Privacy Policy

Data Controller

IQ Career Lab is the data controller responsible for your personal data. Contact us at support@iqcareerlab.com for any privacy-related inquiries.

Categories of Data Collected

We collect and process the following categories of personal data:

• Account data: name, email address (optional for free tests, required for purchases), age, country/region, and optional gender
• Test data: question responses, scores, timing data, result reports, personality trait scores (Big Five OCEAN dimensions), and response consistency metrics
• Payment data: Stripe customer ID, transaction records, and subscription billing records (plan type, billing cycle, renewal dates, cancellation status). We never store full card numbers.
• AI data: AI-generated score justifications, report narratives, and job enrichment outputs
• Technical data: IP address, user agent, device type, and geolocation derived from Vercel headers. For security and fraud-prevention contexts (including the activity log, purchases, and gift code redemption) we retain the full IP address and the user-agent string. For analytics, your IP address is sent to our analytics provider (Mixpanel), which uses it to determine your approximate geographic location (for example, country, region, and city) and to enrich your analytics profile.
• Gift code data: gift code purchase records, purchaser email address, optional recipient email address, redemption records including IP address, user agent, and country (retained for fraud prevention and chargeback defense). When a gift code is sent to a recipient, the purchaser's name or email may be shared with the recipient in the notification email.
• Activity log data: key account events (sign-in, settings changes, billing actions, consent changes) logged with a timestamp, the full IP address, and the user-agent string (stored verbatim, capped at 256 characters). We retain this data for security and fraud-prevention purposes for a maximum of 90 days.
• Usage data: page views, test completions, and feature usage via Mixpanel analytics (cookieless, using a localStorage device identifier). See the Analytics section below for details.

Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

• Contract (Art. 6(1)(b)): account management, test delivery, and payment processing
• Legitimate interest (Art. 6(1)(f)): fraud prevention, service improvement, analytics, and checkout-recovery emails for a purchase you started
• Consent (Art. 6(1)(a)): AI personalization (managed at /account/consent), marketing communications, and purchase-reminder emails for a test you didn't buy
• Legal obligation (Art. 6(1)(c)): tax records and chargeback evidence retention

Gift Recipient Data (GDPR Article 6(1)(f))

When a purchaser provides a recipient's email address during gift code checkout, we process that email address under the lawful basis of legitimate interest (GDPR Article 6(1)(f)). The legitimate interest is the purchaser's desire to deliver a gift to the recipient. We use the recipient's email solely to send a one-time gift code notification email. We do not create an account for the recipient, build a profile, or send further marketing emails unless the recipient independently creates an account and consents to communications. If the gift code is not redeemed within 90 days, we automatically delete the recipient's email address from our records. Gift recipients may contact us at support@iqcareerlab.com at any time to request immediate deletion of their email.

Checkout Recovery and Purchase-Reminder Emails

We run a small automated email program that helps you finish what you started and get more from your results. Any one message is part of a short series (up to three emails), and you are only ever enrolled in one series at a time so you are never sent overlapping campaigns. We treat two situations differently:

• Checkout recovery (an order you started). When you begin a checkout and it expires without payment, we may email you to help you complete it. We process your email for this purpose under legitimate interest (GDPR Article 6(1)(f)) — you initiated a transaction, and the reminder relates directly to it. This applies to signed-in users and to guests (including gift-code purchasers) who entered an email at checkout.
• Reminders and recommendations (based on your test history). If you take a test but don't buy, or you reach a point where a specific report or product becomes relevant to you (for example, a progress report after several IQ attempts, or a combined report once you've taken both tests), we may send a recommendation — but only if you have opted in to "Purchase reminders" at /account/consent (GDPR Article 6(1)(a), consent). This is off by default.

As soon as you complete a purchase, subscribe, or redeem a gift, we stop the campaign and pause new marketing emails for a cooldown period, so you are not asked to buy something you have already resolved.

