Privacy statement
This statement covers the AI-in-Engineering Readiness Scan only. It explains what the scan collects, why, who else sees it, and how long we keep it. YER's general privacy statement covers everything else and stays in force: YER privacy statement.
1. Who is responsible
The controller for the personal data described here is:
« to be completed by YER »« to be completed by YER »
« to be completed by YER »
The Netherlands
Privacy questions and requests: « to be completed by YER ».
2. What we collect
| What | Where it comes from |
|---|---|
| Your work email address | You type it at the front door. It is required, because it is where your one-pager is sent. |
| Your answers and the conversation | Everything you type during the scan, and everything the AI guide replies. |
| Your readiness picture | Scores, themes, the processes you described and the ambition you stated, all derived from your answers. |
| Technical data | Your IP address and request timestamps, held in the server's memory to enforce the usage limits that protect the service. They are not written to the database and are lost when the application restarts. |
We do not ask for special-category data, and you should not enter any. Please also do not paste confidential business information, or personal data about other people — colleagues, candidates or clients. The scan does not need it.
3. Why, and on what legal basis
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Running the conversation and building your one-pager | Your consent, given at the front door before the scan starts — Article 6(1)(a). |
| Your one-pager and following up by email | Your consent — Article 6(1)(a). |
| Improving the scan, and analysing the pool of responses | Your consent — Article 6(1)(a). This analysis uses aggregated and pseudonymised data; your email address is never part of it. |
| Protecting the service against abuse and runaway cost | Our legitimate interest in keeping a free public service available and affordable — Article 6(1)(f). |
Consent is a choice. You can refuse it, and then the scan simply does not start. You can withdraw it later — see section 7 — and a withdrawal does not affect processing that already happened.
4. The AI guide, and what it is
You are talking to an AI system, not to a person. We say so on the page before you start, and we say it here.
Your answers are sent to Anthropic PBC, which runs the Claude model that conducts the conversation and fills in your readiness picture. Anthropic acts as our processor under a data processing agreement. Your answers are not used to train models.
Your email address is never sent to the model. It is stored in its own field and used only to check that you may take the scan and to follow up.
The output is generated by a model and can be wrong. Your one-pager is an indication to start a conversation with. It is not a measurement and not advice. You can correct any score before you submit, using the review panel in the scan. No decision about you is made automatically.
5. Who else sees your data
We do not sell your data, and we do not share it for anyone else's marketing. These are the only parties involved:
| Who | What for | Where | Safeguard |
|---|---|---|---|
| Anthropic PBC | The AI service that runs the conversation and builds your picture | United States | Processor under a data processing agreement, with the European Commission's Standard Contractual Clauses for the transfer. Your answers are not used to train models. |
| Fly.io | Hosting for the application and its database | Amsterdam, the Netherlands | Processor under a data processing agreement. Data stays in the EU. |
| Microsoft (SharePoint) | Storage of completed scans in YER's own document library | European Union | Processor under YER's existing Microsoft agreement. |
Inside YER, access is limited to the consultants who prepare and hold your follow-up conversation.
6. How long we keep it
| What | Kept for |
|---|---|
| The conversation transcript | 12 months after the scan is completed or abandoned |
| Your readiness record and one-pager data | 24 months after the scan is completed |
| Your email address | 24 months after the last contact, unless a client relationship starts |
| A scan you started but did not finish | 90 days, after which an unfinished scan is deleted in full |
7. Your rights
You have the right to:
- ask what we hold about you, and get a copy (Article 15);
- have inaccurate data corrected (Article 16);
- have your data deleted (Article 17);
- have processing restricted (Article 18);
- receive your data in a portable form (Article 20);
- object to processing based on our legitimate interest (Article 21);
- withdraw your consent at any time (Article 7(3)).
Email « to be completed by YER » and we will answer within one month. "Delete my scan" is a complete and sufficient request; you do not have to cite an article.
If you are not satisfied with how we handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.
8. Security
The site is served over HTTPS only. Data is stored in a database hosted in Amsterdam and reachable only by the application. Reading the collected responses requires a separate administrator credential. We use the smallest set of data that makes the scan work, which is why your IP address is never written down and your email address never reaches the model.
9. Changes
If we change this statement materially, we update the date below and change the consent wording shown at the front door, so it is always clear which version you agreed to.
Last updated: 31 August 2026.