Privacy, with clarity.

Who is responsible for your information?

The data controller for About Me Lab is:

Use this email for privacy questions, access requests, corrections, consent withdrawal, or help deleting an account. Please do not send your password or identity documents unless we specifically explain why further identity verification is necessary.

What we use, and why

Your account and reflections

We use your email, a securely hashed password, account identifiers, language preference, and account dates to create and protect your profile. We record the privacy notice version shown when you register. Older accounts may retain a previously supplied age confirmation. We do not ask for your date of birth.

When you complete a test, we store your selected answers, scores, generated interpretations, test and scoring versions, and completion date. Where applicable, we also record your introductory test, purchased access, unused tests and unlock history. We also keep the purchase terms supplied to you, upgrade contribution records and refund review decisions to fulfil purchases and administer consumer rights. Providing account details and answers is necessary to save and retrieve your reflections; you can browse the public site without an account.

The legal basis for providing the account, calculating ordinary personality reflections and administering requested access is performance of our agreement with you, including steps you request beforehand (GDPR Article 6(1)(b)).

Optional profile introduction

Before your first test, you may choose Male or Female and an adult age group (18–24, 25–34, 35–44, 45–54, 55–64 or 65+). These optional details are kept in this browser tab until you finish, then stored with your account to display in your profile settings. We do not collect your birth date, use these details to change your scores or readings, or send them to Meta. The basis for this optional storage is your consent (Article 6(1)(a)). You can skip the introduction, edit the details or withdraw consent using Profile → Account settings → About you → Remove these details. They are included in your data export and removed when you delete your profile; backup copies follow the retention rules below.

Reflections that may reveal sensitive information

Some tests explore emotional wellbeing, stress, or related personal experiences. Answers and inferences may reveal information about mental health. Before those tests, we ask for separate, explicit consent to process that information and save the reflection (Articles 6(1)(a) and 9(2)(a)). You can decline and use other parts of the service.

You can withdraw this consent in Profile → Account settings → Manage sensitive readings by removing a reading, or by emailing us. Removing a reading erases its saved answers and scores while preserving your account and purchased test access. Withdrawal does not affect processing that was lawful before withdrawal.

Support, security and legal obligations

If you contact us, we receive the details and message you choose to send. Our contact form opens your email application; it does not submit a separate copy to our website database. We use correspondence to answer your enquiry or administer your account, based on the requested service or our legitimate interest in responding to enquiries.

Our host receives connection information such as IP address, requested URL, time and browser information in server logs. The application uses short-lived, keyed hashes to limit abusive requests. Protecting the service and investigating security incidents are legitimate interests under Article 6(1)(f). Necessary accounting or legally required disclosure uses Article 6(1)(c).

How your readings are produced

Our scoring rules turn your chosen answers into trait scores, patterns and written reflections. This is profiling under the GDPR: using personal information to evaluate aspects of your personality and behaviour. Scores describe the model and your responses; they are not diagnoses or population percentiles. Readings are generated by defined scoring rules and written content, rather than by sending your answers to a third-party AI service.

We do not use these profiles to make decisions with legal or similarly significant effects, such as decisions about employment, insurance or credit. We do not provide your answers or readings to employers or advertisers. You can ask us to explain or correct information and can retake a test if your answers change.

Who receives information?

Access is limited to people authorised to operate and support About Me Lab and providers needed to run the service. NEOSERV (Avant.Si d.o.o.) provides our hosting and associated infrastructure. Providers may process information under our instructions and applicable data-processing arrangements; authorities may receive information when lawfully required.

Google sign-in is optional and is available only when enabled on the site. When a Google sign-in button is displayed, your browser loads Google's sign-in service and sends connection information, including our site origin, to Google. Signing in with Google remains your choice. We receive a verified Google account identifier, email address, name if supplied, and verification information. We do not receive your Google password, email messages or contacts. Google also processes information under its privacy policy. Email-and-password accounts remain available.

