Privacy Policy

SafeRise Protocol
Operated by Kenor International B.V., Sint Maarten
Last updated: 16 October 2026
Version 2026-10-16.9e9b8de3

The short version

Your voice is never sent anywhere. Speech becomes text on your own device and the recording is discarded as it goes.

What you type — journal entries, decisions, your own statements — stays on your device unless you send it. We never receive it otherwise and cannot read it.

If you use a Sovereign session with AI feedback on, the written record of that session is sent to be read, and the reflection comes back to you. It is never used to train anything, and nobody at your organisation can see it. You can switch it off.

If you send a question to SafeRise AI, that question is sent to be answered from SafeRise's own material. It is never used to train anything. We keep a count that you asked, not what you asked.

If you ask SafeRise to reflect on your record, only the entries you tick are sent, once, for that reflection. They are not kept, and never used to train anything.

If you use Connections, what you send is sealed on your device before it leaves, and only the people in that conversation can open it. SafeRise holds it but cannot read it. We do see who is in a conversation and the shape of the activity in it — that someone replied, liked a message or, if you allow it, viewed something — because that is what lets us tell you something is waiting. If anyone in a conversation asks SafeRise’s AI to help with a reply, that conversation’s words are sent once to be answered, and not kept.

What we do hold is small: your email address, whether your subscription is active, and anonymous counts of which material is being opened. That last part tells us which protocols people find useful. It does not tell us anything about what you wrote or what you were feeling.

We do not sell data. We do not run advertising. We do not share your information with anyone except the small number of services listed below that are needed to run the platform.

The rest of this page explains all of that properly.

1. Who is responsible for your data

Kenor International B.V., registered in Sint Maarten, is the data controller.

Address: Union Road #144B, Cole Bay, Sint Maarten
Contact: contact@thesaferiseprotocol.com

2. What we collect

Your account

• Email address
• An encrypted form of your password — we never see the password itself
• The date you created the account
• Which version of our Terms and of this policy you agreed to, and when. Each version is named on the page itself, beside its date. For accounts created before 7 October 2026 we record that we do not know which version was seen, rather than guessing

Your subscription

• Whether your subscription is active, past due or cancelled
• The date your current period ends
• Identifiers linking your account to your payment record, once paid membership opens

We do not collect card details. No payment is taken through SafeRise today; when that changes, this policy will name the company that processes payments and say what it receives, before any payment is possible.

How the platform is used

When you open something, we record a short line: which account, what kind of event, which item, and when. For example: account 4f2b · protocol opened · t2-03 · 14 March, 09:12.

The events we record are: account created, session started, session completed, protocol opened, resource opened, journal entry saved.

"Journal entry saved" records that a save happened. It records nothing about what was written. We built it deliberately so that it cannot.

What you write

Your journal entries, session notes and personal record are stored on your device only. They are not uploaded, not backed up by us, and not readable by us.

The one exception is a Sovereign session with AI feedback switched on. That session's written record — the transcript and your two ratings — is sent to our model provider to be read. Your name, email and account id are not sent with it. See section 5.

A question you choose to send to SafeRise AI is not something you wrote and kept: you sent it to be answered. It is matched to SafeRise material inside our own database host, Supabase, and then sent to our model provider, Anthropic, to be answered — without your name, email or account id. We record that a question was asked, how much of your allowance it used and whether it was answered — never the question and never the answer. See section 5.

Asking SafeRise to reflect on your record works the same way. You see the entries that would be sent and choose which ones go; those entries leave this device once, with that request, to be read and answered, and are not stored by us or recorded anywhere. Nothing from your record is ever sent unless you choose it this way, and none of it is ever visible to an organisation, in any form.

The consequence is worth being clear about: if you clear your browser data, or lose the device, that record is gone and we cannot recover it. We think that trade is the right one, but it is your decision to make knowingly.

If a partner referred you

If you reached SafeRise through a partner’s link or QR code, or entered a partner’s referral code when you signed up, we record which partner it was, how you arrived (a link, a QR code, a code, or an introduction), and the campaign labels on that link. Until you create an account this sits in your browser’s local storage and nowhere else. When you create your account it is sent once, with that request, attached to your account, and removed from your browser. If you never sign up, it never leaves your browser.

