1. Introduction
Psychology Me Ltd ("Psychology.me", "we", "us", or "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our website at psychology.me and related services (the "Service").
Psychology Me Ltd is registered in the United Kingdom (London). For data protection purposes, we are the data controller. Our legal basis for processing personal data is your explicit consent, the performance of a contract, and our legitimate business interests.
2. Data We Collect
2.1 Information You Provide
- Email address - used for account creation (magic link authentication), report delivery, and transactional communications.
- Assessment responses - your answers to assessment questions, which constitute special-category data under GDPR (data concerning health or psychological characteristics).
- Payment information - processed securely by Stripe. We do not store credit card numbers on our servers.
- Report feedback - if you choose to use the optional "Was this report helpful?" widget on a report, we store your rating and any free-text comment you submit, linked to that report, so we can improve the quality of our reports. Providing feedback is entirely voluntary.
2.2 Information Collected Automatically
- Usage data - pages visited, assessment completion events, referral sources, and general interaction patterns. We record some of this on our own first-party servers; additional product-analytics events are collected only after you accept non-essential cookies (see Sections 5 and 8).
- Technical data - IP address, browser type, device type, and operating system for performance and security purposes.
- Cookies and similar technologies - essential cookies for authentication session management, plus consent-gated product-analytics storage. We do not use advertising or social-media tracking cookies. See Section 8 for details.
3. Special-Category Data (Psychological Assessment Responses)
Your assessment responses may reveal information about your psychological characteristics. Under GDPR, this is classified as special-category data. We process this data solely on the basis of your explicit consent, which you provide when you begin an assessment.
You may withdraw your consent at any time by requesting deletion of your data (see Section 6). Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
4. How We Use Your Data
- Delivering your assessment results, scores, and personalised reports.
- Processing payments and fulfilling your purchase of detailed reports or credits.
- Sending transactional emails (report delivery, magic link authentication, purchase confirmations).
- Improving the accuracy and quality of our assessments and service.
- Aggregated, anonymised statistical analysis to improve norms and assessment quality (no individual identification).
- Complying with legal obligations, including responding to lawful data subject requests.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
5. Data Sharing & Third-Party Processors
We share personal data only with the following categories of processors, all bound by data processing agreements:
- Stripe - live payment processing. When you make a purchase, your card details are entered into and handled directly by Stripe, which acts as an independent payment processor. We never receive or store your full card number on our servers; we retain only a transaction reference, the amount, and the payment status. Stripe is PCI DSS compliant. See Stripe's privacy policy for how it processes payment data.
- OpenAI - personalized report generation. Your assessment scores and the relevant interpretation content are sent to OpenAI's API to draft parts of your personalized report (see Section 9). This applies only to personalized reports; detailed reports are produced following strict scientific procedures with no AI involvement. We send the data needed to generate your report; we do not send your email address or other directly identifying account details for this purpose. OpenAI processes this data as our service provider to return the generated text.
- PostHog (cloud analytics provider) - product analytics. Loaded only after you accept non-essential cookies. Collects usage events and page views (no advertising profiling, no session recording, and assessment answers are excluded from automatic capture). Data is sent to PostHog's EU cloud (or, where a deployment is configured for it, PostHog's US cloud). See Section 8.
- Plausible (privacy-preserving page-view analytics), where enabled, is loaded for all visitors. It is cookieless, stores no identifiers on your device, and collects no personal data, so under UK PECR / ePrivacy it does not require consent. It provides aggregate page-view and outbound-link trends only.
- Hosting infrastructure - cloud hosting providers for database, file storage, and application hosting (data encrypted at rest and in transit).
- Email service provider - transactional email delivery (e.g., magic links, report delivery).
We do not sell, rent, or share your personal data with third parties for their own marketing purposes. Some processors (e.g., Stripe, Google, PostHog) may process data outside the UK/EEA; where they do, transfers are governed by appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.
6. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access - request a copy of your personal data.
- Right to rectification - request correction of inaccurate data.
- Right to erasure ("right to be forgotten") - request deletion of your personal data and assessment records.
- Right to data portability - receive your data in a structured, machine-readable format (JSON export).
- Right to restrict processing - request that we limit how we use your data.
- Right to object - object to processing based on legitimate interests.
- Right to withdraw consent - withdraw consent for processing of special-category data at any time.
To exercise any of these rights, email us at [email protected] or use the data export and deletion options in your account dashboard. The self-service export returns your data in a structured, machine-readable JSON file and is available up to once per 24 hours; deletion permanently removes your account and associated records. We will respond to requests made by email within 30 days in accordance with GDPR timelines.
7. Data Retention & Security
Retention
- Assessment responses and results are retained for as long as your account is active or as needed to provide the Service.
- Upon account deletion, your account, assessment responses, results, reports, and other personal records are permanently removed. A small number of operational records (such as product-analytics events) are retained in anonymised form - with your account identifier, IP address, and user agent stripped - so they can no longer be linked to you.
- Payment records may be retained for up to 7 years for tax and legal compliance purposes (Stripe processor retention).
Security Measures
- TLS 1.3 encryption for all data in transit.
- Encrypted storage at rest for databases and file storage.
- Row-Level Security (RLS) and audit logging for database access control.
- Signed URLs with time-to-live (TTL) for report/PDF access.
- Regular security reviews and dependency audits.
9. AI Processing & AI-Generated Content
Detailed reports are produced following strict scientific procedures from your assessment results and validated interpretation content, with no AI involvement. Parts of your personalized report are generated with the assistance of artificial intelligence. To produce them, we send your assessment scores and the relevant approved interpretation content - which includes the optional context details you have chosen to share (such as your work situation, life circumstances, or areas of focus) - to OpenAI, which returns drafted text grounded in those inputs. We do not send your email address or other directly identifying account details for this purpose, and the AI output is constrained by our approved interpretation guidelines rather than generated freely.
AI-generated content is reviewed for accuracy and appropriateness and is disclosed within the report where applicable. The lawful basis for this processing is the performance of our contract with you (delivering the report you requested). For more on OpenAI as a processor, see Section 5.
10. Children's Privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us at [email protected] and we will promptly delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:
Psychology Me Ltd
Registered in England & Wales (London)
Email: [email protected]
General: [email protected]
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.