Legal
Privacy Policy
A test about your own values only works if you answer honestly, and you will only answer honestly if you know where the answers go. So here is all of it, without the hedging.
Last updated · Effective
The short version
- We do not sell your test answers. Not to advertisers, not to data brokers, not to anyone.
- You can take a test without giving us your email. We ask for it to send you the result.
- Advertising and analytics tracking is off until you turn it on in the cookie banner. Rejecting it does not restrict the site.
- You can ask us to show you, correct, or delete everything we hold about you, at any time, and we will not charge you or make the service worse for asking.
- We treat your answers as sensitive even where the law may not require it.
What we collect
These are all the categories of personal information we collect, what is in each one, and where it comes from.
Your test answers
The option you picked for each statement, the order you answered in, the test you took, your computed scores and the profile you were matched to.
- Why:
- This is the product. Without it there is no result.
- Source:
- You, directly
Email address
The address you enter to receive your result, plus your subscriber status.
- Why:
- To send your result, receipts, renewal notices and service messages.
- Source:
- You, directly
Billing information
Billing country and postal code, the last four digits and brand of your card, subscription status and invoice history. Full card numbers go to our payment processor and never touch our systems.
- Why:
- To take payment, prevent fraud and meet tax and accounting obligations.
- Source:
- You, via our payment processor
Device and usage data
IP address, browser and operating system, screen size, referring page, pages viewed, funnel events such as starting or finishing a test, and a pseudonymous identifier stored on your device.
- Why:
- To keep the site working, find where people get stuck, and measure which ads bring people who actually finish a test.
- Source:
- Collected automatically
Support messages
What you write to us and our replies.
- Why:
- To answer you and keep a record of what was agreed.
- Source:
- You, directly
We do not collect your precise geolocation, your contacts, your photos, your government identifiers, biometric data, or health records. We do not buy personal information about you from data brokers.
Your answers and sensitive data
Our tests ask how strongly you agree with abstract statements about how society should work. Those answers can reveal something close to a philosophical or political belief, which is a category the law treats carefully. We do not wait to be told whether the definition applies. We handle your answers as sensitive personal information as a matter of policy:
- We use them to produce your result and to improve our scoring — nothing else.
- We do not use them to target advertising at you, and we never pass an individual answer or score to an advertising platform.
- When we publish statistics about how people answer, the data is aggregated so that no individual can reasonably be identified from it.
- You can ask us to delete them at any time, without cancelling your subscription.
Under California law you have the right to limit the use of sensitive personal information to what is necessary to deliver the service. We already operate that way for everyone, so there is nothing you need to switch off — but you can still make the request, and we will confirm it in writing.
How we use it
- To give you your result — score your answers, match a profile, produce the report.
- To run the subscription — take payment, send receipts and renewal notices, process cancellations and refunds.
- To support you — answer your emails and keep a record of what was agreed.
- To improve the product — see which questions confuse people and where they abandon the test.
- To measure marketing — understand which campaigns bring people who finish a test, using pseudonymous event data, and only with your consent.
- To keep things safe and legal — prevent fraud and abuse, keep accounting records, and respond to lawful requests.
We do not use your personal information to make automated decisions that have a legal or similarly significant effect on you.
Selling and sharing for ads
We do not sell personal information for money. We never have.
If you accept advertising cookies, we allow advertising platforms to set identifiers that let them measure whether their ad led to a completed test or a purchase. Under California law that may count as "sharing" personal information for cross-context behavioural advertising, so we describe it as such rather than hiding behind a definition. It happens only after you opt in, it involves pseudonymous identifiers and event names, and it never includes your test answers or your scores.
You can turn it off at any time in cookie settings. We also honour the Global Privacy Control signal: if your browser sends one, we treat it as an opt-out of sharing without you having to do anything else.
We do not sell or share the personal information of anyone we know to be under 16.
How long we keep it
We keep each category only as long as it is useful for the purpose it was collected for, or as long as the law requires. Then we delete it or aggregate it beyond recovery.
| Category | Kept for |
|---|---|
| Test answers and results | 24 months from your last activity |
| Email address and account | For as long as your subscription is active, then 24 months |
| Billing and invoice records | 7 years, because tax and accounting rules require it |
| Support correspondence | 24 months from the last message in the thread |
| Analytics data | 14 months, in aggregated form |
| Marketing email list | Until you unsubscribe, then 30 days to honour the opt-out |
A deletion request overrides these periods, except for records we are legally required to keep — principally billing records for tax purposes. In that case we delete everything else and tell you exactly what was kept and why.
California rights (CCPA/CPRA)
If you are a California resident, you have the following rights. All of them are free.
- Know. Ask what categories and specific pieces of personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
- Delete. Ask us to delete what we hold, subject to the legal exceptions noted above.
- Correct. Ask us to fix inaccurate personal information.
- Portability. Get a copy of your information in a portable, machine-readable format. For your answers and results we provide JSON.
- Opt out of sale or sharing. Covered above, and available in cookie settings or via Global Privacy Control.
- Limit use of sensitive personal information. We already limit it to delivering the service — see above.
- No retaliation. We will not deny you the service, charge you a different price, or give you a worse experience because you exercised a right.
You can use an authorised agent. We will ask the agent for written proof of your permission and may ask you to confirm directly.
In the twelve months before the date at the top of this page, we collected the categories of personal information listed under What we collect, disclosed the categories listed under Who we share it with for business purposes, and sold no personal information.
Other US state rights
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have broadly the same rights — access, correction, deletion, portability, and opting out of targeted advertising and profiling. Rather than run a different process per state, we give everyone the rights listed above, wherever you live.
Where your state provides a right to appeal a refused request, you may appeal by replying to our decision email with the word "appeal". We respond to appeals within 45 days and, if we still refuse, we tell you how to contact your state attorney general.
How to exercise your rights
Email [email protected] with the word "privacy request" in the subject and tell us what you want — a copy, a correction, or deletion.
- We verify you by confirming control of the email address on the account, and for deletion we send a second confirmation link so that nobody can delete your data by guessing your address.
- We respond within 45 days, and tell you if we need a 45-day extension.
- If you have no account with us and only took a free test, say roughly when you took it so we can find the record.
Security
The site is served over HTTPS only. Access to production data is limited to people who need it and protected by multi-factor authentication. Card details are handled entirely by our payment processor — they never reach our servers or our logs.
No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the relevant authorities as required by law, and tell you what happened and what to do.
Children
The Service is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has given us information, email [email protected] and we will delete it promptly.
Changes to this policy
We update this policy when what we do changes. The date at the top always reflects the current version. If a change materially affects your rights, we email the address on your account before it takes effect.
Who you are dealing with
Testy is operated by TODO Legal Entity Ltd., TODO registered address. Company number TODO company number.
Questions about this document, or any request described in it, go to [email protected]. We reply within two business days. For anything about billing you can also use the help center or cancel directly from the cancellation page.