who contact us, or steps you ask us to take before entering into a contract
Keep the platform secure and prevent abuse, including Lenti's message limits	Scrambled network addresses, device and browser signals, message counts, records of staff access	Controller	Our legitimate interest, and yours, in a secure platform
Measure use and fix errors	Pages and steps used, device and browser type, error reports, never answers or typed text, and nothing from mixed or under-18 audiences	Controller	Our legitimate interest in operating and improving the platform
Create anonymised benchmarks, reports and research	Answers in grouped form only, never names or group names	Controller	Our legitimate interest in producing benchmarks and research; for group data, as permitted under our Terms of Service
Comply with the law and handle legal claims	Whatever data the request or claim concerns	Controller	Legal obligation, or our legitimate interest in establishing, exercising or defending legal claims
Administer prize draws, verify eligibility, select and contact winners, and deliver prizes	Entry details and contact information, and any information needed to verify eligibility or deliver a prize	Controller	Performance of our agreement under the prize draw terms, to the extent necessary to administer entry and award the prize

Where a group's creator is the controller, they are responsible for providing any privacy notices required by data protection law before inviting you to the group.

How we protect identity

The platform is built so that a group never sees an individual's answers. Assessment responses are stored against a one-way token rather than your account identifier. The link between that token and your account is held only within Mesura's systems: the group never sees it, and no one can read it from the platform except through the access controls described below. A group receives only aggregated figures, published in batches of at least five new people, and groups of fewer than five are never shown, so no single person's answers can be read from a change in the figures. Individual results are shown only to you, in your own portal.

This is pseudonymisation rather than full anonymity. We may access information necessary to administer the service, respond to requests, maintain security, or comply with legal obligations.

Security

We never see or store your password in a readable form. It is held by our authentication provider (Google Firebase) as a salted, one-way hash, and every account must use a password of at least ten characters with a lowercase letter, an uppercase letter and a number, which is not among the most common passwords.

To protect the platform and your data from automated abuse, such as password guessing, scraping and denial-of-service attempts, we use Google reCAPTCHA Enterprise through Firebase App Check. It assesses signals from your browser and device, including your IP address, to tell people from automated traffic, and runs in the background without asking you to solve anything. Google processes this information under its own privacy policy and terms. Sign-in attempts are limited by our authentication provider. We also limit how often other sensitive actions, such as resetting a password, sending invitations or survey emails, or opening a protected report, can be attempted from one network address or account. For this we keep only a one-way scrambled form of the address, deleted automatically within two days.

If a personal data breach affects a group's data, every Manager in that group's tree is told by email.

Our legal basis for this processing is our legitimate interest, and yours, in keeping the platform and the accounts on it secure.

Sharing and sub-processors

We do not sell personal data. We never use your answers, or anything you type or say into Mesura, to train artificial intelligence models, ours or anyone else's. We share personal data only with service providers that process it on our behalf under appropriate safeguards.

Google (Firebase) for authentication, database, file storage, and hosting of our backend, and Google reCAPTCHA Enterprise (through Firebase App Check) to protect the platform from automated abuse. Your data is stored and processed in the European Union: the database and file storage in Google Cloud's EU locations (Belgium and the Netherlands), and our backend in Belgium. Sign-in details (your email and the scrambled password) are held by Firebase Authentication, a global Google service.
Google Cloud Speech-to-Text and Text-to-Speech, at Google Cloud's EU endpoints, to turn what you say to Lenti into text and to read Lenti's replies aloud.
Anthropic for the AI model behind Lenti's replies. It receives only what Lenti may read under the rules above.
Stripe for subscription billing and payment processing. We do not store card details.
MailerSend for transactional email such as invitations and reminders.
PostHog (hosted in the EU) for product analytics: which pages and steps are used, without cookies, and never the content of answers or anything typed.
Sentry (hosted in the EU) for error and performance monitoring, without personal details or account identifiers.

Where a provider processes data outside the European Economic Area, that transfer is covered by an adequacy decision or by Standard Contractual Clauses. A current list of sub-processors is available on request.

