Privacy Policy
What we collect, why, how long we keep it, and how to get rid of it.
1. Who is responsible
The data controller for this Service is «LEGAL_NAME», a sole proprietor based in «LEGAL_ADDRESS». Send every data-related request to «LEGAL_EMAIL».
2. The short version
- We collect: your sign-in email, your answers, the computed results, and basic technical logs.
- We do not collect: card numbers, passwords, contacts, precise location, or advertising identifiers.
- There are no third-party advertising or analytics trackers on this site.
- We never sell your personal data.
- One email is enough to export or delete everything we hold.
3. What we collect
| Category | What exactly | Why | Required? |
|---|---|---|---|
| Account identity | Email, display name, Google avatar URL, Google account ID | Create the account, store and retrieve reports | Required to sign in |
| Assessment data | Your answers, computed scores, the generated report | Generate and store the report | Required |
| Purchase status | Which report was unlocked, amount, currency, order reference from the Merchant of Record | Unlock content, process refunds | Only if you buy |
| Ratings | Star rating and optional written comment | Show aggregate ratings | Optional |
| Technical logs | IP address, user-agent, timestamps, pages requested | Security, abuse prevention, debugging | Automatic |
| Preferences | Language choice, local draft answers | Keep your experience consistent | Stored in your browser |
4. Why we are allowed to process it
- Performance of a contract: the account, report generation and delivery. Without this we cannot provide what you paid for.
- Legitimate interests: security, fraud and abuse prevention, service improvement. We have weighed these against your rights and they do not override them.
- Consent: optional written comments on a rating, and any marketing email. Marketing is opt-in; we do not send it by default.
- Legal obligation: keeping transaction records as tax and accounting law requires.
5. Cookies and local storage
| Name | Purpose | Lifetime | Type |
|---|---|---|---|
| tf_session | Keeps you signed in | 30 days | Essential (HttpOnly) |
| tf_lang | Remembers your language | 1 year | localStorage |
| tf_admin | Used only by the operator for the admin dashboard | 7 days | Admin only |
No third-party cookies, no advertising pixels, no cross-site tracking. You can clear these in your browser settings; clearing the session cookie signs you out.
6. Who we share it with
- Creem (Merchant of Record): payment processing, invoicing, tax and refunds. It receives your email address and the order amount.
- Google: for sign-in. We receive your basic profile; Google knows you used its sign-in on this site.
- Our email delivery provider: to send report links and receipts.
- Our hosting provider: servers and database.
- Authorities: only where legally compelled, and we tell you unless we are prohibited from doing so.
We do not sell, rent or share personal data with data brokers.
7. Where your data lives
Servers and the database are provided by a third-party hosting provider. The physical region follows our hosting configuration and you can ask us by email which region is currently in use.
If you are in the EEA or the UK, transfers outside that area rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
8. How long we keep it
| Data | Retention |
|---|---|
| Account and reports | While your account exists; deleted within 30 days of a deletion request |
| Accounts inactive for 24 months | Deleted or anonymised |
| Order and payment records | As required by tax and accounting law (typically 5–10 years), held by us and by the Merchant of Record |
| Server logs | 30 days |
| Ratings | While the test exists, displayed only in aggregate |
9. Report links are access links
10. Your rights
You can ask us to: confirm what we hold, correct it, delete it, restrict how we use it, export it in a machine-readable format, object to processing based on legitimate interests, or withdraw consent you previously gave.
Email «LEGAL_EMAIL». We reply within 30 days, usually much sooner. Deletion is free. To prevent impersonation we may ask you to write from your registered address.
EEA and UK: you may lodge a complaint with your local supervisory authority. California: we do not sell personal information or share it for cross-context behavioural advertising; you may still request deletion or disclosure.
11. Security
HTTPS across the site. Session tokens are 64-character random values stored server-side and expire after 30 days. Database access is limited to the operator. No payment card data is stored on our servers, and no passwords exist because we never receive one.
No system is perfectly secure. If an incident affects you, we will notify affected accounts without undue delay.
12. Children
The Service is not intended for anyone under 16. If we learn we have collected data from a child under 16, we delete it. Email us if you believe that has happened.
13. Changes
We may update this policy; the date at the top changes. Material changes are emailed to registered users at least 14 days before taking effect.
14. Contact
Data requests: «LEGAL_EMAIL»