Privacy Policy

Who is responsible for your data

OVVIO Solutions operates Psychological Tests Online and is the data controller for the information described here. You can reach us at support@psychologicaltests.online, or by post at Nieuwe Rijn 55B, 2312 JH Leiden, Netherlands.

If you believe we have handled your data improperly, you may also complain to your national data protection authority.

What we collect

Account information. We store your email address, the display name you choose, and a profile picture if your sign-in provider shares one. You can sign in with email and password, Google or Apple, on the website and in the mobile apps. Facebook is also offered, in the mobile apps only. If you sign in with email and password, we never see your password: it is handled by Google Firebase Authentication. With Google, Apple or Facebook, we receive only the basic profile details that provider shares with your permission, such as your name, email address and profile picture.

Guest use. You can take assessments without creating an account. We then create an anonymous account identifier, with no name or email address attached, and store your answers and results under it. If you later sign up, that data is carried over to your new account. How long guest data is kept is explained below.

Assessment responses and results. The answers you give, the scores calculated from them, and the written report produced. We store these so you can return to them and track change over time.

AI conversations. If you use the AI companion, we store the messages you send and the replies you receive, so the conversation persists between visits.

Purchase information. If you buy a subscription or unlock a report, we record what you bought and when. Card and payment details go directly to whoever takes the payment and never reach our servers: Link, a Stripe company, on the website; Apple or Google in the mobile apps.

Technical information. Basic data your browser or device sends when it connects, such as approximate region, device type and the language you read in.

Assessment responses are sensitive, and we treat them that way

Answers to psychological assessments can reveal a great deal about a person, including information that may relate to mental health. We treat them as sensitive personal data regardless of how they are classified in your country.

We process them only on the basis of your explicit consent. As a guest, you give it by ticking a checkbox before your first result is shown. With an account, you give it when you sign up. You can withdraw it at any time by deleting your results, your guest data or your account. We do not use your responses for advertising, we do not sell them, and we do not share them with anyone for their own purposes.

Why we process your data, and on what legal basis

To provide the service you asked for: creating your account (or, if you take assessments as a guest, an anonymous account), running assessments, producing reports, and keeping your history. The legal basis is performance of our contract with you.

To process assessment responses and generate reports from them. The legal basis is your explicit consent.

To give you access to what you bought, keep records of purchases, and meet accounting obligations. The legal bases are performance of a contract and legal obligation.

To send you an email confirming each purchase you make on the website, with what you bought and your consent to immediate access. The legal bases are performance of a contract and legal obligation, because consumer law requires us to confirm the purchase on a durable medium.

To keep the service secure, prevent abuse, and fix faults. The legal basis is our legitimate interest in a service that works and is not misused.

To answer you when you contact support. The legal basis is our legitimate interest in responding to you.

Who processes data on our behalf

We keep the number of processors small and use each for one clear purpose.

Google Firebase runs the service: Authentication (sign-in, including guest sessions), Cloud Firestore (stores your account and results), Cloud Functions (server-side processing such as scoring) and Hosting (serves this website). In the mobile apps, Firebase Cloud Messaging also delivers notifications. On the website, Firebase App Check with Google reCAPTCHA Enterprise protects the service from abuse by checking signals from your browser and device to tell genuine visits from automated traffic. Google acts on our instructions.

Groq processes the text of your AI conversations to generate replies. Messages are sent for that purpose only.

RevenueCat manages subscriptions and purchases, in the apps and on the website, and acts on our instructions as our processor. It tells us which purchases are active on your account so we can unlock what you paid for. We receive confirmation of what you bought, never your card number.

On the website, payment is taken by Link, a Stripe company, acting as merchant of record for the purchase. Link is not our processor. It processes your payment and billing details, for example your name, email address, billing address, payment method and tax details, as an independent controller, under its own privacy policy. Link shares the order details with us: what you bought, the price and tax paid, and the contact and billing details you entered at checkout.

SendGrid, a Twilio service, delivers the messages you send us through the help and contact forms to our support inbox. It receives what you put in the form: your email address, your message and, if you give it, your name. After a purchase on the website, SendGrid also sends you our purchase confirmation email. For that it receives your name, your email address, the details of your purchase (what you bought, the price, the purchase date, renewal and cancellation information, and when you agreed to immediate access and gave up your 14-day right of withdrawal) and the language you use the service in.

Apple and Google operate the app stores, and handle purchases made inside the mobile apps under their own terms.

Where your data goes

Our processors operate infrastructure in the United States and elsewhere, so your data may be transferred outside your country and outside the European Economic Area.

Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

How long we keep it

If you have an account, your account and results stay until you delete them. We do not expire them for you, because the point of the history is to be there when you come back.

Guest data, meaning the anonymous account, your answers and your results, is deleted automatically after 30 days without activity. You can delete it sooner at any time, using the option to delete your guest data on the Account page of the website. If you sign up before then, it is carried over to your new account instead.

When you delete your account or your guest data, or when guest data expires, your profile, results and AI conversations are removed from our live systems. Backups are overwritten on a rolling basis and are fully cleared within 90 days.

Records of purchases are kept for as long as tax and accounting law requires, typically several years, separately from your assessment data.

Your rights

You can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

You do not have to write to us for the two most common ones. On the website, the Account page lets you download a copy of the data we hold about you and delete your account together with all of its data. In the mobile apps, the Data Management screen in Settings lets you export and delete your data.

For anything else, email support@psychologicaltests.online. We will respond within one month.

Age

This service is not intended for children. You must be at least 16 years old to use it, with or without an account. If we learn that we hold data about someone younger, we delete it.

Security

Traffic is encrypted in transit. Access to stored data is restricted by rule so that your results and conversations are readable only by your own account. Passwords are handled by Google and never stored by us.

No system is perfectly secure. If a breach affects your rights, we will tell you and the relevant authority as the law requires.

Cookies and local storage

The website stores only what it needs to work and to stay secure. It uses no analytics, no advertising cookies and no third-party tracking. Its fonts are served from our own servers, so reading a page sends no request to an outside font provider. The Cookie Policy explains exactly what is stored and why.

The mobile apps differ in one respect: users without a subscription see ads, served by Google AdMob. AdMob receives device information, such as the advertising identifier, to show and measure ads, and handles it under Google's own privacy terms. It never receives your answers or results. Subscribers see no ads. The website shows no ads at all.

Changes

If we change this policy in a way that affects you, we will say so on this page and update the date below. Continuing to use the service after a change means you accept the revised policy.