Retention

We keep personal data only for as long as we need it for the purposes in this policy.

Accounts. Kept for as long as the account is in use. If an account has not been used for three years, we delete it after warning you by email.
Group data. Kept for as long as the group uses Mesura. If nobody in a group has used it for three years, we delete its data or make it anonymous after warning its Managers by email. When a group is closed, it has 30 days to export its data, after which we delete it or make it anonymous. Where we act for a group, its controller can ask us to delete data sooner.
When a group's owner leaves. Ownership passes to a Manager given access to that group directly, the longest-standing first. If there is none, the group is frozen: it takes no new answers and its sharing cannot change. Its Managers and Viewers are told by email and have 30 days to claim it, after which its data is deleted. Each person's own take is kept in their own account.
Lenti conversations. Kept until you delete them, or until the account or group they belong to is deleted.
Workshops, interviews and training. Kept for as long as our agreement with the organisation runs, then returned or deleted within 30 days. The organisation can ask us to delete them sooner.
Enquiries. Messages sent through our contact form are not stored on the platform. They reach our support mailbox, where we keep them, and our replies, for up to 12 months after our last exchange.
Survey links. Stop working 14 days after their survey round closes, and are deleted 30 days later.
Email delivery records. Kept for 90 days, without survey links or message content.
Customer support records. Kept for up to 12 months after the request is closed so that we can respond to follow-up queries and investigate recurring issues.
Security records. Scrambled network addresses used to limit repeated attempts are deleted within two days. Records of staff access to personal data, and other security and audit records, are kept for two years.
Prize draws. Entries are deleted 30 days after the draw, and winners' details one year after it.
Billing records. Kept for as long as Maltese tax and company law requires, currently ten years.
Product analytics and error reports. Analytics are kept for up to one year and error reports for up to 90 days.
Backups. Data deleted from our live systems is removed from backups within 90 days.
Anonymised data. Data that can no longer identify anyone is not personal data. We keep it for as long as it remains reasonably necessary for benchmarks, methodology development, reports or research, review that need at least once a year, and delete what is no longer needed.

We keep data longer than this only where the law requires it, or to establish, exercise or defend legal claims, and then only for as long as needed. You can ask us to delete your data at any time (see "Your rights"). When you do, survey answers that already count towards a group's published results are separated from you immediately, so they no longer identify you, and your written answers are removed at once. The rest leave those results at the group's next update. In a round that has closed, only the scored numbers remain, as an anonymous part of its totals.

Cookies and similar technologies

We use cookies and similar technologies, including local browser storage, to maintain user sessions, authenticate users, remember preferences and improve the functionality and security of the platform. Our product analytics run without cookies or local storage. Google reCAPTCHA Enterprise, which protects the platform from automated abuse, may set a cookie that is strictly necessary for that security purpose. Where required by law, we will obtain consent before using non-essential cookies or similar technologies.

Your rights

Subject to applicable law, you may have the right to request access to, correction of, or deletion of your personal data, may object to or restrict certain processing, and may ask for a portable copy of the data you provided. You can request deletion of your own account and data at any time from your account settings, or by contacting us. Once a deletion is carried out it cannot be undone, and you would start over as a new user with no saved history.

For data in a group, the group's controller contact answers requests for access and erasure, for the whole of its tree. If you send such a request to us, we will pass it to them and assist them in fulfilling it. If you took a survey anonymously and later created an account, those earlier responses cannot be linked to you, which also means we cannot single them out to delete on request.

To exercise your rights, email support@mesura.ai. You also have the right to complain to the IDPC (idpc.org.mt).

Changes

We may update this policy from time to time in line with legislation or changes to the service, and will revise the date above when we do. We recommend checking this page occasionally.

Contact

SeyTravel Ltd (C94462), 6 Triq il-Papa Piju XII, Birkirkara, Malta. If you have any questions regarding this Privacy Policy or the processing of your personal data, you may contact us at support@mesura.ai.