Privacy Policy

1. Who We Are & Regulatory Framework

1.1 Legal Basis and Authority

This Privacy Policy is established by TraitTune, Inc. (“TraitTune,” “we,” “us”) in compliance with global data protection law. We apply the standard of each user's own jurisdiction: GDPR-level protections in the EU, EEA, UK, Switzerland and Brazil, and the applicable state privacy laws for residents of the United States.

1.2 Sanctions Compliance Notice

TraitTune is not available to persons or entities located in jurisdictions subject to (a) U.S. Department of the Treasury Office of Foreign Assets Control (OFAC) comprehensive sanctions — Crimea Region of Ukraine, Cuba, Iran, North Korea, Syria, and the Donetsk (DNR) and Luhansk (LNR) regions; (b) sectoral OFAC programs and broader U.S./EU/UK restrictive measures we apply by business decision — Russia and Belarus; (c) jurisdictions where on-the-ground operations make platform availability inappropriate — Afghanistan and Myanmar; and (d) the rest of Ukraine, by business decision, because network-level location cannot reliably separate the sanctioned Crimea, Donetsk and Luhansk regions from the rest of the country. Access from these locations is blocked at the network level.

1.3 EU & UK Representative (GDPR Article 27 / UK GDPR Article 27)

Because TraitTune is established outside the EU and UK but offers its services to individuals there, we are in the process of designating representatives under Article 27 of the EU GDPR and Article 27 of the UK GDPR. Until that designation is finalised, EU/EEA and UK data subjects, as well as supervisory authorities, may contact us directly at privacy@traittune.com on all matters relating to the processing of their personal data.

2. Information We Collect

2.1 Direct User-Provided Information

2.2 Automatically Collected Information

2.3 Google Calendar (only if you connect it)

TraitTune's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect Google Calendar, we read only when you are busy, never what your events are, so that we never offer a booking slot at a time when you are busy. We add the sessions you confirm to a separate “TraitTune” calendar that we create in your account. We cannot see or change your other calendars.

Your Google access is stored encrypted and is deleted when you disconnect Google Calendar or delete your account.

We do not use this data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except with your consent, for security purposes, or where the law requires it.

You can disconnect Google Calendar at any time in Settings, which revokes our access.

2.4 Zoom (only if you connect it)

If you connect Zoom, we use your Zoom account to create the video meeting for each session you book in TraitTune, and to move or delete that meeting when the session is moved or cancelled. The meeting is titled only “TraitTune session”, with its time and length. We send Zoom no client name, email address, case or notes, and we add no attendees. We keep the meeting's ID and its join link; we never store the host link.

We store your Zoom user ID and your Zoom access, encrypted. Our Zoom permission also lets us read, after a session, its cloud recording transcript, its AI Companion summary and transcript, and its list of participants. We use them only for the session import, which is on once you, as the practitioner, connect Zoom, which you can switch off at any time in Settings › Connected apps, and which runs only for clients who allowed TraitTune to record their sessions. From the participant list we keep only how many people joined and for how long, never their names. What we import is stored encrypted and waits on the client's case as a draft: nothing becomes part of the case record or reaches TraitTune's AI until you review and save it. While the import is off, we read no recordings, summaries or participant lists.

We do not use this data for advertising, do not sell it and do not use it to train AI models. Your Zoom access is deleted when you disconnect Zoom in Settings, remove TraitTune from your Zoom account, or delete your account.

Zoom processes your meetings under your own agreement with Zoom and its privacy statement.

2.5 Working with a practitioner (only if you join their practice)

If you join a practitioner's practice in TraitTune (for example a coach or a nutritionist), you decide what you share with them in your case, such as documents and test results. Your practitioner sees only what you share.

You can also let your practitioner ask TraitTune's AI about what you share in that case. When you accept the case, this switch is on, except in the EU, EEA, UK, Switzerland and Brazil, where you turn it on yourself. Health and clinical results (for example depression, anxiety or burnout scales) are never included unless you add them yourself.

That conversation is private to your practitioner. The AI reads only what you allowed in that case, never your personal chats or memory. It runs on AWS Bedrock (see §6), and we do not use this data to train AI models.

