Privacy Policy

The controller of your personal data is [legal entity name], [registered address]. You can reach us at [support email address], and our data protection contact is [DPO or privacy contact — required only in some jurisdictions].

• Account details — your email address, and optionally your name and time zone. The email address is also how you sign in.
• Assessment data — your answer to each question and how long you took over it. Response time is part of the measurement, not analytics: processing speed is one of the five abilities being scored.
• Training data — the games and exercises you complete, your scores, and your conversations with the AI trainer.
• Billing data — subscription state, payments, refunds and invoices. Card details never reach us; they are entered directly with Stripe, and we store only the identifiers Stripe gives back.
• Technical data — browser and device information, and your IP address. IP addresses are stored hashed with a rotating salt for attribution and abuse prevention; the raw address is held only transiently where it is needed to send an advertising conversion event.
• Attribution data — how you arrived: the referring site, campaign parameters in the link you clicked, and any advertising click identifier it carried.
• Your choices — whether you accepted analytics cookies, and whether you opted in to marketing email.

We use a small number of first-party cookies to run the service. These are not optional, because without them there is no session and no report to return to:

• lrn_vid — a random visitor identifier, so an assessment started before you signed up can be matched to your account afterwards. Set for 180 days, and not readable by scripts.
• lrn_ses — marks a browsing session as already counted, so one visit is not recorded many times. 30 minutes, sliding.
• lrn_sid — your sign-in session, once you have an account.
• lrn_consent — remembers your answer to the cookie banner, so you are not asked again.

Analytics and advertising cookies are optional and off until you accept them. If you accept, the Meta pixel loads and sets its own _fbp and _fbc cookies so we can measure which advertising works. Decline and the pixel is never loaded — the assessment behaves identically either way. You can change your mind by [how a visitor withdraws cookie consent after the banner is gone — to be built or documented].

• To provide the service — scoring your assessment, producing your report, running your training programme, signing you in and supporting you. Basis: performance of our contract with you.
• To take payment and keep the records that go with it. Basis: contract, and our legal obligations for accounting and tax.
• To keep the service working and honest — error monitoring, rate limiting, fraud and abuse prevention, and detecting attempts to game the assessment. Basis: our legitimate interest in a service that works.
• To improve the assessment — re-estimating how difficult and how discriminating each question is, from aggregated and de-identified responses. Basis: legitimate interest.
• To measure our advertising. Basis: your consent, which you give or refuse in the cookie banner and can withdraw.
• To send marketing email, if you asked for it. Basis: your consent. Every such email has an unsubscribe link.

We use a small number of processors, each for one job:

• Stripe — payments and subscriptions. Stripe receives your email address and your payment details, which it collects directly from you.
• Resend — sending email, including your sign-in links and your report.
• OpenAI — the AI trainer. What it receives is deliberately narrow: a fixed set of numbers describing your cognitive profile, plus the messages you write to it. Your name, your email address and your identity are never part of that request, and your baseline estimate is passed as a range rather than a single figure.
• Meta — advertising measurement, only if you accepted analytics cookies. Identifiers sent for matching are hashed before they leave our servers.
• Sentry — error monitoring. Logs are redacted: authorisation headers, cookies, tokens and card data are stripped, and email addresses are hashed.
• Hosting and infrastructure — [hosting and database providers, and the regions they run in].

Publishers and affiliates who send visitors to us never receive your personal data. They are told that a conversion happened and are given a pseudonymous identifier for it. They are never sent your email address, your name, your address, your payment details or your results.

We also disclose data where the law requires it, and to a buyer if the business is ever sold — in which case this policy travels with it.

[Hosting regions and the transfer mechanism for any processing outside your country — to be confirmed once the launch jurisdictions are fixed]. Several of the processors above operate internationally.

• Account, assessment and training data — while your account exists, and [retention period after closure] after it is closed.
• Payments, invoices, refunds and disputes — retained for as long as accounting and tax law requires, which is longer than your account lives. These records are never deleted, but they are separated from your identity (see below).
• Attribution and conversion records — retained as a permanent commercial record of what a publisher earned, under a pseudonymous identifier.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. You can withdraw consent at any time without affecting what we did before you withdrew it.

Deletion works by separation, not erasure of everything. When you ask us to delete your account we remove your personal details and your results, and we replace your identity on financial and conversion records with a pseudonymous identifier, because those records must legally survive. Email [support email address] to start a request; we confirm within 30 days. You can also see and end your active sessions yourself from your profile.

If you think we have handled your data badly, tell us first — and you have the right to complain to [supervisory authority for the launch jurisdiction].

Sign-in uses single-use links rather than passwords, so there is no password of yours for us to leak. Third-party credentials and access tokens are encrypted at rest, IP addresses are stored hashed, and sensitive fields are redacted from logs before they are written.

Lernio is not intended for anyone under [minimum age], and we do not knowingly collect their data. If you believe a child has given us data, tell us and we will remove it.

If we change how we use your data we will update this page and, where the change materially affects you, tell you directly. This draft was written on the date shown at the top and has not yet been reviewed.