Privacy Policy

Data Controller

zpsyche ("we," "us," "our") is the Data Fiduciary under India's DPDP Act 2023 and the Data Controller under the EU GDPR for personal data processed through zpsyche.com.

Contact for privacy matters: legal@zpsyche.com

Information We Collect

Information you provide

• Account data: Name, email address, and a hashed (bcrypt) version of your password. We never store passwords in plain text.
• Demographic data: Date of birth and gender (required before your first test), and occupation and country (optional) — collected once, editable any time from your Profile. See Terms & Conditions §09 for how this is used.
• Guardian consent data: Where a user is under 18, we additionally store a self-attested confirmation that a parent or legal guardian consents on their behalf, and a timestamp of when that consent was given. See Terms & Conditions §02.
• Test responses: Your answers to personality assessment questions (stored as option choices A/B).
• Payment information: Transaction ID and billing confirmation provided by our payment processor. We never store card numbers or CVV codes.

Information collected automatically

• Country of origin: Detected silently from your IP address at signup using a third-party geolocation service. Only the country name is stored — never your IP address itself.
• Usage analytics: Page views, session events, and feature interactions via PostHog (privacy-safe, EU-hosted option available). No cross-site tracking.
• Device / browser: Basic technical information (device type, browser) for service optimisation only.

Information we do NOT collect

• Precise GPS location
• Camera, microphone, or biometric data
• Social media profile data
• Third-party browsing behaviour

How We Use Your Information

• To provide the service: Store and display your test results; generate personalised reports.
• Account management: Authenticate you, send verification OTPs, and enable account recovery.
• Payments: Process purchases and maintain transaction records as required by law.
• Communications: Send transactional emails (OTP, receipts, policy updates). We do not send unsolicited marketing emails without your explicit opt-in.
• Product improvement: Analyse anonymised, aggregated usage patterns to improve the platform. Individual test answers are never reviewed by our team.
• Legal compliance: Meet obligations under applicable privacy, tax, and consumer protection laws.
• Localisation: Tailor pricing, language, and compliance notices to your country.

Legal Bases for Processing

For users in the EU, UK, or other GDPR-applicable jurisdictions, we process your data under the following legal bases:

Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We share data only with the sub-processors listed below, each bound by data processing agreements:

We may disclose data to law-enforcement authorities if required by a valid court order or applicable law. We will notify you unless prohibited from doing so.

Cookies & Analytics

We use minimal, privacy-respecting cookies:

• Session cookie: Keeps you logged in during your visit (essential; cannot be disabled).
• Analytics (PostHog): First-party event tracking for product improvement. No cross-site cookie tracking. You can opt out via browser settings or by contacting us.

We do not use third-party advertising cookies or behavioural tracking for ad targeting. We do not participate in any ad network.

Data Retention

• Account data: Retained until you delete your account. Upon deletion, personal data is anonymised within 30 days.
• Test results: Retained for up to 2 years after your last activity, then anonymised.
• Payment records: Retained for 7 years to comply with Indian tax and accounting law (GST requirements).
• Analytics events: Retained for 12 months, then automatically purged.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise any right, email legal@zpsyche.com. We will respond within 30 days (or 72 hours for data-breach notifications).

Children & Minimum Age by Jurisdiction

The table below is kept for transparency about what each jurisdiction’s own law technically permits for self-consent — it does not describe zpsyche’s own policy, which is the global floor and guardian-consent path described above regardless of jurisdiction.

Last reviewed: 26 June 2026. Laws change — always verify with official sources (linked below).

This table is for informational purposes only and does not constitute legal advice. Age thresholds may vary by service type and national implementation. Consult official sources for the latest requirements.

International Data Transfers

Your data may be processed outside your country of residence (e.g., on servers operated by Supabase). Where data is transferred internationally, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (EU SCCs) where applicable — to ensure your data receives an equivalent level of protection.

Security

We implement industry-standard technical and organisational measures to protect your data:

• Passwords hashed using bcrypt with a cost factor of 12.
• Database encryption at rest and in transit (TLS 1.2+).
• Row-level security policies on all database tables.
• API keys and secrets stored as server-side environment variables, never in client code.
• Regular dependency audits.

No method of transmission over the internet is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and relevant authorities within 72 hours of becoming aware.

Changes to This Policy

We may revise this Privacy Policy to reflect changes in law, technology, or our services. When we make material changes, we will update the "Effective" date at the top of this page and notify registered users via email at least 14 days before the changes take effect. Your continued use after that date constitutes acceptance of the revised policy.

Contact & Grievance Redressal

For privacy enquiries, data requests, or to file a grievance under the DPDP Act 2023: