Reviewer privacy policy
How Akili processes personal data in publicly available reviews, ratings and mentions, and the rights of the people who wrote them or are named in them.
1. Introduction
1.1 This Statement explains how 12Kobo OÜ, trading as Akili (“Akili”, “we”, “us” or “our”), a private limited company registered in Estonia under registry code 17631609, whose registered office is at Tornimäe tn 5, 10145 Tallinn, Estonia, processes Personal Data contained in publicly available reviews, ratings and mentions.
1.2 Our correspondence address is 12Kobo OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia. You can also contact us about this Statement at privacy@yourakili.com.
1.3 We have appointed Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom, as our representative in the United Kingdom for the purposes of Article 27 UK GDPR. If you are in the United Kingdom, you may contact our representative about any matter relating to our processing of your Personal Data.
2. Definitions
2.1 In this Statement:
"Client" means an organisation which subscribes to the Platform;
"Platform" means the Akili brand intelligence and reputation analytics platform;
"Public Content" means reviews, ratings, comments and other material published by an individual on a publicly accessible website or platform;
"Source Platform" means the website or service on which Public Content was originally published;
and "Personal Data", "Controller", "Processor", "processing", "special category data" and "Data Subject" bear the meanings given to them in Regulation (EU) 2016/679 (the “GDPR”) and, where applicable, the UK GDPR.
3. Our role
3.1 Akili determines the Source Platforms from which Public Content is collected, the brands in respect of which it is collected, the taxonomy against which it is classified, and the purposes for which it is analysed. Akili accordingly acts as Controller in respect of the processing described in this Statement.
3.2 Clients receive analytical outputs derived from Public Content. Where a Client receives Personal Data contained in Public Content, that Client acts as Controller in respect of its own subsequent use of it.
3.3 This Statement does not apply to Personal Data which a Client supplies to Akili or which Akili obtains from an account the Client has connected to the Platform, including support ticket exports, responses to surveys operated by a Client, and reviews obtained through a connected Google Business Profile account. Akili acts as Processor in respect of that data and the Client’s own privacy notice applies.
4. Personal Data we process
4.1 We process the following categories of Personal Data where they appear in Public Content:
(a) the name, username, handle or other identifier under which the content was published;
(b) the content itself, including the text of a review, its rating, and the date of publication;
(c) the Source Platform and the location of the content on it;
(d) where disclosed by the author within the content or their public profile, the business, branch or location to which the content refers;
(e) any other Personal Data which the author has chosen to include in the content.
4.2 We keep the name or handle under which content was published so that the Client whose brand it concerns can reply to the author on the Source Platform. We do not seek to collect contact details, and we do not contact authors by any other means.
4.3 We do not collect profile images, follower or connection counts, or the author's own location, and we do not infer or derive any attributes about the author. The only location we record is that of the business, branch or store to which the content refers.
4.4 Public Content sometimes names other people, such as staff of the business being reviewed. This Statement applies to any such individual in the same way as to authors, and they have the rights described in section 12.
5. Where we obtain it
5.1 Public Content is obtained from publicly accessible websites and platforms, including review platforms and social media services, either directly through the interfaces those platforms make available or through a service provider acting on our instructions.
5.2 We do not obtain Public Content from private messages, closed groups, or any source requiring authentication as another person.
5.3 The Source Platforms from which we collect Public Content include public review platforms such as Trustpilot, Yelp and Google Reviews, and social media services such as X. The Source Platforms we use may change over time. You may ask us at any time which Source Platform your Personal Data was obtained from.
6. Why we process it
6.1 We process Public Content in order to:
(a) classify the subject matter and sentiment of what customers say about a brand;
(b) produce aggregate scores and measures of brand perception;
(c) identify recurring themes and prioritise recommended actions for the Client whose brand is analysed;
(d) compare performance between a Client's own branches or locations, and against competitor brands;
(e) enable the Client whose brand is the subject of the content to respond to it on the Source Platform;
(f) maintain, test and improve the Platform, including by training and evaluating machine learning models which classify the subject matter and sentiment of Public Content. Before Public Content is used for training, we remove author names and usernames and take reasonable steps to remove or replace other identifiers within the content, and we do not intentionally use special category data for this purpose.
6.2 We do not use Public Content to make decisions about the individual who wrote it, to target advertising, or to construct a profile of that individual for any purpose unrelated to the analysis of the brand referred to. We do not carry out automated decision-making, including profiling, which produces legal or similarly significant effects for you.
7. Lawful basis
7.1 We process Public Content on the basis of our legitimate interests and those of our Clients under Article 6(1)(f) of the GDPR (and, where applicable, Article 6(1)(f) of the UK GDPR). Those interests are understanding and improving how a brand is perceived by its customers, and enabling a brand to respond to what its customers say about it.
