How Flarion processes personal data.
Flarion processes personal data on behalf of the firm that invited you. This notice says what is processed, who else processes it, how long it is kept and what your rights are. It also covers visitors to this website.
Who we are
Flarion is operated by Islands AI Ltd, a Guernsey company, registration number 74458, registered at 2 Market Street, St Peter Port, Guernsey.
Our role
We process your personal data on behalf of the firm that invited you. That firm is the data controller: it decides what to collect and why. We are its processor and act on its instructions.
If you want to know why your data is being collected, what will be done with it, or how long that firm will keep it, please ask the firm first. They are the ones who can answer.
What we process
Depending on what the firm has asked you for, this may include:
- your identity and contact details, such as your name, date of birth, nationality, address, phone number and email address;
- documents you supply, and the information written on them;
- the results of sanctions, politically exposed person and adverse media screening carried out against your name;
- for an identity check, an image of your identity document and a capture of your face. A face capture is biometric data, which the law treats as a special category needing extra protection. It is used to confirm that the person holding the document is you, and for nothing else;
- if you are joining a vessel's crew, a profile photograph you choose to send and the certificates your position requires. The photograph is optional, it is shown as your picture on the firm's crew list, and it is never the image used for the identity check;
- if you correspond with the firm by email or meet its staff, and the firm captures from Outlook, the dates and counts of that contact: that an email passed between you and a member of staff on a given day, how many that day, and that a meeting took place. Nothing else is captured: no subject line, no message content, no attachment, no message identifier. It is read from that staff member's own mailbox and calendar with their permission, each of them can withhold it, and the firm can switch the capture off;
- if you meet the firm's staff in person and the meeting is recorded, the audio and a transcript. A recording is made only after each person in the room has been asked and has agreed, and anyone may withdraw, which deletes the audio, the transcript and any draft. The audio is deleted once it is transcribed unless the firm chooses to keep it; the transcript is kept for the period the firm sets, a year unless it sets another;
- if you send us a note about the product, a picture of the page as it looked on your screen at that moment, together with what you wrote and which part of the page you pointed at. It is taken only when you write a note, it is stored by us and sent to no one else, and it may show whatever was on the page at the time.
When Islands AI looks at a firm's account
To fix a problem where it happens, Islands AI staff can view a firm's account as one of its users. Each view needs a reason, which is recorded. It is read only unless the firm has allowed edits, it ends by itself after thirty minutes unless the firm sets another limit, and it is recorded permanently, append only, on our log and on the firm's own activity trail, so the firm can see that it happened and why.
Errors in the firm's browser
When a page fails in the browser of a firm's own signed-in staff, we keep a record of the error so that we can fix it: the page's address without its query, and the error's own message and stack with quoted text, email addresses, long numbers and the query of every web address removed. No form values, names or document content are read. These records are kept for thirty days unless the firm sets another period. People a firm invites to complete a form are not covered by this.
Who else processes it
We use the service providers below. Each acts on our instructions, for the purpose named and no other. None of them is permitted to use your data for its own purposes, and none of it is used to train an artificial intelligence model. The data processing agreement we sign with the firm carries the same list and is available on request.
Identity document verification and liveness checking, including biometric processing of your face capture. Receives the images of your document and your face, and the name and date of birth to compare them against.
Identity document verification, where the firm uses it instead of Didit. Receives the same as Didit would. Where ComplyCube deletes a record, it is taken out of use at once and removed permanently after their safety delay, thirty days unless the firm has agreed otherwise with them.
Processes data in: the region the firm has recorded for its own account.Sanctions, politically exposed person and adverse media list matching. Receives your name and, where the firm holds them, your date of birth and nationality, to be matched against published lists.
Web search about the person or entity screened, for adverse media. Receives only the name searched and the firm's own keywords; the results come back to the firm for a person to judge.