You can turn it off, or change what the AI may read, at any time in your case. Your practitioner's next question no longer uses it, and closing the case deletes the conversation.

2.6 Slack (only if your company connects it)

If an owner or admin of your company's TraitTune workspace adds TraitTune to your company's Slack, TraitTune answers in Slack when someone mentions it, sends it a direct message or uses the /traittune command. We receive only those messages. We do not read channels, other people's direct messages or files, and we do not keep a copy of your Slack conversations.

We store the Slack workspace's ID and name, the app's Slack access (encrypted) and, once you confirm it yourself in TraitTune, the link between your Slack user ID and your TraitTune account. For each answer we keep a record without its text: who asked, in which conversation, where the answer went, and whose shared TraitTune data it drew on.

What you ask TraitTune in Slack, and what it answers, can become notes in your TraitTune memory so your Companion remembers it. These notes are encrypted, marked as coming from Slack, and you can see and delete them in your memory. Answers are written by TraitTune's AI models, hosted in the United States, and can be wrong. Answers about the team appear in the thread only while your team picture is open; anything about one person goes privately to the person who asked.

We do not use Slack data for advertising, do not sell it, do not use it to train AI models and never use one company's Slack data for another. When your company removes TraitTune from Slack, in TraitTune or in Slack, we delete its Slack access, every account link and the memory notes that came from Slack straight away. Leaving your company's TraitTune workspace or deleting your account ends your link. Your company's Slack conversations stay in Slack under its agreement with Slack and Slack's privacy policy.

2.7 Microsoft (only if you sign in with it or connect it)

If you sign in with Microsoft, Microsoft gives us your name, your email address and an ID for your Microsoft account. We use them only to create your TraitTune account and sign you in. We never see your Microsoft password.

If you connect Microsoft 365 or Outlook, we read only when you are busy in your Outlook calendar, never what your events are, so that we never offer a booking slot at a time when you are busy. With a work or school account we also create the Microsoft Teams meeting for each session you book in TraitTune, and move or delete it when the session is moved or cancelled. The meeting is titled only “TraitTune session”, with its time and length; we send Microsoft no client name, email address, case or notes, and we add no attendees. We keep the meeting's join link.

Your Microsoft access is stored encrypted and is deleted when you disconnect Microsoft in Settings, remove TraitTune from your Microsoft account, or delete your account.

We do not use this data for advertising, do not sell it and do not use it to train AI models. Microsoft handles your account and your meetings under your own agreement with Microsoft and Microsoft's privacy statement.

2.8 AI assistants you connect (only if you connect one)

You can connect your own AI assistant, for example Claude, ChatGPT, Gemini, Perplexity or Microsoft Copilot, to TraitTune. We ask you on a TraitTune screen what it may read, and we send it only that, and only when it asks: a reading of your working style, your trait scores as TraitTune shows them to you, and your published “Instruction to me” card. We never send an assistant the measurement data behind your scores, your assessment answers, your chats, your memory or your documents.

On Pro, Max or a Team seat, your assistant can also read how to work with the people you are connected with in TraitTune, their trait scores as TraitTune shows them to you, and how they like to hear feedback. Being connected in TraitTune is what allows this. Anyone can turn it off for everyone in Settings › Privacy › Assistants of my connections, and sees there each time someone’s assistant read about them; a block stops it at once. In a Team workspace, assistants can read team readings, with the numbers of the team picture, only if the workspace admin turns this on. An owner’s or admin’s assistant can then also read the team’s totals: how many people joined, finished the assessment and are in the team picture, what changed in the last month, and how the team uses the Companion, coaches and growth budgets. These are counts for groups of at least two people, never who did what.

The company behind the assistant is not our processor. It receives these readings because you asked us to send them, and handles them under your own agreement with it. Depending on your plan and settings with that company, it may keep them in your conversation history and may use them to improve its models; check its privacy settings. Only the assistants on our list can connect.

