Privacy Policy

1. Data Controller

PsychLens is the data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

PsychLens is operated by an individually licensed business entity registered in the People's Republic of China. For all privacy-related inquiries, contact us at support@yourdomain.com.

2. Information We Collect

2.1 Information you provide directly:

• Test responses: Your answers to assessments are processed locally in your browser. They are stored in your browser's local storage and are not transmitted to our servers unless required for payment verification.
• Email address: Collected only if you voluntarily provide it (e.g., to receive results via email or contact support).

2.2 Information collected automatically:

• Usage data: IP address, browser type, device information, pages visited, and timestamps — collected through server logs and analytics cookies (if you consent).
• Cookie data: See Section 5 below.

2.3 Payment information:

All payments are processed by Lemon Squeezy, our Merchant of Record. We do not collect, store, or process your credit card or banking information. Lemon Squeezy shares with us only the order ID, product name, and customer email necessary to fulfill your order.

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data under the following legal bases:

• Consent (Art. 6(1)(a)): For setting analytics and marketing cookies, and for sending you results via email.
• Contractual necessity (Art. 6(1)(b)): To process your payment and deliver your test results.
• Legitimate interests (Art. 6(1)(f)): For website security, fraud prevention, and improving our services.

4. How We Use Your Information

• To generate and display your test results
• To process payments and verify order status
• To send you your results or respond to support inquiries
• To analyze and improve our assessments and user experience (anonymized data only)
• To prevent fraud and ensure website security

We do not: sell your personal data, use it for targeted advertising without consent, or share it with third parties for their own marketing purposes.

5. Cookies and Similar Technologies

We use the following categories of cookies:

You can manage your cookie preferences at any time by clicking the "Customize" button in the cookie banner or by calling PsychLensCookie.revoke() in your browser console.

6. Data Storage and Retention

• Test responses: Stored in your browser's local storage. They persist until you clear your browser data or use the "Retake Test" function. We do not store responses on our servers.
• Order records: Stored in our database (Upstash Redis) for 7 days after payment for verification purposes, then automatically deleted.
• Email communications: Retained for up to 12 months for customer support purposes.
• Usage logs: Retained for up to 90 days for security and analytics.

7. Third-Party Services

We use the following third-party services that may process your data:

• Lemon Squeezy: Payment processing and Merchant of Record services. Their Privacy Policy
• Vercel: Website hosting and serverless functions. Their Privacy Policy
• Upstash: Redis database for payment verification (order ID and status only, 7-day TTL). Their Privacy Policy

8. International Data Transfers

Your data may be processed in countries other than your own, including the United States (Vercel, Lemon Squeezy) and the European Union (Upstash). We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required by GDPR.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including HTTPS encryption, HMAC signature verification for webhooks, and minimal data collection. However, no method of internet transmission is 100% secure.

10. Your Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights:

• Right of access (Art. 15): Request a copy of your personal data.
• Right to rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data.
• Right to restrict processing (Art. 18): Limit how we process your data.
• Right to data portability (Art. 20): Receive your data in a machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting prior processing.

To exercise these rights, contact support@yourdomain.com. You also have the right to lodge a complaint with your local data protection authority.

11. Your Rights Under CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: What personal information we collect, how we use it, and who we share it with.
• Right to delete: Request deletion of your personal information.
• Right to opt-out: Opt-out of the "sale" or "sharing" of your personal information.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a request, email support@yourdomain.com with "CCPA Request" in the subject line. We will verify your identity before processing your request.

13. Children's Privacy

Our services are intended for users aged 16 and older. We do not knowingly collect personal information from children under 13 (COPPA) or under 16 (where applicable). If you believe a child has provided us with personal data, please contact us immediately so we can delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date. If we make material changes to how we process your data, we will seek your consent where required.