Every one of these emails includes a one-click unsubscribe link. Unsubscribing stops all further campaign emails for your address immediately — this works for guests as well as account holders, with no sign-in required. Signed-in users can also manage these emails at any time from /account/consent. We record your unsubscribe so we do not email you again.

Special Category Data (GDPR Article 9)

IQ test results and personality assessment results may be considered health-related data under the GDPR. We process this data on the basis of your explicit consent, which you may withdraw at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Payment Processing

Payments are processed by Stripe. We never store full card details. Stripe may collect additional payment-related information under its own privacy policy.

Cookies

We set a small cookie (iqjb_auth) to grant access after authentication. You can delete it at any time in your browser. See our Cookie Policy for details.

Analytics

We use Mixpanel, a product analytics service, to understand how visitors use our site. We maintain European Union data residency: analytics events are sent to and stored on Mixpanel's EU infrastructure.

Data collected:

• Page views and navigation patterns
• Browser type, device type, and operating system
• Geographic location
• Referrer information
• Custom events (test completion, checkout, etc.)
• A randomly generated device identifier stored in your browser's localStorage

How you are identified: Mixpanel assigns a random device identifier the first time you visit and stores it in your browser's localStorage (not a cookie). Because it persists in localStorage, it can recognize your browser across visits to our site. If you sign in, we associate your activity with your account and build an identified analytics profile that includes profile attributes such as your name, email address, profile data, plan, purchase history, gift-code activity, and your use of our service. Clearing your browser's localStorage resets the device identifier but does not delete a profile already associated with your account. Account deletion can be requested from your account page.

What we do NOT do:

• No cookies are used for analytics (Mixpanel uses a localStorage identifier, not a cookie)
• No cross-site tracking: the device identifier is used only on our site

Profile and event data sent to Mixpanel: For signed-in users, analytics events and the associated profile may include personally identifiable information: your name, email address, profile data, plan, purchase and gift-code activity, your use of our services. We use this data to analyze usage and conversion in detail.

Conversion funnel tracking: We track conversion events (e.g., test completion, add-on purchase, checkout initiation) via Mixpanel to understand how visitors use the Service.

First-party delivery: The Mixpanel library and all analytics events load through our own domain (a first-party /api/mp endpoint) rather than from a third-party network. This keeps requests first-party, improves reliability against ad-blockers, and avoids exposing your activity to additional third-party domains.

Session replay: We use Mixpanel Session Replay to reconstruct on-page interactions (clicks, navigation, and on-screen content) so we can diagnose usability issues. Session replay is recorded for up to 100% of eligible sessions and captures the full on-screen content, including any text displayed on the page. Replay data is buffered in your browser's IndexedDB before being sent to Mixpanel. Session replay respects your analytics opt-out — when you opt out, no replay is recorded. Replays are retained for 30 days and then deleted.

Performance monitoring: We use Vercel Speed Insights to measure anonymous performance metrics (Core Web Vitals, such as page load and responsiveness). It uses no cookies and collects no personally identifiable information.

Purpose: To improve user experience, diagnose usability issues, and optimize conversion.

Data handling: Mixpanel processes analytics data for IQ Career Lab as a processor under a data processing agreement, with EU data residency. See Mixpanel's Privacy Policy and Data Processing Agreement for details.

Analytics retention: Analytics events are retained for up to 2 years. Analytics profiles for signed-in users are retained for the life of the account or subscription. Session replays are retained for 30 days.

Your choices and consent: In regions where prior consent is required for analytics, we show a consent banner and load analytics only after you opt in. In the United States, analytics run by default but you may opt out at any time, and we honor the Global Privacy Control (GPC) signal where present. We also honor the "Do Not Track" (DNT) browser signal. You can opt out at any time using the control below; your choice is stored in your browser's localStorage.

Analytics deletion and export: You can request deletion or export of your analytics data, identified by your analytics distinct identifier, by contacting us (see Data Subject Rights). Note that requesting deletion removes your past analytics data but does not by itself stop future collection. Tto stop future collection, use the opt-out control below.

