Privacy Policy

1. Who We Are & Regulatory Framework

1.1 Legal Basis and Authority

This Privacy Policy is established by TraitTune, Inc. (“TraitTune,” “we,” “us”) in compliance with global data protection law. We apply the standard of each user's own jurisdiction: GDPR-level protections in the EU, EEA, UK, Switzerland and Brazil, and the applicable state privacy laws for residents of the United States.

1.2 Sanctions Compliance Notice

TraitTune is not available to persons or entities located in jurisdictions subject to (a) U.S. Department of the Treasury Office of Foreign Assets Control (OFAC) comprehensive sanctions — Crimea Region of Ukraine, Cuba, Iran, North Korea, Syria, and the Donetsk (DNR) and Luhansk (LNR) regions; (b) sectoral OFAC programs and broader U.S./EU/UK restrictive measures we apply by business decision — Russia and Belarus; and (c) jurisdictions where on-the-ground operations make platform availability inappropriate — Afghanistan and Myanmar. Access from these locations is blocked at the network level.

1.3 EU & UK Representative (GDPR Article 27 / UK GDPR Article 27)

Because TraitTune is established outside the EU and UK but offers its services to individuals there, we are in the process of designating representatives under Article 27 of the EU GDPR and Article 27 of the UK GDPR. Until that designation is finalised, EU/EEA and UK data subjects, as well as supervisory authorities, may contact us directly at privacy@traittune.com on all matters relating to the processing of their personal data.

2. Information We Collect

2.1 Direct User-Provided Information

2.2 Automatically Collected Information

3. Legal Basis for Processing

3.1 Explicit Consent (GDPR Article 9(2)(a))

• Required: Explicit consent is the legal basis for processing psychometric data
• Granular: Core assessment consent is required; AI analysis and analytics are optional
• Revocable: Withdraw consent anytime — we cease processing and delete data
• Audited: Every consent event is logged with timestamp, IP, and version

3.2 Core Service Provision

• Conduct personality and skills assessments
• Generate personalized insights and recommendations
• Provide assessment results and reports
• Support your account and technical access

3.3 Marketing Communications

With your permission, we send marketing communications so you can get the most out of TraitTune. This includes product updates and new-feature announcements, our periodic newsletter, and promotional offers such as discounts and promo codes. We may reach you by email, push notification (if enabled), and in-app messages.

Users outside the EU / EEA / UK / Switzerland / Brazil

By creating an account and accepting this Privacy Policy and our Terms of Service, you agree to receive marketing communications from us. This is an opt-out arrangement: marketing is on by default, and you can turn it off at any time — with no effect on your ability to use the service.

Users in the EU / EEA / UK / Switzerland / Brazil

We will only send you marketing communications if you have given separate, explicit opt-in consent, requested independently of accepting our Terms of Service (typically via a dedicated consent prompt). If you do not opt in, you will still receive essential service messages (for example security, billing, and transactional emails) but no marketing. You may withdraw this consent at any time; withdrawal is as easy as giving it and does not affect the lawfulness of processing before withdrawal.

How to opt out or unsubscribe

• Settings: Manage your communication preferences at any time in Dashboard → Settings → Notifications.
• One-click unsubscribe: Every marketing email includes a one-click unsubscribe link in its footer.
• Push & in-app: Disable push notifications in your device or browser settings; in-app marketing follows the same preference toggle.

Opting out of marketing does not stop transactional or service messages (such as security alerts, billing receipts, and important account notices), which we must send to operate your account. We never sell your contact details, and we do not condition access to the service on receiving marketing.

4. Your Privacy Rights

4.1 Universal Rights

• Right to Access: Request copies of your personal data
• Right to Correction: Update inaccurate or incomplete data
• Right to Deletion: Request removal of your personal data
• Right to Portability: Receive your data in a structured format (JSON/CSV), free of charge, within 30 days

4.2 GDPR Rights (EU/EEA Residents)

• Right to erasure (“right to be forgotten”): Request complete deletion of your account and all associated psychometric data. We will action within 30 days and confirm in writing.
• Right to restrict processing: Ask us to pause processing while a dispute is resolved
• Right to object: Object to processing based on legitimate interests
• Right not to be subject to automated decisions: Request human review of any automated personality profiling outputs
• Right to withdraw consent: Withdraw at any time; withdrawal does not affect lawfulness of prior processing

To exercise GDPR rights, email privacy@traittune.com with subject “GDPR Rights Request”. We respond within 30 days; complex requests may extend to 90 days with notice.

4.3 CCPA / CPRA Rights (California Residents)

Use of Sensitive Personal Information

We use your sensitive personal information solely to provide the service you have requested and for no other purpose; we do not use or disclose it to infer characteristics about you. Because our use is limited in this way under California Civil Code §1798.121(d), the CPRA right to limit the use of sensitive personal information does not apply, and we do not provide a separate “Limit the Use of My Sensitive Personal Information” link.

Global Privacy Control (GPC)

We honor Global Privacy Control signals in every region. If your browser sends a GPC signal, we treat it as a hard opt-out of cross-context behavioral advertising — our TikTok and Reddit pixels stay off, whether you had previously accepted marketing cookies or advertising was on by default for your region. We check for the signal before anything is written, so a browser broadcasting GPC never receives an advertising pixel. Sale of personal information is not affected because no sale takes place.

See Do Not Sell or Share My Personal Information for the standalone disclosure.

To submit a CCPA request, email privacy@traittune.com with subject “CCPA Rights Request”, or call +1 (347) 667-9624. We respond within 45 days.

