Privacy policy

• There are no accounts or passwords. Your browser gets a random number, and the site uses it to find your results.
• We get your e-mail address only when you pay: you enter it on Stripe's payment page.
• We never see or store bank card numbers: you enter them on Stripe's side.
• There are no ads and no tracking cookies on the site. We keep anonymous visit statistics that use no cookie (see below); the one cookie there is remembers your language.
• A few services help us run the site: Supabase, Vercel, Anthropic, Resend and Stripe (payments). Below you can see exactly what each of them receives.
• To have your data deleted, write to support@profilemap.app. We reply within one month.

Your data on profilemap.app is handled by Petro Gaida. Postal address: Co. Kerry, Ireland. This is a private individual (country: Ireland). In GDPR terms, the data controller.

For any question about your data, write to support@profilemap.app.

This is everything the site collects and stores.

• Anonymous visit statistics. Vercel, who hosts the site, also counts page views and where visitors come from (Vercel Web Analytics). It works without a cookie and without anything that ties two visits to the same person: what it gives us is aggregate counts, never your browser ID.
• A random browser ID. On your first visit your browser creates a random number (the key is called profilemap_visitor_id). It is kept in your browser and in our database. It is what lets us do without accounts: the number tells the site whose results are whose. Stored with it are the language you opened the site in and the times of your first and last visit.
• What you do on the site. Which tests you start and finish, whether you reach the point where the offer appears, whether you scroll to it, whether you open the payment page, and whether you ask for an access link. Tied to the same browser ID as everything else on this list; never your e-mail address, your IP address or your answers.
• The campaign tag and the page that sent you here, from your first visit only. If the address of the first page you opened carried something like ?utm_source=..., we keep those tags, together with the page that linked here, if any. Saved once, with your browser ID, and a later visit never updates it.
• Your answers and scores. When you finish a test, all your answers and the time you finished are sent to the server. The server works out the scores itself and saves them. While a test is unfinished, your partial answers stay in your browser only. If you ask for a picture to share, the server draws it from your saved scores and sends it to your device; the picture has no name or e-mail address, and we do not save it.
• Interface language. We save the language you took the tests in and the language your readings are written in.
• Your readings (“the breakdown”). If you buy the four readings, all four are written right after the payment and saved on our side, separately for each mode and language, so they don't have to be written again when you open them.
• The mode you pick first. Which of the four questions (interview, work, relationships, under pressure) you pick first. It is stored with your browser ID and decides which reading comes first in the e-mail with your readings. You can pick it before paying.
• E-mail address. Only when you pay. You enter it on Stripe's payment page and Stripe passes it to us. It is needed to confirm the payment, unlock the readings, send you the e-mail with your readings and, if you ask, give you access back on another device. When you get access back in another browser, that browser's record in our database receives the same address.
• Payment details. The amount, currency, date, status, the numbers Stripe gives to the payment (of the payment session and of the payment itself), and the fact and time of your agreement to the terms, which Stripe reports to us and we save with the payment record. If the payment is refunded or disputed with the bank, Stripe tells us and the status changes. You enter the card number, expiry date and code on Stripe's side: the site does not receive or store them.
• A record of requests for an access link (a hash, not your address). When you ask for a link to get access back by e-mail, the site saves the time of the request and a hash of the address you typed. A hash is a code calculated from the address with a secret key that only our server has. It is not the address, and the address cannot be read back from it. It is used for one thing: to send no more than three letters an hour to one address, so that the form cannot be used to flood someone's mailbox. The record is kept for one day and then deleted: the site clears out records older than a day each time anybody asks for a link, so if nobody asks, a record may stay a little longer. It is saved whether or not the address has made a purchase.
• AI usage records. For every reading that is written we record which model wrote it, how many tokens it took, the mode, the language and roughly what it cost. The record contains neither the text nor your scores, but it is linked to your browser ID.
• Technical request data. Like any website, our host sees your IP address, browser type, the address of the page requested and the time. Some requests from the site to the server carry the browser ID in the address, so it ends up in these logs too. The logs are kept by Vercel; we do not copy them into our own database.

The site saves data in localStorage. That is the site's own memory inside your browser, not a cookie:

• profilemap_visitor_id — the browser ID (when you get access back on another device, the browser replaces it with the ID of the browser where the purchase was made, so that your results and readings open here too);
• profilemap:result:… — the answers and scores of each test you have finished;
• profilemap:result:…:progress — partial answers of a test you haven't finished;
• profilemap:synced — a note of which results have already been sent to the server;
• profilemap:unlocked — a remembered payment status (used to draw the page; the server decides who gets the breakdown);
• profilemap:report:… — a copy of the text of each reading you have opened, so the page opens straight away;
• profilemap:entry-mode — the mode you picked first (used to draw the page; the server keeps its own copy).

