Privacy Policy

Data Controller

IQ Career Lab is the data controller responsible for your personal data. Contact us at support@iqcareerlab.com for any privacy-related inquiries.

Categories of Data Collected

We collect and process the following categories of personal data:

• Account data: name, email address (optional for free tests, required for purchases), age, country/region, and optional gender
• Test data: question responses, scores, timing data, and result reports
• Payment data: Stripe customer ID, transaction records, and subscription billing records (plan type, billing cycle, renewal dates, cancellation status). We never store full card numbers.
• AI data: AI-generated score justifications, report narratives, and job enrichment outputs
• Technical data: IP address (hashed for most contexts; unhashed for fraud prevention in purchase and gift code redemption), user agent, device type, and geolocation derived from Vercel headers
• Gift code data: gift code purchase records, purchaser email address, optional recipient email address, redemption records including IP address, user agent, and country (retained for fraud prevention and chargeback defense). When a gift code is sent to a recipient, the purchaser's name or email may be shared with the recipient in the notification email.
• Usage data: page views, test completions, and feature usage via Vercel Analytics (anonymized)

Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

• Contract (Art. 6(1)(b)): account management, test delivery, and payment processing
• Legitimate interest (Art. 6(1)(f)): fraud prevention, service improvement, and analytics
• Consent (Art. 6(1)(a)): AI personalization (managed at /account/consent) and marketing communications
• Legal obligation (Art. 6(1)(c)): tax records and chargeback evidence retention

Gift Recipient Data (GDPR Article 6(1)(f))

When a purchaser provides a recipient's email address during gift code checkout, we process that email address under the lawful basis of legitimate interest (GDPR Article 6(1)(f)). The legitimate interest is the purchaser's desire to deliver a gift to the recipient. We use the recipient's email solely to send a one-time gift code notification email. We do not create an account for the recipient, build a profile, or send further marketing emails unless the recipient independently creates an account and consents to communications. If the gift code is not redeemed within 90 days, we automatically delete the recipient's email address from our records. Gift recipients may contact us at support@iqcareerlab.com at any time to request immediate deletion of their email.

Special Category Data (GDPR Article 9)

IQ test results may be considered health-related data under the GDPR. We process this data on the basis of your explicit consent, which you may withdraw at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Payment Processing

Payments are processed by Stripe. We never store full card details. Stripe may collect additional payment-related information under its own privacy policy.

Cookies

We set a small cookie (iqjb_auth) to grant access after authentication. You can delete it at any time in your browser. See our Cookie Policy for details.

Analytics

We use Vercel Analytics and Vercel Speed Insights to understand how visitors use our site and to monitor performance.

Data collected:

• Page views and navigation patterns
• Browser type, device type, and operating system
• Geographic location (country level only)
• Referrer information
• Custom events (test completion, checkout, etc.)

Data NOT collected:

• No cookies are used for analytics
• No personally identifiable information
• No cross-site tracking
• IP addresses are hashed and not stored

Conversion funnel tracking: We track anonymized conversion events (e.g., test completion, add-on purchase, checkout initiation) via Vercel Analytics to understand how visitors use the Service. No personally identifiable information is included in these analytics events.

Purpose: To improve user experience, website performance, and conversion optimization.

Data handling: Vercel processes analytics data with a privacy-first approach. Data is aggregated and anonymized. See Vercel's Privacy Policy for details.

Data Storage

Data is stored using a managed database service in production. We do not sell personal data. You may request deletion by contacting support@iqcareerlab.com.

Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data
• Restriction: request that we limit how we process your data
• Portability: request your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest

To exercise any of these rights, contact support@iqcareerlab.com. We will respond within 30 days for GDPR requests and 45 days for CCPA requests.

Retention Periods

We retain your personal data for the following periods:

• Account data: retained until you delete your account, plus 30 days for backup removal
• Test results: retained until account deletion; anonymized data may be kept for scoring norm calibration
• Payment records: 7 years to comply with tax and accounting obligations
• Subscription records: billing history, plan changes, and cancellation records retained for 7 years for tax and accounting compliance
• Terms acceptance logs: 3 years minimum in accordance with California AB 2863
• Gift code purchase and redemption records: 7 years (required for tax compliance, fraud prevention, and chargeback defense)
• AI output logs: retained until account deletion or reprocessing
• Analytics data: aggregated and anonymized with no individual-level retention

International Data Transfers

Your data is processed in the United States. For users in the EU/EEA, international transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

Third-Party Processors

We share data with the following third-party processors, each of which operates under a data processing agreement:

California Privacy Rights (CCPA/CPRA)

We do not sell your personal information. California residents have the right to:

• Request the categories of personal information we collect
• Request the specific pieces of personal information we hold
• Request deletion of personal information
• Opt out of the sale of personal information (not applicable as we do not sell data)

To exercise these rights, contact support@iqcareerlab.com.

Children's Privacy

IQ Career Lab is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will promptly delete it.

Local Storage

Non-essential preferences such as theme selection, analytics opt-out status, and banner dismissals are stored in your browser's localStorage. This data remains on your device and is never transmitted to our servers.

Updates

This policy will evolve as the product grows. Please check back for updates.