Privacy Policy

The protection of Your personal data is important to Textoscopio, Lda (“Textoscopio”, “We”, “Us”, or “Our”), the company that operates getsocialaccord.com (the “Service”) as a brand of Textoscopio, Lda. Through this Privacy Policy We inform You how We collect, use, share, and protect Your personal data in connection with the Service.

Textoscopio acts as the data controller for personal data processed through the Service. We are committed to processing personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”), the UK GDPR, the California Consumer Privacy Act (CCPA) as amended by the CPRA, the Portuguese Lei n.º 58/2019 implementing the GDPR, and other applicable privacy laws.

By creating an Account, completing the free Assessment, or otherwise using the Service, You confirm that You have read and understood this Privacy Policy. This Privacy Policy forms an integral part of the getsocialaccord.com Terms of Service.

The Controller of Your personal data is: Textoscopio, Lda.

• Tax Identification Number (NIF): 516897985
• Registered office: Rua Cidade de Nampula, 148, 5-dto, 1800-105 Lisboa, Portugal
• General contact email: info@thomasgaultier.com
• Privacy contact email: data@thomasgaultier.com
• Telephone: +351 916441499

Data Protection Officer

The Data Protection Officer (DPO) for Textoscopio can be contacted at data@thomasgaultier.com or by post at the registered office address above, marked “For the attention of the Data Protection Officer”.

When You provide personal data to Us, We process it for the following purposes and on the following legal bases:

• Service delivery (contract performance, GDPR Art. 6(1)(b)): to provide and operate the Service, including authenticating You, computing Your Social Risk Score, generating Your derisking roadmap, tracking Your progress over time, producing reports, and operating team-member access for Portfolio and Enterprise tiers. Failure to provide the required data will prevent Us from delivering the Service.
• Billing and administrative management (contract performance and legal obligation, GDPR Art. 6(1)(b) and (c)): to process subscription payments through Stripe, apply founding-member rates, manage refunds, and comply with Portuguese tax and accounting obligations.
• Sending commercial communications (consent, GDPR Art. 6(1)(a) or legitimate interest, Art. 6(1)(f)): where the law requires consent, on the basis of Your consent, which You may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal; where applicable, on the basis of Our legitimate interest in informing existing customers about related products and updates. Failure to provide consent (where required) will prevent Us from sending commercial communications.
• Responding to Your requests and providing customer support (legitimate interest, GDPR Art. 6(1)(f)): Our legitimate interest in providing You with a personalised and quality service and, where applicable, the pursuit of pre-contractual steps at the request of the data subject.
• Product improvement and Methodology calibration (legitimate interest, GDPR Art. 6(1)(f)): to compute aggregate statistics from Our own records (for example, sign-ups and assessments completed), and to refine the scoring engine and recommendation matrix using de-identified, aggregated data. We do not currently use third-party analytics or tracking tools. We do not use individual project data for calibration without aggregation and de-identification.
• Intellectual-property protection (legitimate interest, GDPR Art. 6(1)(f)): to log methodology White Paper downloads (subscriber identifier, timestamp, IP address, user agent, unique download ID) and audit trails for leak attribution.
• Compliance with legal obligations (GDPR Art. 6(1)(c)): to comply with tax, accounting, anti-money-laundering, and other legal duties applicable to Textoscopio.
• Security, fraud prevention, and dispute defence (legitimate interest, GDPR Art. 6(1)(f)): to detect, prevent, and respond to fraud, abuse, security incidents, and other harmful or illegal activity; and to establish, exercise, or defend legal claims.

Depending on the applicable purpose, We process the following categories of personal data:

• Identification and contact data: email address; on payment, first name, last name, and organisation; optionally a password (if You do not use magic-link or Google sign-in); IP address; for invoicing, billing name, address, and tax identification where applicable.
• Professional data: job title, function, and company information You voluntarily provide.
• Project Data: the inputs You provide to the Assessment (project name, country, sector, stage, region, commodity, engagement maturity, grievance mechanism status, FPIC status, community resistance, legal action history, displacement, regulatory framework selections), and the resulting computed scores and roadmap actions and statuses.
• Payment data: collected and processed by Our payment processor Stripe. We do not store full credit card numbers on Our servers. We receive and store Your Stripe customer ID, subscription tier, subscription status, billing email, and the last four digits of Your payment method as displayed in Your Account.
• Communications: when You contact Us by email or through any support form, We receive Your message and any information You choose to include.
• Technical and security data: IP address, browser user agent, and request logs processed by Our hosting provider to operate and secure the Service; short-lived rate-limit counters keyed by email address, account identifier or IP address (for example, failed sign-in attempts); dates of sign-up, last sign-in, and account cancellation or deletion.
• Team membership data (Portfolio, Enterprise and Group): when a subscriber invites a team member, We collect that member email address and the role assigned.
• Methodology White Paper download data: subscriber identifier, download timestamp, IP address, user agent, unique download identifier (UUID), terms-of-use acknowledgement timestamp.

The period for which We retain Your personal data depends on the purpose for which it was collected. Where personal data is used for multiple purposes requiring different retention periods, We apply the longer period.