5. Data Security

Encryption of Your Content

We protect the most sensitive content you create — your AI-chat messages, your open-ended assessment answers, and the notes we keep to personalize your experience — with per-record envelope encryption using AWS Key Management Service (AES-256-GCM), and we are rolling this protection out progressively across these content types. Where it applies, each record is encrypted under its own cryptographic context, so no single key unlocks your data in bulk. Access to decrypt encrypted content is limited to the automated application services that operate the product, and every such access is logged and continuously monitored. We are also progressively removing standing administrative access to your decrypted content, with the objective that reading it in plaintext requires a strictly limited, dual-controlled, per-record “break-glass” procedure — invoked only when we are compelled by valid legal process, and independently audited each time. Apart from the service providers (sub-processors) we rely on to operate the product — described in Section 6, Data Processors and Sub-processors — we disclose your content to outside parties only under valid legal process, as described in our Legal Disclosure practices.

5.1 Personal Data Breach Notification

If a personal data breach occurs, we will respond in line with GDPR Articles 33 and 34: where the breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it; and where the breach is likely to result in a high risk to you, we will notify affected users without undue delay. Our internal target is to inform affected users within 24 hours of confirming a breach affects them, which is consistent with — and never later than — the GDPR “without undue delay” standard. Notifications describe the nature of the breach, its likely consequences, and the measures we have taken or propose to take.

6. Data Processors & Sub-processors

We do not sell your data. TraitTune is the controller for your psychometric and account data. The vendors below act as processors under our instruction (GDPR Art. 28) — each is bound by a Data Processing Agreement with Standard Contractual Clauses. Stripe is listed separately because, for payment-card data it collects directly during checkout, Stripe acts as an independent controller under its own privacy notice (GDPR Art. 26). Advertising partners are listed in a third group: while advertising cookies are on — which requires your opt-in in the EU, EEA, UK, Switzerland and Brazil, and is the default elsewhere — they receive conversion events (such as page view, sign-up, subscription, or purchase) and, for matching, a one-way SHA-256 hash of your email — never your readable email or any psychometric data — and process this as independent controllers under their own privacy notices.

Processors (acting on TraitTune's instruction):

Independent controllers (acting on their own legal basis):

Advertising partners (independent controllers — active while advertising cookies are on):

To measure which ads lead to sign-ups and subscriptions, we forward conversion events (such as a completed sign-up, a started lead, a subscription, or a purchase) to these advertising partners through their server-to-server conversion APIs. To match a conversion to the right ad click, we may include a one-way SHA-256 hash of your email address — a fixed-length code that we cannot reverse back into your address; the partner can only use it to match you to an account it already holds. We never send your readable email. We also pass the conversion event name and, for purchases, a coarse value and currency, together with technical signals such as IP address and user agent. We never send your psychometric data (scores, theta, IRT parameters, or assessment answers) or the free-text you write to any advertising partner — this is the same hashed identifier they receive, whereas our analytics sub-processor (see PostHog above) operates under a separate analytics consent. Because these advertising partners are independent controllers, an identifier we have already shared is then subject to their own retention and deletion: to have them stop using or delete it, exercise your privacy rights with the partner directly. This forwarding happens only while advertising cookies are on and you have not signalled Global Privacy Control. In the EU, EEA, UK, Switzerland and Brazil advertising cookies stay off until you opt in; everywhere else, including the United States, they are on by default and you can switch them off at any time in Cookie preferences — see "Do Not Sell or Share".

7. Cookies & Tracking Technologies

8. International Data Transfers

Some of our processors are located in the United States. Where we transfer your personal data outside the European Economic Area, the United Kingdom, or Switzerland, we rely on the following safeguards:

• EU Standard Contractual Clauses (SCCs): Transfers to the US rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), incorporated into our Data Processing Agreement with each processor, together with the UK International Data Transfer Addendum for UK transfers.
• EU–US Data Privacy Framework (DPF): Where a processor is certified under the EU–US Data Privacy Framework (and its UK Extension), we additionally rely on that adequacy mechanism.
• Supplementary technical measures: Encryption in transit (TLS 1.3) and at rest (AES-256), pseudonymization where feasible, and strict access controls protect transferred data.
• Transfer Impact Assessment (TIA): We maintain and periodically review a Transfer Impact Assessment evaluating the legal regime of each destination country and the effectiveness of these safeguards.

You may request a copy of the relevant transfer safeguards by emailing privacy@traittune.com.

9. Data Retention & Deletion

We keep personal data only as long as necessary for the purpose it was collected. The schedule below is our single, coherent retention schedule:

• Active accounts: For the duration of your account, plus 30 days after closure.
• Psychometric (special-category) data: Kept while your consent to process it remains in force, up to a maximum of 5 years from the collection date. If you withdraw consent or request deletion, we delete your psychometric data within 30 days — regardless of the 5-year ceiling.
• AI-generated narratives (Pro): Retained per Section 3.7 of our Terms (hidden on downgrade; deleted after 12 months on a Free plan). A consent-withdrawal or deletion request overrides this and triggers deletion within 30 days.
• Transaction records: 7 years for payment information, where required by legal and tax obligations (this statutory retention survives a deletion request to the extent the law requires).
• Server logs: 90 days.

To be explicit: when you withdraw your Article 9 consent, all psychometric assessment data is erased within 30 days, even though some records (such as tax-mandated transaction records) must be retained for the periods stated above.

10. Children’s Privacy (COPPA Compliance)

TraitTune is designed for users aged 18 and above.

• Under 13: We do not knowingly collect data. Contact privacy@traittune.com to request deletion.
• Ages 18+: May use TraitTune independently.

11. Policy Updates

We may update this Privacy Policy from time to time. We will notify you of any material changes at least 30 days in advance through email notifications, platform announcements, and website updates.

12. Contact Information