There is also a single cookie, NEXT_LOCALE, which remembers the language you chose. It has no expiry date, so your browser deletes it when it closes. It tracks nothing.

All of this is needed for the site to work the way you ask it to. The visit statistics above use no cookie and nothing that identifies you either, which is why there is still no cookie consent banner. There are no ads and no third-party tracking code on the site.

You can wipe the local data in your browser settings (“site data” or “cookies and site data”). That removes the copy on your device but not the one on our server. How to have that deleted too is explained below, under your rights.

• To show you your results and profile, to keep them on the server and to draw the picture to share when you ask for it. This is the service you asked for. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• To write the breakdown, e-mail it to you, confirm the payment, unlock access and give it back when you ask for a link. Same basis: performance of a contract, Article 6(1)(b) GDPR.
• To keep payment records for tax purposes. Legal basis: a legal obligation, Article 6(1)(c) GDPR.
• To protect the site from faults and abuse, to limit how often a link for access can be asked for one address and to keep track of AI costs. Legal basis: our legitimate interest, Article 6(1)(f) GDPR.

We do not use your data for advertising, we do not sell it and we do not pass it to anyone for marketing. We use your e-mail address only for the payment, for the e-mail with your readings, for the letter with the access link and for replying to you.

The text of the breakdown is written automatically: a language model receives your numerical scores and writes the text from them. This is not a decision about you that affects your rights: the breakdown does not forbid or allow you anything.

We use five services. For each one, this is what it receives and what it does not.

We do not sell data and we do not pass it to advertising networks. Data may be handed to a public authority only where the law requires it.

Supabase stores data in the EU. Vercel, Anthropic, Resend and Stripe, however, are US companies, and the servers your data passes through may be outside the European Economic Area, in particular in the United States. That is why we do not claim that data always stays in the EU.

Transfers to such companies rely on the EU's standard contractual clauses and/or the EU–US Data Privacy Framework, as set out in their data processing terms. You can read more in their privacy policies: Supabase, Vercel, Anthropic, Resend, Stripe.

• Browser ID, answers, scores and the breakdown text — until you ask us to delete them. They are not deleted automatically.
• E-mail address — until you ask us to delete it. When we delete it, it is erased from the payment record too.
• Payment records (amount, date, payment number, the record of your agreement to the terms) — 6 years, which is how long Irish tax law requires transaction records to be kept. If you ask for deletion, the e-mail and the link to the browser ID are removed from the record and the rest stays for that period.
• AI usage records — after your data is deleted the record stays as a cost record, but no longer linked to you.
• Records of access-link requests (the hash of the address and the time) — one day. The site deletes records older than a day each time anyone asks for a link, so one may stay a little longer if nobody asks.
• The access link — works for 24 hours after it is sent. We do not save links: the site recognises a link by the signature on it.
• Technical logs of the host and copies of e-mails are kept by Vercel and Resend under their own rules and on their own plans. We do not set those periods and do not keep copies of the logs or of the e-mails ourselves; see their privacy policies, linked above.
• Stripe's own records of the payment are kept by Stripe under its privacy policy and its legal obligations; deleting our copy does not delete them.
• The copy in your browser — until you clear the site's data.

Under the GDPR you have the right to:

• get a copy of your data and find out how we use it (access);
• have incorrect data corrected;
• have your data deleted;
• restrict how it is used;
• receive your data in a portable format (export);
• object to processing that is based on our legitimate interest.

How to use these rights. Write to support@profilemap.app and tell us what you need. We will reply within one month.

How we know the data is yours. If you paid for a breakdown, write from the address you gave when paying. If we have no e-mail address, your records can only be found by the browser ID. Open the site in the browser where you took the tests and find the ID in the browser's developer tools (usually the F12 key): the Application or Storage tab, Local Storage, profilemap.app, the key profilemap_visitor_id. Send us that value. Without it we cannot tell your records from anyone else's, and that protects you as well.

What happens when we delete. We erase the browser ID, answers, scores, breakdown texts and e-mail address. If you got access back in other browsers, each of them has its own ID tied to your address, and we erase those records too. From the payment record we remove the e-mail and the link to the browser ID. The record itself stays, because it has to be kept for tax reporting (see “How long we keep data”). If you open the site in the same browser after deletion, it will create a record with the same browser ID again. To prevent that, clear the site's data in your browser. Stripe keeps its own records of the payment under its own policy; deleting our copy does not remove them, and requests about them go to Stripe.

If you think we are handling your data wrongly, you can complain to a supervisory authority. In Ireland that is the Data Protection Commission (dataprotection.ie). If you live in another EU country you can also turn to the authority there. You are welcome to write to us first, but you don't have to.

The site is meant for people aged 18 and over. We do not knowingly collect data of anyone under 18. If such data has ended up on the site anyway, it is deleted when you write to support@profilemap.app.

If we change this policy, we will update the text and the date at the top of the page.