A partner learns only commercial facts: that a referral became a customer, the revenue collected, and the commission it earned. Never what you read, write, record or do in SafeRise, and never anything from your journal or your record. This is enforced in the database, not only on a screen.

What you mark

If you mark a resource as one that resonates with you, or as one you want to work with, we keep that mark with your account — which resource, and when — so it is there on your other devices and when you look back over your record. The mark is a mark, nothing more: nothing you write goes with it. Only you can see your marks. SafeRise counts how many members have marked each resource, only where enough people have that nobody can be picked out, and never who. You can clear a mark whenever you like.

Connections

If you connect with someone — a partner, a parent, a friend — or join a conversation with several of them, we hold:

• that you are connected, the kind of connection you chose, and when
• your public key, and your private key locked with a recovery passphrase only you know. We cannot unlock it, and we cannot recover it for you
• each conversation and message, sealed on your device before it is sent. We store them but cannot read them: not the words, not what was shared, not what it was about
• who is in each conversation. A conversation can include more than two people: anyone in it can add someone they are already connected with, and that person can then read the whole conversation, including what was written before they joined. Everyone in it is told who was added
• the plain facts the service needs to work: who opened a conversation, when things were sent, whether a conversation is open, parked or worked through, whether you said you’d received something, and whether anyone asked to delete it
• likes: that you liked a message, and when. Everyone in that conversation can see it
• saves: that you saved a conversation. Only you see this; nobody is told
• “seen”: when you first open something another person shared or wrote, if you have “Let people see when I’ve viewed” turned on. It is on unless you turn it off, and it works both ways: with it off, we keep no record of when you viewed anything, and you don’t see when others viewed yours
• notifications: a short list of what happened for you — who replied, liked, shared, viewed or added you, and in which conversation. We hold only a reference to the conversation; its title is sealed and is shown to you by your own device. Notifications never contain what anyone wrote
• your email choices: each time, once a day or off, and for which kinds of activity, and when we last emailed you
• an invitation’s email address, until it is accepted, withdrawn or expires (14 days)

What you call the other person is sealed with your own key; they never see it, and we can’t.

On your device only, we keep the list of what has been shared with you, so you can open it for 30 days even if it isn’t part of your own membership.

Asking SafeRise’s AI about a conversation. Help me reply and Find something to attach send the words of that one conversation — yours and the other people’s — to be answered, the same way as a question you send to SafeRise AI: matched inside Supabase, answered by Anthropic, never stored by us, never used to train anything. Everyone is told this before they connect.

Technical information

Our host records standard server logs — IP address, browser type, pages requested — for security and for keeping the site running. These are kept briefly and are not used to build a profile of you.

We do not use advertising or tracking cookies. We use one small piece of local storage to remember whether you chose the light or dark theme, which stays in your browser, and, only if you arrived through a partner’s link, one to remember which partner until you create an account (above).

3. What we do not collect

We want to be explicit, because of what this platform is about.

We do not collect health data. We do not ask about diagnoses, conditions, medication or treatment, and there is nowhere on the platform to enter them. We do not infer a health condition from which protocols you open, and we do not attempt to.

Which protocol you opened is, of course, suggestive. We treat that information as sensitive for exactly that reason, keep it aggregated, and never look at it person by person.

What you type stays on your device. Journal entries, decisions and statements you write are stored on the device you wrote them on. We cannot read them, we do not back them up, and we could not recover them for you. If you clear your browser data or change device, what you have written can be lost. The one thing you write that leaves your device is what you send through Connections, and it leaves sealed: we store it, and we cannot read it.

Your voice is never sent anywhere. In a Sovereign session, speech becomes text in your own browser and the audio is discarded as it goes. It is not uploaded, not stored, and not recoverable — by us or by anyone.

4. Why we hold it, and on what legal basis

Where we rely on legitimate interests, we have weighed that against your privacy. It is why usage data is aggregated, why no one drills into an individual record, and why nothing you type is ever transmitted.

5. Who else is involved

We use a small number of providers. Each one only receives what it needs.

What is sent for AI feedback, and any question you send to SafeRise AI, is never used to train any model. If you switch AI feedback off, nothing from your sessions is ever sent; if you do not send a question, nothing is sent.

We do not sell your data, and we do not share it with anyone for their own marketing.

We may disclose information if the law requires it, or to protect someone's safety.

6. Where your data is held

Your account and usage data are stored in the European Union, in Frankfurt, Germany.