Processes data in: the United States, where Serper is operated.Reading and drafting with an AI model, for eight things: reading adverse media results about a screened name; reading the details off an identity document or a staff training certificate; drafting the firm's periodic review memo; rewording the brief before a meeting with you; summarising email threads between the firm and your people; drafting staff training courses from the firm's own manuals; drafting minutes from a recorded meeting's transcript; and suggesting where the columns of a business development spreadsheet belong. Each call receives only the material for that one task, and a person checks the result. Board papers are never sent, and nor are a board meeting's minutes unless the firm switches that on.
Processes data in: London (eu-west-2), on a London-only model with no cross-region routing.Turning speech into text when a firm records an in-person meeting, after the people in the room have agreed. Receives the meeting audio.
Processes data in: London (eu-west-2).Finding your address on the onboarding form, where the firm has switched the address finder on. Only what you type into the Find address box and the country you chose are sent, so that it can offer you a list to pick from. Your name and the rest of the form are never sent to it.
Processes data in: the United Kingdom.Delivering email, such as the invitation that brought you here. Receives your email address and the message. No documents are ever attached.
Carrying traffic between your browser and Flarion, and serving this website. Everything you send passes through it in transit, including your IP address.
Processes data in: its global network, as traffic in transit. It is not where your data is stored.The booking calendar on the demo page of this website. Sees your IP address when the page loads it, and receives the name, email address and any note you give it when you book a time. It is not used anywhere in the product.
When you sign the declaration, the firm records the internet address it came from and looks that address up on its own server, using MaxMind databases held there and refreshed weekly, to note the town, country and network. Nothing is sent to anyone else to do this.
Processes data in: Guernsey, on the firm's own server.Hosting: running the application and its database, which is where your data is stored, and backing them up.
Processes data in: Guernsey. Production runs in Sure's Tier III data centre in Guernsey, with Sure's nightly backup and a copy held in Jersey.How long it is kept
Identity verification data held by the provider is erased on a schedule, once it passes the retention limit the firm has set. Where the firm has set none, that limit is twelve months. A firm can switch this erasure off, in which case the provider keeps the data until the firm asks for it to be removed.
The firm's own records, that a check was run, when, and what it returned, are kept separately and for longer, because the firm's regulatory obligations require it. For a Guernsey fiduciary that is at least six years under Fiduciary Rule 2.6.4(1). Those records are not erased by the process above.
Your rights
Under the Data Protection (Bailiwick of Guernsey) Law, 2017 you have the right to ask for a copy of your personal data, to have inaccurate data corrected, to object to processing or ask that it be restricted, and in some circumstances to have your data erased.
Because the firm that invited you is the controller, please make any of those requests to them. We will help them answer it. If we receive a request directly we will pass it to them and tell you we have done so.
If you are not satisfied with how a request has been handled, you may complain to the Office of the Data Protection Authority, Guernsey, at odpa.gg.
Visitors to this website
flarion.ai is a static site. It sets no cookies of its own and runs no analytics. It is served through Cloudflare, which sees your IP address in transit.
The demo page can load one thing from elsewhere: the Cal.com booking calendar. Nothing of it loads until you ask for it, by pressing "Show the calendar" or a "Book a walkthrough" button that opens it, so simply reading the site sends Cal.com nothing. Once it loads, it sees your IP address and sets its own cookies inside the calendar, and booking a time gives it the name, email address and any note you type. That is the only third party any page here loads, and it is the only one you have to choose.
If you send the access form, the walkthrough form or the due diligence pack form, what you type in it reaches us by email and is kept so that we can reply. We do not add you to a mailing list and we do not pass it to anyone else.
Contact
For privacy questions about Flarion itself, write to Islands AI Ltd, 2 Market Street, St Peter Port, Guernsey, or email info@flarion.ai.
For questions about why your data was collected, contact the firm that invited you.
Questions about any of this?
Write to us and the founder replies. Firms running a vendor review should ask for the Due Diligence Pack, which carries the same facts in the form the review needs.