Privacy
What we process, and what we deliberately never ask for.
This statement describes the data flows of the Libera platform as it is actually built today. Where a commitment depends on the contracting entity, the hosting region or an agreed retention schedule, it is marked as outstanding instead of being guessed.
Draft for pilot review
Draft for pilot review. This document describes how the product works today and is not a signed agreement. The final terms, data processing agreement and company details are provided and signed during onboarding.
Last revised September 2026
Data we process
Account and organisation data
Email address and authentication credentials handled by the managed authentication service, workspace name, user role within the workspace, and the activity record of actions taken in the console.
Supplier and site records
Business information entered by the customer: supplier or site name, country, sector, workforce size, recruitment model, and any notes, cases, remediation actions and evidence metadata the customer records. This is business data, though it may incidentally contain a named contact person entered by the customer.
Worker reports
The reporting page asks for no name, no phone number, no email address, no account and no precise location. What is stored is the selected indicators, the optional free-text description, the chosen language, the site or supplier the report relates to, and the time of submission.
Worker access verification records
Site, date, verification method, number of agreed and available access points, outcome and an optional neutral note, plus the verifier name or organisation if the customer enters one. No worker identities, device identifiers or scan tracking are recorded.
Enquiry data
Company, contact name, work email, country, sector, scope and message submitted through the access and pilot request forms, used only to respond to the enquiry.
Worker reporting principles
- The worker reporting channel does not ask for identity data, and no account is required to use it.
- Individual worker narratives are not shown in the customer management console. Customers see grouped indicator counts per supplier or site.
- Every supplier record and linked report belongs to exactly one workspace, enforced by database-level row policies, so one customer cannot read another customer's data.
- Risk scores are indicators for human review, never a finding about a person or a company.
- Demo content is generated from a fixed fictional dataset in the application and is never written to the customer database.
We describe the channel as confidential rather than perfectly anonymous, because internet infrastructure can produce limited technical security logs outside the report itself.
Why we process it
- Providing the supplier screening, worker reporting, case management and reporting features to the customer workspace.
- Authenticating users and keeping an activity record for audit purposes.
- Screening supplier names against publicly available official lists (currently US OFAC sanctions data and the DHS UFLPA Entity List).
- Responding to pilot and access requests submitted through the website.
- Keeping the service secure and operational.
We do not sell data, and we do not use customer data or worker reports for advertising or for training third-party models.
Sub-processors
Supabase
Managed Postgres database, authentication and data API for organisation accounts, supplier records and worker reports.
Confirmed per deployment during onboarding — not stated here without verification.
Cloudflare
Application hosting, content delivery and execution of server functions for the website and console.
Confirmed per deployment during onboarding — not stated here without verification.
Resend
Transactional email delivery for pilot and access requests submitted through the website forms.
Confirmed per deployment during onboarding — not stated here without verification.
Customers are told in advance when a sub-processor is added.
Retention, transfers and your rights
Retention. A workspace owner can delete supplier records at any time, and a written request to delete a full workspace and its linked records is actioned by us. A fixed retention schedule is agreed in the data processing agreement per pilot; we do not publish a duration we have not committed to.
International transfers. The platform runs on managed infrastructure that can operate across regions. The applicable region and transfer mechanism are confirmed in writing during onboarding rather than claimed here.
Your rights. Under the GDPR, people in the EU/EEA have rights of access, rectification, erasure, restriction, objection and portability. For account and enquiry data we act on those requests directly. For worker reports there is usually no identifier to match a person to a report, which is a deliberate design choice rather than a refusal.
Privacy contact. [PRIVACY CONTACT] — not yet published. Until it is, use the request form and mark it as a privacy request.
We describe how the product is built against GDPR principles. We do not claim a certification of compliance, and no supervisory authority has reviewed this product.
Company details
Brand name and legal details are not the same thing.
Libera Europe is the operating brand of the platform. The verified legal entity details below are not published yet. Rather than showing an unverified value, each outstanding item is marked — procurement receives the completed set before any contract is signed.
- Operating brand
- Libera Europe
- Legal entity name
- [LEGAL ENTITY NAME]To be completed before production contracting
- Registered address
- [REGISTERED ADDRESS]To be completed before production contracting
- Chamber of Commerce number
- [REGISTRATION NUMBER]To be completed before production contracting
- VAT number
- [VAT NUMBER]To be completed before production contracting
- Governing law and jurisdiction
- [GOVERNING LAW / COURT]To be completed before production contracting
- General contact address
- [CONTACT EMAIL]To be completed before production contracting
- Privacy contact
- [PRIVACY CONTACT]To be completed before production contracting
- Security contact
- [SECURITY CONTACT]To be completed before production contracting