For every request we keep a record of which assistant asked, for which reading and about whom, when, and whether it was answered, never the content, for 13 months. Settings › Privacy › Connected assistants lists your assistants and when each last read your data; disconnecting one stops it at once. The access we give an assistant lasts 10 minutes at a time and works only for these readings. We do not use this data for advertising, do not sell it and do not use it to train AI models.

2.9 Preparing a 1:1 in a team (only if you are in a team)

In a Team workspace, anyone can prepare a conversation with a teammate, and a coach the team hired can prepare one with a team member who agreed to work with them, in both directions. By default the preparation uses both people’s profiles, so it can start before the other person agrees or the meeting is booked.

You can turn this off for yourself at any time in the team’s “What the team sees about me” or on the 1:1 screen; others then prepare from their own profile only. Your team’s admin can turn it off for everyone but can never make it required. Notes you save are private to you, and the preparation never rates anyone and is never used for employment decisions.

3. Legal Basis for Processing

3.1 Explicit Consent (GDPR Article 9(2)(a))

• Required: Explicit consent is the legal basis for processing psychometric data
• Granular: Core assessment consent is required; AI analysis and analytics are optional
• Revocable: Withdraw consent anytime — we cease processing and delete data
• Audited: Every consent event is logged with timestamp, IP, and version
• Assistants you connect: Sending readings to an AI assistant you connect is based on your consent, given for each assistant on the connection screen. You can withdraw it at any time by disconnecting the assistant in Settings › Privacy.

3.2 Core Service Provision

• Conduct personality and skills assessments
• Generate personalized insights and recommendations
• Provide assessment results and reports
• Support your account and technical access

3.3 Marketing Communications

With your permission, we send marketing communications so you can get the most out of TraitTune. This includes product updates and new-feature announcements, our periodic newsletter, and promotional offers such as discounts and promo codes. We may reach you by email, push notification (if enabled), and in-app messages.

Users outside the EU / EEA / UK / Switzerland / Brazil

By creating an account and accepting this Privacy Policy and our Terms of Service, you agree to receive marketing communications from us. This is an opt-out arrangement: marketing is on by default, and you can turn it off at any time — with no effect on your ability to use the service.

Users in the EU / EEA / UK / Switzerland / Brazil

We will only send you marketing communications if you have given separate, explicit opt-in consent, requested independently of accepting our Terms of Service (typically via a dedicated consent prompt). If you do not opt in, you will still receive essential service messages (for example security, billing, and transactional emails) but no marketing. You may withdraw this consent at any time; withdrawal is as easy as giving it and does not affect the lawfulness of processing before withdrawal.

How to opt out or unsubscribe

• Settings: Manage your communication preferences at any time in Dashboard → Settings → Notifications.
• One-click unsubscribe: Every marketing email includes a one-click unsubscribe link in its footer.
• Push & in-app: Disable push notifications in your device or browser settings; in-app marketing follows the same preference toggle.

Opting out of marketing does not stop transactional or service messages (such as security alerts, billing receipts, and important account notices), which we must send to operate your account. We never sell your contact details, and we do not condition access to the service on receiving marketing.

3.4 SMS Messaging

If you choose to sign in or verify your account with a phone number, TraitTune, Inc. sends you a one-time verification code by SMS (text message), and may send account notifications tied to your existing account. You opt in by entering your phone number on our sign-in screen and tapping “Send code”; that tap is your consent. We do not send marketing or promotional text messages.

• What we send: one-time verification codes (for example, “Your TraitTune verification code is 123456”), security alerts, and account notifications such as “your profile is ready”, a Companion check-in reminder, or a reply from our support team.
• Frequency: one message per sign-in or verification request, plus occasional account notifications. Message frequency varies.
• Cost: message and data rates may apply according to your carrier’s plan.
• Opt out: reply STOP to any message to stop receiving texts. You can also remove your phone number in Dashboard → Settings → Privacy, or sign in with another method.
• Help: reply HELP to any message, or email support@traittune.com.
• Sharing: mobile information (your phone number and SMS opt-in) is never sold or shared with third parties or affiliates for marketing or promotional purposes. It is shared only with the messaging provider that delivers the code (Twilio) as our processor.

