Privacy Policy

1. Who We Are & Regulatory Framework

1.1 Legal Basis and Authority

This Privacy Policy is established by TraitTune, Inc. (“TraitTune,” “we,” “us”) in compliance with global data protection law. We apply GDPR as our baseline standard for all users worldwide.

1.2 Sanctions Compliance Notice

TraitTune is not available to persons or entities located in jurisdictions subject to (a) U.S. Department of the Treasury Office of Foreign Assets Control (OFAC) comprehensive sanctions — Crimea Region of Ukraine, Cuba, Iran, North Korea, Syria, and the Donetsk (DNR) and Luhansk (LNR) regions; (b) sectoral OFAC programs and broader U.S./EU/UK restrictive measures we apply by business decision — Russia and Belarus; and (c) jurisdictions where on-the-ground operations make platform availability inappropriate — Afghanistan and Myanmar. Access from these locations is blocked at the network level.

2. Information We Collect

2.1 Direct User-Provided Information

2.2 Automatically Collected Information

3. Legal Basis for Processing

3.1 Explicit Consent (GDPR Article 9(2)(a))

• Required: Explicit consent is the legal basis for processing psychometric data
• Granular: Core assessment consent is required; AI analysis and analytics are optional
• Revocable: Withdraw consent anytime — we cease processing and delete data
• Audited: Every consent event is logged with timestamp, IP, and version

3.2 Retroactive Consent — Existing Participants

If you participated in our 2025–2026 contest, you have not yet provided explicit consent under current regulations. In April 2026 we will contact you to request consent or offer to delete your data. You will have 30 days to respond.

3.3 Core Service Provision

• Conduct personality and skills assessments
• Generate personalized insights and recommendations
• Provide assessment results and reports
• Support your account and technical access

4. Your Privacy Rights

4.1 Universal Rights

• Right to Access: Request copies of your personal data
• Right to Correction: Update inaccurate or incomplete data
• Right to Deletion: Request removal of your personal data
• Right to Portability: Receive your data in a structured format (JSON/CSV), free of charge, within 30 days

4.2 GDPR Rights (EU/EEA Residents)

• Right to erasure (“right to be forgotten”): Request complete deletion of your account and all associated psychometric data. We will action within 30 days and confirm in writing.
• Right to restrict processing: Ask us to pause processing while a dispute is resolved
• Right to object: Object to processing based on legitimate interests
• Right not to be subject to automated decisions: Request human review of any automated personality profiling outputs
• Right to withdraw consent: Withdraw at any time; withdrawal does not affect lawfulness of prior processing

To exercise GDPR rights, email privacy@traittune.com with subject “GDPR Rights Request”. We respond within 30 days; complex requests may extend to 90 days with notice.

4.3 CCPA / CPRA Rights (California Residents)

Global Privacy Control (GPC)

We honor Global Privacy Control signals. If your browser sends GPC, we treat it as an opt-out of any data sharing or sale, even though no sale or sharing is taking place.

See Do Not Sell or Share My Personal Information for the standalone disclosure.

To submit a CCPA request, email privacy@traittune.com with subject “CCPA Rights Request”, or call +1 (347) 667-9624. We respond within 45 days.

5. Data Security

6. Data Processors & Sub-processors

We do not sell your data. TraitTune is the controller for your psychometric and account data. The vendors below act as processors under our instruction (GDPR Art. 28) — each is bound by a Data Processing Agreement with Standard Contractual Clauses. Stripe is listed separately because, for payment-card data it collects directly during checkout, Stripe acts as an independent controller under its own privacy notice (GDPR Art. 26).

Processors (acting on TraitTune's instruction):

Independent controllers (acting on their own legal basis):

7. Cookies & Tracking Technologies

8. International Data Transfers

• Standard Contractual Clauses approved by regulatory authorities
• Adequacy decisions for data transfers to approved countries
• Technical and organizational measures to protect data
• Regular compliance monitoring and audits

9. Data Retention & Deletion

• Active accounts: Duration of account plus 30 days after closure
• Psychometric data: Up to 5 years from collection date, or until you request deletion
• Transaction records: 7 years for payment information (legal/tax obligation)
• Server logs: 90 days

10. Children’s Privacy (COPPA Compliance)

TraitTune is designed for users aged 18 and above.

• Under 13: We do not knowingly collect data. Contact privacy@traittune.com to request deletion.
• Ages 13–17: Parental/guardian consent required. Enhanced protections apply.
• Ages 18+: May use TraitTune independently.

11. Policy Updates

We may update this Privacy Policy from time to time. We will notify you of any material changes at least 30 days in advance through email notifications, platform announcements, and website updates.

12. Contact Information