Privacy Policy

1. Who We Are & Regulatory Framework

1.1 Legal Basis and Authority

This Privacy Policy is established by TraitTune, Inc. (“TraitTune,” “we,” “us”) in compliance with global data protection law. We apply GDPR as our baseline standard for all users worldwide.

1.2 Sanctions Compliance Notice

TraitTune is not available to persons or entities located in jurisdictions subject to (a) U.S. Department of the Treasury Office of Foreign Assets Control (OFAC) comprehensive sanctions — Crimea Region of Ukraine, Cuba, Iran, North Korea, Syria, and the Donetsk (DNR) and Luhansk (LNR) regions; (b) sectoral OFAC programs and broader U.S./EU/UK restrictive measures we apply by business decision — Russia and Belarus; and (c) jurisdictions where on-the-ground operations make platform availability inappropriate — Afghanistan and Myanmar. Access from these locations is blocked at the network level.

1.3 EU & UK Representative (GDPR Article 27 / UK GDPR Article 27)

Because TraitTune is established outside the EU and UK but offers its services to individuals there, we are in the process of designating representatives under Article 27 of the EU GDPR and Article 27 of the UK GDPR. Until that designation is finalised, EU/EEA and UK data subjects, as well as supervisory authorities, may contact us directly at privacy@traittune.com on all matters relating to the processing of their personal data.

2. Information We Collect

2.1 Direct User-Provided Information

2.2 Automatically Collected Information

3. Legal Basis for Processing

3.1 Explicit Consent (GDPR Article 9(2)(a))

• Required: Explicit consent is the legal basis for processing psychometric data
• Granular: Core assessment consent is required; AI analysis and analytics are optional
• Revocable: Withdraw consent anytime — we cease processing and delete data
• Audited: Every consent event is logged with timestamp, IP, and version

3.2 Core Service Provision

• Conduct personality and skills assessments
• Generate personalized insights and recommendations
• Provide assessment results and reports
• Support your account and technical access

4. Your Privacy Rights

4.1 Universal Rights

• Right to Access: Request copies of your personal data
• Right to Correction: Update inaccurate or incomplete data
• Right to Deletion: Request removal of your personal data
• Right to Portability: Receive your data in a structured format (JSON/CSV), free of charge, within 30 days

4.2 GDPR Rights (EU/EEA Residents)

• Right to erasure (“right to be forgotten”): Request complete deletion of your account and all associated psychometric data. We will action within 30 days and confirm in writing.
• Right to restrict processing: Ask us to pause processing while a dispute is resolved
• Right to object: Object to processing based on legitimate interests
• Right not to be subject to automated decisions: Request human review of any automated personality profiling outputs
• Right to withdraw consent: Withdraw at any time; withdrawal does not affect lawfulness of prior processing

To exercise GDPR rights, email privacy@traittune.com with subject “GDPR Rights Request”. We respond within 30 days; complex requests may extend to 90 days with notice.

4.3 CCPA / CPRA Rights (California Residents)

Use of Sensitive Personal Information

We use your sensitive personal information solely to provide the service you have requested and for no other purpose; we do not use or disclose it to infer characteristics about you. Because our use is limited in this way under California Civil Code §1798.121(d), the CPRA right to limit the use of sensitive personal information does not apply, and we do not provide a separate “Limit the Use of My Sensitive Personal Information” link.

Global Privacy Control (GPC)

We honor Global Privacy Control signals. If your browser sends a GPC header, we treat it as a hard opt-out of cross-context behavioral advertising — our TikTok and Reddit pixels are disabled even if you previously consented to marketing cookies. Sale of personal information is not affected because no sale takes place.

See Do Not Sell or Share My Personal Information for the standalone disclosure.

To submit a CCPA request, email privacy@traittune.com with subject “CCPA Rights Request”, or call +1 (347) 667-9624. We respond within 45 days.

5. Data Security

5.1 Personal Data Breach Notification

If a personal data breach occurs, we will respond in line with GDPR Articles 33 and 34: where the breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it; and where the breach is likely to result in a high risk to you, we will notify affected users without undue delay. Our internal target is to inform affected users within 24 hours of confirming a breach affects them, which is consistent with — and never later than — the GDPR “without undue delay” standard. Notifications describe the nature of the breach, its likely consequences, and the measures we have taken or propose to take.

