Privacy Notice

Who we are

Truly Suited is a trading name of Buvo Ltd, a company registered in England and Wales (company number 15846940), ICO registration ZB805946. Registered office: 320 Firecrest Court, Warrington, WA1 1RG. Buvo Ltd decides how your information is used, so we are in charge of it under UK data protection law (the "controller"). Questions: hello@mybuvo.co.uk

Who can use Truly Suited

Truly Suited is for adults aged 18 and over only.

What happens to your conversation

Each message you send goes to an AI model (Claude, made by Anthropic) so it can write the next question. At the end, your whole conversation goes to the model again to write your report. Your conversation is never stored on our servers. Your report is written on our server, sent to your browser and not kept by us. You save it yourself.

The interviewer also keeps working notes about your session so it can follow the thread of the conversation. Those notes travel with your conversation in a locked (encrypted) form that only our server can read. They are never shown to you or stored on our servers, and are used only to continue your conversation and write your report.

What we keep, and for how long

• On your device. So you can pick up where you left off, your browser keeps a copy of the conversation and a short-lived session key (it stops working 90 minutes after your last answer). Both are removed when your report is shown, when you choose Discard on the start screen, or when you next open the page 24 hours or more after your last answer. If you never open the page again, they stay in your browser until you clear your browser data.
• Your access code record. The code, its dates and whether it has been used. Kept until 90 days after the code is used or expires, then deleted.
• Your email address, if you asked for your code by email. Kept next to the code for 7 days, so a second free code cannot go to the same address, then deleted. The email we sent you is deleted from our sent mail after 30 days. The system that sends it (n8n) does not keep a copy.
• Hosting logs. Technical records such as your IP address and the time of each request. They never contain your conversation or your email address. Kept for about 1 day.
• Usage limits. To stop misuse we count requests against a shortened code made from your IP address. The counts are held only in the server's memory, for 24 hours at most, and are never stored.

Access codes

Entry to Truly Suited needs an access code. We store the code and its status (issued, used or expired, and the dates) in our Airtable database, so we can check it is valid. While your report is being written, a random session reference is held against the code so it can only produce one report. It is cleared as soon as your report is delivered. If a session stops before then, the reference stays until the code is next used or deleted. The only thing on the code record that can identify you is your email address, if you asked for your code by email, and that is deleted after 7 days.

Why we are allowed to use your information

• The interview and your report: we need to use your information to give you what we agreed to provide (contract, Article 6(1)(b) UK GDPR).
• Your email address and code: you asked us to send you a code, so we need your email address to do it (steps at your request, Article 6(1)(b)).
• Security logs and stopping misuse: we have a fair reason to keep the service safe and working (legitimate interests, Article 6(1)(f)).

Sensitive information

The interview may bring up sensitive information. This may include your health, neurodiversity, mental wellbeing, religious or philosophical beliefs, sex life or sexual orientation, racial or ethnic origin, political opinions or trade union membership. The law gives this kind of information extra protection (special category data, Article 9 UK GDPR). We only use it because you clearly agree to it on the start screen before you begin (explicit consent, Article 9(2)(a)).

You can take back your consent at any time. Close the page. When you next open Truly Suited, the start screen says you have an unfinished session saved on this device: choose Discard to remove it. You can also clear your browser data. Messages you have already sent cannot be called back, but the AI services do not keep them.

Who processes your information for us

These companies handle information only on our instructions, under a written data processing agreement:

• Vercel Inc. hosts the app. Its servers for Truly Suited are in London.
• OpenRouter, Inc. passes each message to the AI model and sends back the reply. We have set it so that neither OpenRouter nor the company running the model keeps your conversation or trains AI on it.
• Claude models made by Anthropic, run for us on Amazon Web Services or Google Cloud. We ask for European servers first.
• Airtable stores access codes.
• n8n sends the email with your code.
• Google (Gmail) is the mailbox that sends the code email.

Data transfers outside the UK

Some of these companies are based in the US or the EU, so your information may be handled outside the UK. We only allow this under legal contracts that UK law approves for the purpose:

• Vercel and Airtable: an approved UK contract (the UK International Data Transfer Agreement).
• OpenRouter and n8n: approved EU contracts with UK terms added (the EU Standard Contractual Clauses with the UK Addendum).
• Google: Google's own data processing terms.

Not therapy or a clinical assessment

Truly Suited is a self-reflection tool. It is not therapy, counselling, or a clinical or validated psychometric assessment, and it does not provide medical, legal, or financial advice. If you are struggling or in distress, please speak to your GP, call NHS 111, or contact Samaritans free on 116 123 (UK), any time. In an emergency, call 999.

Cookies and tracking

This service does not use cookies or any analytics tracking. No tracking scripts are loaded. The only thing saved in your browser is the session copy described above.

Your rights

You have the right to (under UK GDPR):

• see the information we hold about you (access);
• have it corrected (rectification);
• have it deleted (erasure);
• ask us to limit how we use it (restriction);
• object to how we use it (objection);
• get a copy to take elsewhere (portability);
• withdraw your consent at any time.

What we hold about you is your access code record and, for 7 days, your email address. We can show you these, correct them or delete them early. Your conversation and report are not on our servers. Anything else is on your own device: the saved session, which you can remove with Discard or by clearing your browser data, and any report you saved.

Send every request to us at hello@mybuvo.co.uk. We handle it for you, including anything held by the companies that process information for us. You do not need to contact them yourself. We will reply within one month.

If you are unhappy with how we use your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.