Privacy Policy
Compliant with GDPR (Regulation EU 2016/679) · Version 1.6 · Effective from 9 November 2026
1. Data Controller
The data controller for your personal data is the operator of PsychoProfil.pl (hereinafter: "Controller").
Contact for data protection matters: privacy@psychoprofil.pl
2. What Data Do We Collect?
2.1. Data Provided Voluntarily
- Email address — when you create an account or sign in (we email you a 6-digit code)
- Test results — the scores of every Test you finish, linked to your Account or, without an Account, to a cookie in your browser (section 6). We do not store your individual answers.
2.2. Data Collected Automatically
- Browser identifier — a random identifier stored in a cookie for 90 days. It links the results you get in this browser, so you can return to them and save them to an Account.
- Usage events — what you do on the Service (e.g. test started, test finished, results viewed), with the page address, referring site, browser type, IP address and the country and city derived from it. We store them ourselves (Supabase, EU) to measure and improve the Service. Plausible Analytics and Vercel Web Analytics also count page views, without cookies.
- Server logs — IP address, browser type, date and time of request
2.3. Data We Do NOT Collect
- We do not collect payment card data — payments are processed by Stripe (Stripe Payments Europe, Ltd.), which receives your card details and billing email directly from you
- We do not collect health data — Test Results are not treated as medical data
- We do not profile Users for advertising purposes
- We set no analytics cookies unless you click OK in the cookie banner
3. Purposes of Processing
| Purpose | Legal basis (GDPR) | Retention period |
| Account management and login | Art. 6(1)(b) — performance of a contract | Until account deletion |
| Storing test results | Art. 6(1)(b) — performance of a contract | Until account deletion |
| Payment processing | Art. 6(1)(b) — performance of a contract | As required by tax law (5 years) |
| Usage statistics (our own events, Plausible, Vercel). Google Analytics only with your consent, Art. 6(1)(a) | Art. 6(1)(f) — legitimate interests | 26 months, then deleted |
| Security and diagnostics | Art. 6(1)(f) — legitimate interests | 30 days (server logs) |
| Paid reports and report previews: the text we write for a result is stored per result and language, so the report opens again without being written anew | Art. 6(1)(b) — performance of a contract | Until you delete that result or your account |
| Profile share link, only if you create one: a public page with the radar chart and top strengths across your tests, without sensitive tests (such as depression or anxiety screeners), your name or your email | Art. 6(1)(b) — performance of a contract | Until you stop sharing or delete your account |
| Report generation records: the request we send to Anthropic or OpenRouter (the scores of the result and the page language) and the text it returns, so we can find and fix a failed report | Art. 6(1)(f) — legitimate interests | 30 days, then deleted |
| Feedback, bug reports and thank-you discounts: the message you send through the form, your email if you give one, the page, the language, the browser's user agent and the country; for each discount (for feedback or for answering "What's stopping you?") the browser and account identifiers, the result, the percentage and when it was used. So we can reply, fix bugs and apply the discount at checkout | Art. 6(1)(f) — legitimate interests | 12 months, then deleted |
4. Sharing of Data
Your data may be shared only with the following categories of recipients:
- Supabase Inc. — database hosting and authentication. Supabase processes data in the EU (Frankfurt region). Standard Contractual Clauses (SCCs) ensure GDPR compliance.
- Vercel Inc. — application hosting and cookie-free page statistics (Vercel Web Analytics). Data processed on edge servers globally. GDPR compliance ensured through SCCs.
- Stripe Payments Europe, Ltd. — payment processor. Stripe processes payment data as an independent data controller.
- Plausible Analytics — anonymous analytics, data stored in the EU. No cookie consent required (no cookies used).
- Google Analytics — visit statistics (Google Ireland Ltd.). Loaded only after you click OK in the cookie banner; sets _ga cookies. Data may be transferred to the USA under the EU-US Data Privacy Framework.
- Anthropic Ireland, Limited — writes the text of paid reports and report previews using a language model. It receives the scores of the result being described and the page language, never your name or email address. Data is stored in the USA and may be processed in other countries where Anthropic and its providers operate, under the EU standard contractual clauses. It is deleted within 30 days, unless a safety review or the law requires longer.
- OpenRouter, Inc. — writes this text instead when Anthropic does not answer or another language model is used. It receives the scores of the result being described and the page language, never your name or email address. Data is transferred to the USA.
The Controller does not sell personal data and does not share it with third parties for marketing purposes.
5. Your Rights (GDPR)
Under the GDPR, you have the following rights:
- Right of access (Art. 15) — you may obtain information about the personal data we process about you
- Right to rectification (Art. 16) — you may request correction of inaccurate data
- Right to erasure (Art. 17, "right to be forgotten") — you may request deletion of your data
- Right to restriction of processing (Art. 18) — you may restrict the way we use your data
- Right to data portability (Art. 20) — you may receive your data in a machine-readable format
- Right to object (Art. 21) — you may object to processing based on legitimate interests
- Right to lodge a complaint — with your national data protection authority. In Poland: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl
To exercise your rights, contact us at: privacy@psychoprofil.pl. We will respond within 30 days.
6. Cookies
PsychoProfil.pl uses these cookies and similar browser storage:
- Sign-in cookies (Supabase) — keep you signed in. Set only when you sign in and removed when you sign out.
- Results cookie (pp_sid) — a random identifier that links the tests you take in this browser to your results. Expires after 90 days.
- Cookie choice — your answer to the cookie banner, saved in your browser's local storage. It stays until you change it or clear your browser data.
- Saved on your device (local storage) — a finished test that could not be saved yet, kept until our server confirms it (at most 7 days), and the class codes you create for a group. Clearing your browser data removes them.
- Language cookie — remembers your preferred language. Expires after 1 year.
- Google Analytics cookies (_ga, _ga_*) — set only after you click OK in the cookie banner. They expire after up to 2 years, and choosing "Essential only" removes them.
Without your OK we set no analytics cookies. You can change your choice at any time under "Cookie settings" at the bottom of every page.
7. Data Security
We apply the following security measures:
- Encryption of data in transit (HTTPS/TLS)
- No passwords: sign-in uses one-time email codes, and sessions use signed tokens (JWT)
- Row Level Security (RLS) in the database — each user can only access their own data
- HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy)
8. Children's Data
The Service is not directed at persons under the age of 16. We do not knowingly collect data from minors. If we become aware that data has been provided by a person under 16 without parental or guardian consent, we will delete it without delay.
9. Changes to This Privacy Policy
The Controller reserves the right to update this Privacy Policy. Users will be informed of material changes via the Service or by email.
Last updated: 27 October 2026
10. Contact
For matters relating to personal data protection:
- E-mail: privacy@psychoprofil.pl
- Website: www.psychoprofil.pl
Push Notifications
Our mobile app may collect device tokens to send push notifications about new tests and features. We collect platform information (iOS/Android) and language preferences.
Device tokens are automatically deleted after 90 days of inactivity. We do not share this data with third parties.