Carriers are not liable for delayed or undelivered messages.

4. Your Privacy Rights

4.1 Universal Rights

• Right to Access: Request copies of your personal data
• Right to Correction: Update inaccurate or incomplete data
• Right to Deletion: Request removal of your personal data
• Right to Portability: Receive your data in a structured format (JSON/CSV), free of charge, within 30 days

4.2 GDPR Rights (EU/EEA Residents)

• Right to erasure (“right to be forgotten”): Request complete deletion of your account and all associated psychometric data. We will action within 30 days and confirm in writing.
• Right to restrict processing: Ask us to pause processing while a dispute is resolved
• Right to object: Object to processing based on legitimate interests
• Right not to be subject to automated decisions: Request human review of any automated personality profiling outputs
• Right to withdraw consent: Withdraw at any time; withdrawal does not affect lawfulness of prior processing

To exercise GDPR rights, email privacy@traittune.com with subject “GDPR Rights Request”. We respond within 30 days; complex requests may extend to 90 days with notice.

4.3 CCPA / CPRA Rights (California Residents)

Use of Sensitive Personal Information

We use your sensitive personal information solely to provide the service you have requested and for no other purpose; we do not use or disclose it to infer characteristics about you. Because our use is limited in this way under California Civil Code §1798.121(d), the CPRA right to limit the use of sensitive personal information does not apply, and we do not provide a separate “Limit the Use of My Sensitive Personal Information” link.

Global Privacy Control (GPC)

We honor Global Privacy Control signals in every region. If your browser sends a GPC signal, we treat it as a hard opt-out of cross-context behavioral advertising — our TikTok and Reddit pixels stay off, whether you had previously accepted marketing cookies or advertising was on by default for your region. We check for the signal before anything is written, so a browser broadcasting GPC never receives an advertising pixel. Sale of personal information is not affected because no sale takes place.

See Do Not Sell or Share My Personal Information for the standalone disclosure.

To submit a CCPA request, email privacy@traittune.com with subject “CCPA Rights Request”, or call +1 (833) 785-2999. We respond within 45 days.

5. Data Security

Encryption of Your Content

We protect the most sensitive content you create — your AI-chat messages, your open-ended assessment answers, and the notes we keep to personalize your experience — with per-record envelope encryption using AWS Key Management Service (AES-256-GCM), and we are rolling this protection out progressively across these content types. Where it applies, each record is encrypted under its own cryptographic context, so no single key unlocks your data in bulk. Access to decrypt encrypted content is limited to the automated application services that operate the product, and every such access is logged and continuously monitored. We are also progressively removing standing administrative access to your decrypted content, with the objective that reading it in plaintext requires a strictly limited, dual-controlled, per-record “break-glass” procedure — invoked only when we are compelled by valid legal process, and independently audited each time. Apart from the service providers (sub-processors) we rely on to operate the product — described in Section 6, Data Processors and Sub-processors — we disclose your content to outside parties only under valid legal process, as described in our Legal Disclosure practices.

5.1 Personal Data Breach Notification

If a personal data breach occurs, we will respond in line with GDPR Articles 33 and 34: where the breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it; and where the breach is likely to result in a high risk to you, we will notify affected users without undue delay. Our internal target is to inform affected users within 24 hours of confirming a breach affects them, which is consistent with — and never later than — the GDPR “without undue delay” standard. Notifications describe the nature of the breach, its likely consequences, and the measures we have taken or propose to take.

6. Data Processors & Sub-processors

We do not sell your data. TraitTune is the controller for your psychometric and account data. The vendors below act as processors under our instruction (GDPR Art. 28) — each is bound by a Data Processing Agreement with Standard Contractual Clauses. Stripe is listed separately because, for payment-card data it collects directly during checkout, Stripe acts as an independent controller under its own privacy notice (GDPR Art. 26). Advertising partners are listed in a third group: while advertising cookies are on — which requires your opt-in in the EU, EEA, UK, Switzerland and Brazil, and is the default elsewhere — they receive conversion events (such as page view, sign-up, subscription, or purchase) and, for matching, a one-way SHA-256 hash of your email — never your readable email or any psychometric data — and process this as independent controllers under their own privacy notices.