One exception: if you turn on AI feedback, that session's written record is processed by Anthropic, our model provider, on infrastructure outside the European Economic Area — and so is a question you choose to send to SafeRise AI, with any record entries you chose to include. Your account data does not leave Frankfurt.

Kenor International B.V. is based in Sint Maarten, which sits outside the European Economic Area and is not covered by an EU adequacy decision. When we access data from there, that is an international transfer. Processing a Sovereign session record outside the EEA for AI feedback is a second one. We rely on [TRANSFER MECHANISM — see note] to make both lawful.

7. How long we keep things

• Account data: while your account is open, then 30 days after you close it, then deleted.
• Usage events: 13 months, then deleted. Aggregate totals with no link to any account may be kept longer.
• Correspondence: 24 months — long enough to cover a repeat enquiry or a dispute.
• Marketing list: until you withdraw consent, plus 30 days.
• Server logs: 30 days.
• Your marks on resources: while your account is open, and deleted with it. A mark you clear stays cleared.
• Which partner referred you: while your account is open, and deleted with it. Commission paid to a partner is a billing record and is kept as one, without your activity in it.
• Billing and financial records: once paid membership opens, kept for as long as tax law requires — typically seven years — because that is a legal obligation, not our choice. This period overrides the ones above for the transaction record only.
• Questions you send to SafeRise AI: we keep a record that a question was asked, the allowance it used and whether it was answered — never its words. Supabase does not store the question. Our model provider's retention for it is the same as for AI feedback: up to 30 days for abuse monitoring, then deleted.
• Connections: while the connection is open. If either of you leaves, it becomes read-only and is deleted 30 days later. A conversation everyone in it asks to delete is deleted at once. If you leave a conversation with several people, you stop seeing it; what you wrote stays for the others until the conversation is deleted. If you close your account, what you wrote goes with it; what others wrote stays with them until the 30 days end. Likes, saves and “seen” go with the conversation. Notifications are deleted after 90 days. An invitation’s email address is cleared when the invitation ends, at most 14 days.
• What you write: on your device, under your control. Deleting it there deletes it entirely. A Sovereign session record sent for AI feedback is held by our model provider for up to 30 days for their own abuse monitoring, then deleted. It is never used to train anything.

Backups can hold data for a short time after it is deleted everywhere else, while the backup itself ages out on its own schedule. We would rather tell you that than have you find out by asking.

8. Your rights

If you are in the EU or UK, you have the right to:

• See what we hold about you
• Correct anything wrong
• Delete your data — the "right to be forgotten"
• Restrict how we use it while a question is being resolved
• Take it with you in a portable format
• Object to processing based on legitimate interests, including usage analytics
• Withdraw consent at any time, where consent is what we relied on

To do any of these, write to contact@thesaferiseprotocol.com. We will respond within 30 days, and there is no charge.

You do not have to explain why, and asking will never affect your access or how you are treated.

Objecting to usage analytics. If you would rather we did not record which material you open, tell us and we will switch it off for your account. Everything else keeps working.

Complaints. If you think we have handled your data badly, please tell us first. You also have the right to complain to your national data protection authority.

9. Security

Passwords are hashed, never stored in readable form. Traffic is encrypted in transit. Access to the production database is restricted, and the fields controlling your subscription cannot be changed from a browser — not by anyone's, including yours. They are writable only by the server.

No system is perfectly secure. If a breach occurs that puts you at risk, we will tell you and the relevant authority within 72 hours.

10. Children

SafeRise is for adults. You must be 18 or over to create an account. We do not knowingly collect data from children, and will delete it promptly if we discover we have.

11. Automated decisions

We do not make automated decisions about you that have legal or similarly significant effects. There is no profiling. We do not recommend protocols based on your behaviour.

AI feedback is not a decision about you and not an assessment of you. It reads back what you said in your own words — what you returned to, what changed between the start and the end — and it is bound to what is actually in the record. It does not diagnose, it does not infer a condition, and it never adds a statement you did not make. Nothing follows from it automatically: no score, no flag, no change to your account, and nothing sent to anyone.

12. Changes

If we change this policy in a way that materially affects you, we will email you at least 14 days before it takes effect. The date at the top always shows the current version.

Anything at all about your privacy: contact@thesaferiseprotocol.com