7.2 In reaching that assessment we have taken into account that the content was published by the author to be read by the public; that it concerns the author's experience of a business rather than their private life; and that our use of it is analytical and does not affect the author individually.
7.3 Public Content may incidentally contain special category data, or Personal Data relating to criminal convictions or offences, such as an allegation made about a member of staff. Where it does, we do not seek out that data, extract it, or use it to classify, characterise or make inferences about any individual. To the extent that we process special category data at all, we do so only where it has manifestly been made public by the Data Subject, under Article 9(2)(e) of the GDPR (and, where applicable, Article 9(2)(e) of the UK GDPR).
7.4 A written legitimate interests assessment supporting clause 7.1 is maintained by Akili.
7.5 You have the right to object to processing carried out under clause 7.1. Section 12 explains how.
8. Information about the source of your data
8.1 Your Personal Data was not obtained from you directly. It was obtained from the Source Platform on which you published it.
8.2 We are ordinarily unable to contact authors of Public Content individually to provide this Statement. We do not hold their contact details, and obtaining them would require collecting more Personal Data than the processing itself requires. Providing this Statement to each author individually would therefore involve a disproportionate effort, within the meaning of Article 14(5)(b) of the GDPR (and, where applicable, Article 14(5)(b) of the UK GDPR). In accordance with that provision, we instead make this Statement publicly available on our website at yourakili.com/legal/reviewer-privacy.
9. Who we share it with
9.1 We disclose Public Content, including the name or handle under which it was published, and analytical outputs derived from it, to the Client whose brand is the subject of the content.
9.2 Where Public Content concerns a competitor of a Client, we may disclose the content and analytical outputs derived from it to that Client for the purpose described in clause 6.1(d), without the name, username or handle of the author.
9.3 We use service providers who process Public Content on our behalf, including providers of hosting, content collection and artificial intelligence models. These are listed in our Sub-processor Register, published at yourakili.com/legal/subprocessors.
9.4 We may disclose Personal Data where required by law, or to professional advisers under a duty of confidentiality.
9.5 We do not sell Personal Data.
10. Retention
10.1 We retain Public Content, and the classifications we derive from it (such as theme and sentiment), for no longer than 180 days from collection, after which they are deleted from our live systems. Content from some Source Platforms may be deleted sooner.
10.2 Aggregate scores and measures which do not identify any individual may be retained after the underlying content is deleted.
10.3 Deleted content may remain in routine backups for a short period before it is overwritten, and is not restored to live use.
10.4 De-identified Public Content used to train and evaluate models under clause 6.1(f) is retained for up to 24 months from collection, separately from the Platform’s live data, and is then deleted.
11. International transfers
11.1 Public Content is stored in the United Kingdom, which benefits from an adequacy decision of the European Commission.
11.2 Some of our service providers may process Public Content elsewhere, including in the United States. Where they do, we rely on an adequacy decision (including, for certified recipients, the EU–U.S. Data Privacy Framework) or the European Commission’s Standard Contractual Clauses, and for UK Personal Data on the UK Extension to the Data Privacy Framework, the International Data Transfer Agreement or the UK Addendum.
12. Your rights
12.1 You have the right to request access to the Personal Data we hold about you; to request its rectification or erasure; to request restriction of processing; to object to processing carried out on the basis of legitimate interests; and, where applicable, to request portability.
12.2 Requests should be sent to privacy@yourakili.com. We may ask you to provide information sufficient to identify the Public Content in question, and to verify your identity. We will not use verification to delay a request beyond the period reasonably necessary. If you are in the United Kingdom, you may also submit requests through our UK representative (see clause 1.3).
12.3 We will respond within one month of receipt, which may be extended by up to two further months where a request is complex. We will tell you if an extension applies and why.
12.4 Deleting Public Content from our systems does not remove it from the Source Platform on which you published it. If you wish it to be removed from public view, you will need to ask that platform, or delete it yourself. Where you have objected to our processing or asked us to delete your Personal Data, we will take reasonable steps to ensure that content is not collected and processed again.
13. Complaints
13.1 Complaints about our handling of your Personal Data may be made to privacy@yourakili.com and will be handled in accordance with our Data Protection Complaints Procedure.
13.2 You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority in the EU country where you live or work. If you are in the United Kingdom, you may complain to the Information Commissioner (ico.org.uk). You may also seek a judicial remedy. None of these rights depends on first complaining to us.
14. Changes to this Statement
14.1 We may amend this Statement. The version and review date are stated at the head of this document.