After the applicable retention period, We securely delete or anonymise the data, unless We are required to retain it longer by law.

Textoscopio does not sell personal data. We share personal data only with the following categories of recipients:

6.1 Service providers (processors acting on Our instructions)

Textoscopio follows strict criteria in the selection of service providers in order to comply with its data protection obligations, signing data processing agreements that include: appropriate technical and organisational measures; processing for the agreed purposes only and on Our documented instructions; and deletion or return of personal data on completion of services.

6.2 Other sharing scenarios

• Team members: Project Data is shared with team members invited to Your Account at the access level You assign (viewer or editor).
• Legal and regulatory authorities: where required by law, court order, or to protect Our rights or the rights of others.
• Business transfers: in connection with a merger, acquisition, sale of assets, or similar corporate transaction, personal data may be transferred to the acquiring entity, subject to confidentiality obligations.
• Professional advisors: lawyers, accountants, and auditors, bound by professional confidentiality duties.

Some of Our service providers are based outside the European Economic Area, the United Kingdom, or Switzerland. Where personal data is transferred to a country that is not subject to an EU adequacy decision, We rely on appropriate safeguards:

• Standard Contractual Clauses (SCCs) issued by the European Commission, supplemented where necessary by additional technical or organisational measures.
• UK International Data Transfer Agreement (IDTA) or UK Addendum to the SCCs for transfers from the United Kingdom.
• Adequacy decisions where they apply (for example, EU-US Data Privacy Framework participants).

On request to data@thomasgaultier.com, We will provide a copy of the safeguards in place for international transfers.

Under the GDPR, the UK GDPR, and applicable national law, You have the following rights regarding Your personal data:

• Access: You may obtain information about whether We process Your personal data and receive a copy of that data.
• Rectification: You may correct inaccurate personal data and complete data that is incomplete.
• Erasure: You may request the deletion of Your personal data when, among other reasons, the personal data is no longer necessary for the purposes for which it was collected. You can delete Your Account Yourself from the Account page: it is closed at once and permanently deleted 12 months later (see Section 5). For immediate erasure, email data@thomasgaultier.com from the address on Your Account. We may decline erasure where retention is required by law (for example, invoicing records under Portuguese tax law) or to defend against legal claims.
• Objection: You may object to the processing of Your personal data based on legitimate interest, including direct marketing. We will cease the processing unless there are compelling legitimate grounds that override Your interests or for the establishment, exercise, or defence of a right in a judicial proceeding.
• Restriction of processing: You may request limitation of processing during contestation of accuracy, where processing is unlawful and You oppose erasure, where Textoscopio no longer needs the data but You need it for legal claims, or where You have objected to processing pending verification of legitimate grounds.
• Portability: You may receive Your personal data in a structured, machine-readable format and transmit it to another controller. Portfolio and Enterprise subscribers can also use the platform CSV export to download project and evolution data at any time.
• Withdrawal of consent: where processing is based on consent, You may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

If You are a California resident, You have additional rights under the CCPA as amended by the CPRA:

• Right to know what categories of personal information We collect, the sources, and the purposes for collection.
• Right to access the specific pieces of personal information We hold about You.
• Right to delete personal information, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell personal information.
• Right to limit the use of sensitive personal information. We do not collect sensitive personal information as defined by the CPRA.
• Right not to be discriminated against for exercising privacy rights.

To exercise these rights, email data@thomasgaultier.com. You may designate an authorised agent, subject to Our verification process.

We only set cookies that are strictly necessary for the Service to work. They do not require consent, so We do not show a cookie banner.

• access_token (strictly necessary): keeps You signed in. HTTP-only, expires after 15 minutes and is renewed while You use the Service.
• refresh_token (strictly necessary): renews the access token so You stay signed in. HTTP-only and only sent to Our sign-in renewal endpoint; it lasts up to 30 days if You choose to stay signed in, otherwise until You close the browser. Signing out removes it.
• oauth_state (strictly necessary): set for up to 10 minutes during “Sign in with Google” to protect the sign-in against forgery.

The Service also stores a few preferences in Your browser’s local storage (for example, an unsent assessment draft, dismissed prompts, or a skipped animation). This data stays on Your device and is not sent to Us. We do not use analytics, advertising, or other third-party tracking cookies. If We add any in future, We will update this Policy and ask for Your consent where the law requires it.

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If You believe a child has provided personal data, please contact Us so We can delete it.

We apply appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS 1.2 or higher) for all communications with the Service.
• Encryption at rest for database storage.
• Access controls, password hashing, short-lived access tokens, and refresh-token rotation.
• Regular security reviews, dependency updates, and vulnerability scanning.
• Server request logs kept by Our hosting provider, and an internal audit trail of administrative actions.

No method of transmission or storage is fully secure. We cannot guarantee absolute security. In the event of a personal data breach affecting Your rights and freedoms, We will notify the relevant supervisory authority and, where required, You, in accordance with GDPR Articles 33 and 34.

The Service may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage You to review their privacy policies before providing personal data.

Textoscopio may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. The effective date at the top of this Policy will be updated. We encourage You to review this Policy periodically. This Policy is updated in accordance with the GDPR and other applicable legislation.