Data Storage

Data is stored using a managed database service in production. We do not sell personal data. You may request deletion by contacting support@iqcareerlab.com.

Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data
• Restriction: request that we limit how we process your data
• Portability: request your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest

To exercise any of these rights, contact support@iqcareerlab.com. We will respond within 30 days for GDPR requests and 45 days for CCPA requests.

Analytics data: We can delete or export the analytics data held by Mixpanel, identified by your analytics distinct identifier (and, for signed-in users, your account identifier). Deleting your analytics data removes your past analytics records but does not by itself stop future collection — to stop future collection, use the analytics opt-out control in the Analytics section above.

Retention Periods

We retain your personal data for the following periods:

• Account data: retained until you delete your account, plus 30 days for backup removal
• Test results and personality trait scores: retained until account deletion; anonymized data may be kept for scoring norm calibration
• Payment records: 7 years to comply with tax and accounting obligations
• Subscription records: billing history, plan changes, and cancellation records retained for 7 years for tax and accounting compliance
• Terms acceptance logs: 3 years minimum in accordance with California AB 2863
• Gift code purchase and redemption records: 7 years (required for tax compliance, fraud prevention, and chargeback defense)
• AI output logs: retained until account deletion or reprocessing
• Activity log entries: maximum 90 days; automatically purged on a weekly rolling basis
• Retained certificates (optional): if you opt in to keep your verifiable certificates when deleting your account, we retain a minimal, de-identified certificate record (your name, score or personality archetype and OCEAN scores, and issue date) so the public verification URL continues to resolve. Your email address is removed from this record and is not retained. The legal basis is your explicit opt-in consent, which you may withdraw at any time by contacting support@iqcareerlab.com; withdrawal permanently disables the verification URL.
• Analytics data: analytics events retained for up to 2 years; signed-in analytics profiles retained for the life of the account or subscription; session replays retained for 30 days

International Data Transfers

Our analytics project with Mixpanel is configured for European Union data residency, so analytics events are stored on Mixpanel's EU infrastructure. Some of our service providers (for example, payment processing, AI processing, hosting, and email delivery) may process data in the United States. For users in the EU/EEA, those international transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

Third-Party Processors

We share data with the following third-party processors, each of which operates under a data processing agreement:

AI Model Providers

We access AI models through Vercel AI Gateway, which routes each request to a third-party large language model provider on our behalf. We use several providers so that we can select the most suitable model for a given task and fail over to an alternative if one is unavailable. As of the effective date of this policy, the providers we may route to include OpenAI, Anthropic, Google, Mistral, DeepSeek, and xAI. This set may change over time as we adopt, replace, or retire models; the current list is representative rather than exhaustive, and we will keep this section broadly accurate.

Each provider processes the prompt inputs we send and the outputs it returns under its own terms and data processing agreement. We send only the data needed to produce the requested feature, and we transmit your profile data for AI personalization only where you have granted consent (see Legal Basis and manage it at /account/consent). Vercel AI Gateway and its underlying model providers act as our sub-processors for this activity.

California Privacy Rights (CCPA/CPRA)

We do not sell your personal information. California residents have the right to:

• Request the categories of personal information we collect
• Request the specific pieces of personal information we hold
• Request deletion of personal information
• Opt out of the sale of personal information (not applicable as we do not sell data)

To exercise these rights, contact support@iqcareerlab.com.

Children's Privacy

IQ Career Lab is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will promptly delete it.

Local Storage

Preferences such as theme selection, analytics opt-out status, and banner dismissals are stored in your browser's localStorage and remain on your device. Our analytics provider (Mixpanel) also stores a randomly generated device identifier in localStorage to recognize a returning browser; unlike the preferences above, this identifier is sent to Mixpanel through our own domain. Mixpanel Session Replay additionally buffers replay data in your browser's IndexedDB before sending it. Clearing your browser storage resets the analytics device identifier and your opt-out preference. See the Analytics section above for full details.

Updates

This policy will evolve as the product grows. Please check back for updates.