6. Data Processors & Sub-processors

We do not sell your data. TraitTune is the controller for your psychometric and account data. The vendors below act as processors under our instruction (GDPR Art. 28) — each is bound by a Data Processing Agreement with Standard Contractual Clauses. Stripe is listed separately because, for payment-card data it collects directly during checkout, Stripe acts as an independent controller under its own privacy notice (GDPR Art. 26). Advertising partners are listed in a third group: when you give us marketing consent they receive conversion events (such as page view, sign-up, subscription, or purchase) and, for matching, a one-way SHA-256 hash of your email — never your readable email or any psychometric data — and process this as independent controllers under their own privacy notices.

Processors (acting on TraitTune's instruction):

Independent controllers (acting on their own legal basis):

Advertising partners (independent controllers — only with marketing consent):

To measure which ads lead to sign-ups and subscriptions, we forward conversion events (such as a completed sign-up, a started lead, a subscription, or a purchase) to these advertising partners through their server-to-server conversion APIs. To match a conversion to the right ad click, we may include a one-way SHA-256 hash of your email address — a fixed-length code that we cannot reverse back into your address; the partner can only use it to match you to an account it already holds. We never send your readable email. We also pass the conversion event name and, for purchases, a coarse value and currency, together with technical signals such as IP address and user agent. We never send your psychometric data (scores, theta, IRT parameters, or assessment answers) or the free-text you write to any advertising partner — this is the same hashed identifier they receive, whereas our analytics sub-processor (see PostHog above) operates under a separate analytics consent. Because these advertising partners are independent controllers, an identifier we have already shared is then subject to their own retention and deletion: to have them stop using or delete it, exercise your privacy rights with the partner directly. This forwarding happens only when you have given marketing consent and have not signalled Global Privacy Control, and you can withdraw your consent at any time — see "Do Not Sell or Share".

7. Cookies & Tracking Technologies

8. International Data Transfers

Some of our processors are located in the United States. Where we transfer your personal data outside the European Economic Area, the United Kingdom, or Switzerland, we rely on the following safeguards:

• EU Standard Contractual Clauses (SCCs): Transfers to the US rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), incorporated into our Data Processing Agreement with each processor, together with the UK International Data Transfer Addendum for UK transfers.
• EU–US Data Privacy Framework (DPF): Where a processor is certified under the EU–US Data Privacy Framework (and its UK Extension), we additionally rely on that adequacy mechanism.
• Supplementary technical measures: Encryption in transit (TLS 1.3) and at rest (AES-256), pseudonymization where feasible, and strict access controls protect transferred data.
• Transfer Impact Assessment (TIA): We maintain and periodically review a Transfer Impact Assessment evaluating the legal regime of each destination country and the effectiveness of these safeguards.

You may request a copy of the relevant transfer safeguards by emailing privacy@traittune.com.

9. Data Retention & Deletion

We keep personal data only as long as necessary for the purpose it was collected. The schedule below is our single, coherent retention schedule:

• Active accounts: For the duration of your account, plus 30 days after closure.
• Psychometric (special-category) data: Kept while your consent to process it remains in force, up to a maximum of 5 years from the collection date. If you withdraw consent or request deletion, we delete your psychometric data within 30 days — regardless of the 5-year ceiling.
• AI-generated narratives (Pro): Retained per Section 3.7 of our Terms (hidden on downgrade; deleted after 12 months on a Free plan). A consent-withdrawal or deletion request overrides this and triggers deletion within 30 days.
• Transaction records: 7 years for payment information, where required by legal and tax obligations (this statutory retention survives a deletion request to the extent the law requires).
• Server logs: 90 days.

To be explicit: when you withdraw your Article 9 consent, all psychometric assessment data is erased within 30 days, even though some records (such as tax-mandated transaction records) must be retained for the periods stated above.

10. Children’s Privacy (COPPA Compliance)

TraitTune is designed for users aged 18 and above.

• Under 13: We do not knowingly collect data. Contact privacy@traittune.com to request deletion.
• Ages 18+: May use TraitTune independently.

11. Policy Updates

We may update this Privacy Policy from time to time. We will notify you of any material changes at least 30 days in advance through email notifications, platform announcements, and website updates.

12. Contact Information