Processors (acting on TraitTune's instruction):

Independent controllers (acting on their own legal basis):

Advertising partners (independent controllers — active while advertising cookies are on):

To measure which ads lead to sign-ups and subscriptions, we forward conversion events (such as a completed sign-up, a started lead, a subscription, or a purchase) to these advertising partners through their server-to-server conversion APIs. To match a conversion to the right ad click, we may include a one-way SHA-256 hash of your email address — a fixed-length code that we cannot reverse back into your address; the partner can only use it to match you to an account it already holds. We never send your readable email. We also pass the conversion event name and, for purchases, a coarse value and currency, together with technical signals such as IP address and user agent. We never send your psychometric data (scores, theta, IRT parameters, or assessment answers) or the free-text you write to any advertising partner — this is the same hashed identifier they receive, whereas our analytics sub-processor (see PostHog above) operates under a separate analytics consent. Because these advertising partners are independent controllers, an identifier we have already shared is then subject to their own retention and deletion: to have them stop using or delete it, exercise your privacy rights with the partner directly. This forwarding happens only while advertising cookies are on and you have not signalled Global Privacy Control. In the EU, EEA, UK, Switzerland and Brazil advertising cookies stay off until you opt in; everywhere else, including the United States, they are on by default and you can switch them off at any time in Cookie preferences — see "Do Not Sell or Share".

7. Cookies & Tracking Technologies

8. International Data Transfers

Some of our processors are located in the United States. Where we transfer your personal data outside the European Economic Area, the United Kingdom, or Switzerland, we rely on the following safeguards:

• EU Standard Contractual Clauses (SCCs): Transfers to the US rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), incorporated into our Data Processing Agreement with each processor, together with the UK International Data Transfer Addendum for UK transfers.
• EU–US Data Privacy Framework (DPF): Where a processor is certified under the EU–US Data Privacy Framework (and its UK Extension), we additionally rely on that adequacy mechanism.
• Supplementary technical measures: Encryption in transit (TLS 1.3) and at rest (AES-256), pseudonymization where feasible, and strict access controls protect transferred data.
• Transfer Impact Assessment (TIA): We maintain and periodically review a Transfer Impact Assessment evaluating the legal regime of each destination country and the effectiveness of these safeguards.

You may request a copy of the relevant transfer safeguards by emailing privacy@traittune.com.

9. Data Retention & Deletion

We keep personal data only as long as necessary for the purpose it was collected. The schedule below is our single, coherent retention schedule:

• Active accounts: For the duration of your account. Deleting your account deletes your account data immediately — there is no 30-day waiting period. Your messages in other people's chats are replaced at once by a “Message deleted” placeholder, which is removed within 30 days. The items below set out what we must keep for longer.
• Psychometric (special-category) data: Kept while your consent to process it remains in force, up to a maximum of 5 years from the collection date. If you withdraw consent or request deletion, we delete your psychometric data within 30 days — regardless of the 5-year ceiling.
• AI-generated narratives (Pro): Retained per Section 3.7 of our Terms (hidden on downgrade; deleted after 12 months on a Free plan). A consent-withdrawal or deletion request overrides this and triggers deletion within 30 days.
• Transaction records: 7 years for payment information, where required by legal and tax obligations (this statutory retention survives a deletion request to the extent the law requires).
• Server logs: 90 days.
• Assistant access log: 13 months (which assistant read which kind of reading, about whom, when and with what outcome; never the content).

To be explicit: when you withdraw your Article 9 consent, all psychometric assessment data is erased within 30 days, even though some records (such as tax-mandated transaction records) must be retained for the periods stated above.

10. Children’s Privacy (COPPA Compliance)

TraitTune is designed for users aged 18 and above.

• Under 13: We do not knowingly collect data. Contact privacy@traittune.com to request deletion.
• Ages 18+: May use TraitTune independently.

11. Policy Updates

We may update this Privacy Policy from time to time. We will notify you of any material changes at least 30 days in advance through email notifications, platform announcements, and website updates.

12. Contact Information