Privacy Policy

1. Identity of the data controller

The data controller responsible for the personal data collected through elara.onrewire.com is On Rewire, a trade name owned by Gustavo Vivas Marquez, domiciled in Buenos Aires, Argentina.

For any inquiries related to this policy or the exercise of your rights, you may contact us at contacto@onrewire.com.

2. Personal data we collect

We collect the following personal data when you use Elara:

• Professional identification data: first and last name, corporate email, company, role or position, industry, organization size (number of employees).
• Assessment responses: your numeric (0-4 scale) and open-ended answers to the data maturity or AI governance questions.
• Technical metadata: IP address, browser, operating system, date and time of the assessment, duration. This data is processed through our hosting provider (Vercel).
• Authentication data (On Rewire internal Dashboard only): @onrewire.com corporate email, Google profile name and photo, exclusively for On Rewire internal staff.

We do not collect sensitive data (racial or ethnic origin, political opinions, religious beliefs, health data, sex life, genetic or biometric data) or data from minors. If we detect data from minors, it is immediately deleted.

3. Purposes of processing

We process your personal data for the following purposes:

1. Generation of a personalized executive maturity report based on your responses, using generative AI models.
2. Delivery of the report to the email address you provided, via a transactional email service.
3. Commercial follow-up communication, if you have explicitly consented, by the On Rewire team to provide deeper insights into the findings.
4. Aggregate statistical analysis (non-identifiable) to improve product quality, calibrate industry benchmarks, and train our internal models.
5. Compliance with applicable legal obligations of On Rewire.

4. Legal basis for processing

The legal basis for processing your data varies by jurisdiction:

• Argentina (Law 25,326): free, express, and informed consent, given by completing the form and submitting the assessment.
• European Union (GDPR / Regulation 2016/679): consent (Art. 6.1.a) and legitimate interest (Art. 6.1.f) for aggregate product analysis.
• Mexico (LFPDPPP): implied consent by completing the form, with the right to object subsequently.
• Brazil (LGPD - Law 13,709): consent (Art. 7.I) and legitimate interest (Art. 7.IX).

5. Processors and international transfers

To operate the service, we share your data with the following processors (data sub-processors), under contract and with equivalent safeguards:

On Rewire ensures that each processor meets minimum standards equivalent to Law 25,326 and the GDPR. We do not sell or transfer your data to third parties for commercial or advertising purposes.

6. Data retention period

We retain your personal data for the following periods:

• Assessment data (session, responses, report): 5 years from the date of the assessment, unless you exercise your right to deletion earlier.
• Professional contact data: until you request removal or for a maximum of 5 years of inactivity.
• Technical logs: 90 days.
• Dashboard authentication data: for the duration of the employment relationship with On Rewire.

Once the retention period expires, data is deleted or irreversibly anonymized.

7. Your rights (ARCO / GDPR / LGPD)

As a data subject, you have the following rights:

• Access: obtain confirmation of what data we process about you and a copy thereof.
• Rectification: request correction of inaccurate or outdated data.
• Erasure / "Right to be forgotten": request deletion of your data when it is no longer necessary or you withdraw your consent.
• Objection: object to the processing of your data on legitimate grounds.
• Portability (GDPR/LGPD only): receive your data in a structured, machine-readable format.
• Restriction of processing (GDPR only): request that we pause processing while a concern is being verified.
• Withdrawal of consent: withdraw your consent at any time, without retroactive effect.
• Complaint to supervisory authority: file a complaint with the competent authority in your country.

To exercise any of these rights, write to us at contacto@onrewire.com indicating:

• Your full name and the email you used for the assessment
• Which right you wish to exercise
• A copy of an identity document (only if the request is for total deletion)

We respond within a maximum of 10 business days (Argentina) or 30 days (EU/Brazil/Mexico).

8. Supervisory authorities

If you believe we are processing your data in violation of applicable regulations, you may file a complaint with:

• Argentina: Agencia de Acceso a la Informacion Publica — www.argentina.gob.ar/aaip
• European Union: the data protection authority of your country of residence
• Mexico: Instituto Nacional de Transparencia (INAI) — www.inai.org.mx
• Brazil: Autoridade Nacional de Protecao de Dados (ANPD) — www.gov.br/anpd

9. Data security

On Rewire implements reasonable technical and organizational measures to protect your personal data: TLS 1.3 encryption for all communications, storage in databases encrypted at rest, access restricted by multi-factor authentication for authorized personnel, and periodic permission reviews. However, no security measure is 100% infallible — if you detect a vulnerability, please write to contacto@onrewire.com.

10. Use of cookies

Elara uses strictly necessary cookies for the application to function (maintaining your active session, remembering your responses during the assessment). We do not use marketing, advertising, or third-party tracking cookies. Traffic measurement is performed with Plausible Analytics, which does not use cookies and does not collect personal data.

For internal Dashboard administrators, an additional authentication cookie (NextAuth.js) is used, which expires upon sign-out.

11. Automated decisions and AI

The executive report generated by Elara is created by a language model (Mistral Large) processing your responses. The report is for guidance purposes and does not constitute a binding decision about your organization. It does not make decisions that produce legal effects on you.

If you have objections to the automated analysis, you may contact us for a human review of the report (at no additional cost).

12. Changes to this policy

We may update this policy. The current version is always published at elara.onrewire.com/en/privacy with its last update date. Material changes will be notified by email to active users.

13. Contact

For any inquiries about this policy, the processing of your data, or to exercise your rights:

contacto@onrewire.com
onrewire.com
Buenos Aires, Argentina