Privacy Policy

Data Controller

IQ Career Lab is the data controller responsible for your personal data. Contact us at support@iqcareerlab.com for any privacy-related inquiries.

Categories of Data Collected

We collect and process the following categories of personal data:

• Account data: name, email address, age, country/region, and optional gender
• Test data: question responses, scores, timing data, and result reports
• Payment data: Stripe customer ID and transaction records (we never store full card numbers)
• AI data: AI-generated score justifications, report narratives, and job enrichment outputs
• Technical data: IP address (hashed), user agent, device type, and geolocation derived from Vercel headers
• Usage data: page views, test completions, and feature usage via Vercel Analytics (anonymized)

Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

• Contract (Art. 6(1)(b)): account management, test delivery, and payment processing
• Legitimate interest (Art. 6(1)(f)): fraud prevention, service improvement, and analytics
• Consent (Art. 6(1)(a)): AI personalization (managed at /account/consent) and marketing communications
• Legal obligation (Art. 6(1)(c)): tax records and chargeback evidence retention

Special Category Data (GDPR Article 9)

IQ test results may be considered health-related data under the GDPR. We process this data on the basis of your explicit consent, which you may withdraw at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Payment Processing

Payments are processed by Stripe. We never store full card details. Stripe may collect additional payment-related information under its own privacy policy.

Cookies

We set a small cookie (iqjb_auth) to grant access after authentication. You can delete it at any time in your browser. See our Cookie Policy for details.

Analytics

We use Vercel Analytics and Vercel Speed Insights to understand how visitors use our site and to monitor performance.

Data collected:

• Page views and navigation patterns
• Browser type, device type, and operating system
• Geographic location (country level only)
• Referrer information
• Custom events (test completion, checkout, etc.)

Data NOT collected:

• No cookies are used for analytics
• No personally identifiable information
• No cross-site tracking
• IP addresses are hashed and not stored

Purpose: To improve user experience and website performance.

Data handling: Vercel processes analytics data with a privacy-first approach. Data is aggregated and anonymized. See Vercel's Privacy Policy for details.

Data Storage

Data is stored using a managed database service in production. We do not sell personal data. You may request deletion by contacting support@iqcareerlab.com.

Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data
• Restriction: request that we limit how we process your data
• Portability: request your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest

To exercise any of these rights, contact support@iqcareerlab.com. We will respond within 30 days for GDPR requests and 45 days for CCPA requests.

Retention Periods

We retain your personal data for the following periods:

• Account data: retained until you delete your account, plus 30 days for backup removal
• Test results: retained until account deletion; anonymized data may be kept for scoring norm calibration
• Payment records: 7 years to comply with tax and accounting obligations
• Terms acceptance logs: 3 years minimum in accordance with California AB 2863
• AI output logs: retained until account deletion or reprocessing
• Analytics data: aggregated and anonymized with no individual-level retention

International Data Transfers

Your data is processed in the United States. For users in the EU/EEA, international transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

Third-Party Processors

We share data with the following third-party processors, each of which operates under a data processing agreement:

California Privacy Rights (CCPA/CPRA)

We do not sell your personal information. California residents have the right to:

• Request the categories of personal information we collect
• Request the specific pieces of personal information we hold
• Request deletion of personal information
• Opt out of the sale of personal information (not applicable as we do not sell data)

To exercise these rights, contact support@iqcareerlab.com.

Children's Privacy

IQ Career Lab is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will promptly delete it.

Local Storage

Non-essential preferences such as theme selection, analytics opt-out status, and banner dismissals are stored in your browser's localStorage. This data remains on your device and is never transmitted to our servers.

Updates

This policy will evolve as the product grows. Please check back for updates.