Privacy Policy
This Privacy Policy explains how SPHR LLC (“SPHR”, “we”, “us”, “our”) collects, uses, shares, and protects personal data when you visit sphr.world or request an SPHR account through our join page. It also describes your privacy rights and how to exercise them.
1. Who we are
SPHR LLC is the data controller responsible for your personal data. SPHR is an enterprise AI consultancy operating across the United States, Brazil, Australia, and Japan.
- Controller: SPHR LLC (United States)
- Privacy contact: privacy@sphr.world
- General contact: hello@sphr.world
2. Data we collect
We collect only what we need to operate the site and provision SPHR accounts.
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Full name, email address, LinkedIn profile URL, location (city/country) | You, via the join form |
| Account & eligibility | Signup code (identifying the SPHR member who referred you); the SPHR account we create for you (username/UPN and account identifier) | You; generated by us |
| Programme profile | Country, and optionally date of birth, job function and experience level, that you provide at join; cohort/training statistics derived from your practice & exam activity | You (at join); generated by us |
| Technical & security | IP address, request metadata, and anti-abuse signals (CAPTCHA result, rate-limit counters) | Automatically, when you submit the form |
| Usage analytics | Pages viewed, approximate location, device/browser — only if you accept analytics cookies | Google Analytics (opt-in) |
| Communications | Onboarding and account emails we send you (a copy is sent to SPHR founders — see §5) | Generated by us |
We do not intentionally collect special-category (sensitive) data, and we ask you not to submit any.
3. How & why we use it
We process your data for the purposes below. Where the EU/UK GDPR or Brazil’s LGPD apply, the legal basis is shown; under the Australian Privacy Act we process personal information for these related primary purposes.
| Purpose | Data used | Legal basis (GDPR / LGPD) |
|---|---|---|
| Create your SPHR account and send onboarding instructions | Identity & contact, account | Performance of a contract / steps at your request (you provided a signup code) |
| Run and improve the CCA-F training programme — cohort statistics (participation, readiness, and results by country, role, and experience) | Programme profile, training activity | Legitimate interests (operating the training programme) |
| Notify SPHR founders of a new join (name, location, LinkedIn, account identifiers) via a private channel | Identity & contact, account | Legitimate interests (operating and governing the SPHR network) |
| Protect the form from spam, brute-force, and abuse | Technical & security | Legitimate interests; legal obligation (security) |
| Measure and improve the website | Usage analytics | Consent (you may decline) |
| Maintain records and comply with law | Most categories | Legal obligation; legitimate interests |
Where we rely on consent (analytics), you can withdraw it at any time via the “Cookie preferences” link in the footer, without affecting prior processing.
4. Cookies & analytics
We use a small number of cookies and similar technologies. Analytics cookies (Google Analytics 4) load only after you click “Accept” on our cookie banner — nothing is set if you decline. Strictly-necessary cookies set by our hosting/security provider keep the site available and secure. Full details, names, and durations are in our Cookie Policy.
5. Who we share it with
We do not sell your personal data. We share it with service providers (processors/sub-processors) that help us run the service, and with SPHR’s founders for onboarding and governance. Each provider may process data in the United States and other countries.
| Recipient | Purpose | Where |
|---|---|---|
| Microsoft Corporation (Microsoft 365, Entra ID, Microsoft Graph) | Creating and hosting your SPHR account and mailbox | USA / global |
| Cloudflare, Inc. (Pages hosting, Turnstile, Workers KV) | Website hosting, bot/abuse protection, rate-limit & lead storage | USA / global edge |
| Google LLC (Google Analytics 4) | Website usage analytics — only with your consent | USA / global |
| Twilio SendGrid | Transactional email delivery (your onboarding email), when email delivery is enabled | USA / global |
| Telegram FZ-LLC (Telegram Messenger) | Delivering new-join notifications, and (when used) relaying your first-sign-in credentials, to a private SPHR channel | Global |
| SPHR founders | Onboarding and governance; they may also receive your first-sign-in credentials (a temporary, time-limited access pass and a temporary password, used only for first sign-in) to relay them to you | USA, Brazil, Australia, Japan |
We may also disclose data where required by law, to protect our rights, or as part of a business transfer.
6. International data transfers
Because we and our providers operate globally, your personal data may be transferred to and processed in countries other than your own, including the United States. Where such transfers are subject to the GDPR, LGPD, or the Australian Privacy Act, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses, the ANPD-approved Standard Contractual Clauses (Cláusulas-Padrão Contratuais) for transfers from Brazil, the contractual protections in our providers’ data processing agreements, and (where relevant) your consent. You may request more information about these safeguards using the contact details below.
7. How long we keep it
| Data | Retention |
|---|---|
| SPHR account & member records | For as long as your SPHR account is active; deleted when the account is off-boarded (and in any case not kept in our operational store beyond 24 months) |
| Lead / signup audit log | Up to 24 months |
| Signup codes | 24 hours (then expire automatically) |
| Anti-abuse counters | Up to 15 minutes (per-IP) / up to ~48 hours (daily cap) |
| Cookie-consent choice | Stored in your browser until you change it (via “Cookie preferences”) or clear your site data |
| Analytics data | Up to 14 months (Google Analytics maximum), then automatically deleted — see the Cookie Policy |
8. How we protect it
We apply industry-standard safeguards: encryption in transit (HTTPS/HSTS), a strict Content Security Policy and other security headers, CAPTCHA and rate-limiting on the join form, least-privilege access for our systems, secrets stored only in our hosting provider’s encrypted environment (never in our code), and short-lived, time-limited onboarding credentials. No method of transmission or storage is completely secure, but we work to protect your data and review our controls regularly.
9. Your rights
Depending on where you live, you have rights over your personal data. These generally include the right to access your data, to correct it, to request erasure, to restrict or object to processing, to data portability, and to withdraw consent. Under Brazil’s LGPD you also have the right to information about sharing and to review automated decisions; under the Australian Privacy Act you may access and seek correction of your personal information.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The CAPTCHA and rate-limiting on the join form are used only to prevent abuse, not to evaluate you.
To exercise any right, email privacy@sphr.world. We will respond within the timeframe required by applicable law (generally within 30 days). We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority — for example the ANPD (Brazil), your local data protection authority in the EU/EEA/UK, or the OAIC (Australia). We’d appreciate the chance to address your concern first.
10. Children
The site and SPHR accounts are intended for working professionals aged 18 and over and are not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, take additional steps where required by law.
12. Contact
Questions or requests about privacy: privacy@sphr.world. See also our Cookie Policy and Terms of Service.