Payments use Polar as merchant of record. When you choose an offer, we send its product, price and opaque account/checkout references to Polar. In the embedded or hosted checkout, you provide billing and payment details directly to Polar and its payment processors; we do not receive your full card number. We receive payment/refund status, transaction references and amounts to provide your purchased access and maintain required records. We do not send test answers, scores, readings, gender or age group to Polar. Payment processing supports your purchase contract and applicable financial-record obligations. Polar explains its processing, retention and international transfers in its privacy policy; purchases are subject to the buyer terms shown at checkout. Optional Meta measurement and Microsoft Clarity are described below. We do not currently run marketing email campaigns. Links to Instagram and TikTok take you to those services only if you choose to follow them. Our fonts are hosted with the site.

We use Brevo to deliver account-verification, password-reset and purchase-confirmation emails. Brevo processes your recipient email address, the message (including a one-time link for verification or password reset), and delivery information such as message identifiers, delivery times and bounce status. This processing supports the account service you request and our legitimate interest in account security (Articles 6(1)(b) and 6(1)(f)). We do not send test answers, scores, readings or optional demographic details to Brevo, or add you to a marketing mailing list through this integration. Brevo explains its processing in its privacy policy.

Where an optional provider processes data outside the European Economic Area, we must establish an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses, before using it. You can request information about the safeguards relevant to an active service at our contact address.

Purchase confirmations sent through Brevo contain your order reference, purchased access and the applicable terms and refund policy, without test answers, scores or readings. We keep a downloadable copy while your account is open. Account deletion removes these account-linked copies and refund review records; the limited financial retention described below remains.

Your cookie choices, Meta and Microsoft Clarity

Accept allows optional Meta (Facebook) measurement of public-page visits, opening purchase offers, starting checkout and confirmed purchases to measure campaign performance, and Microsoft Clarity heatmaps and session recordings of our public landing page to improve usability. Reject keeps only necessary storage. Both options are available before either tracking script loads. You can reopen Cookie settings in the footer to change or withdraw your choice. Rejecting does not limit access to your tests or account.

When you accept, Meta Platforms Ireland Limited receives a PageView event, the public page address and campaign parameters, connection information such as IP address and browser details, and any available Meta cookie or click identifiers. Meta may associate this with a Facebook or Instagram account and use it for campaign measurement and personalised advertising under its privacy policy. Our basis for loading the optional Pixel is your consent (Article 6(1)(a)).

The browser Pixel stays off questionnaires, sign-in, profiles, personal results and contact forms. With your consent, our server sends ViewContent when you open purchase offers, AddToCart when you select an offer and its checkout is created or resumed, InitiateCheckout when checkout loads, and Purchase only after Polar verifies payment. These server events contain the time, a unique event reference, a generic page path and purchase step without private query parameters, and the amount/currency where applicable. For matching, we send your email after SHA-256 hashing, a keyed hash of your account identifier, and available _fbp/_fbc identifiers. Hashed information is still personal data; Meta may match it to an account. We never send test names, answers, trait scores, readings, gender or age group. Both integrations use Pixel ID 1867816897535678. Purchase-step events are server-only, so they do not duplicate browser events. Consent under Article 6(1)(a) is the basis for this optional measurement.

With fresh permission for test measurement, we send the generic TestStarted event after your first valid answer and TestCompleted after all answers are validated in your browser, before registration or payment. These events use a pseudonymous identifier derived from your consent receipt, available Meta cookie identifiers and a generic campaign label. They contain no test name, answers, scores, results or demographic details. An attempt identifier prevents duplicates. We keep event records for up to 30 days; withdrawal stops pending events. If you later sign in using the same consent receipt, we link these records to your account so account deletion also removes them. Declining consent does not prevent taking tests.

With fresh consent to enhanced matching, Meta events also include your IP address and browser information captured when you act. Registration events include hashed email and account identifiers; purchase events include generic offer codes and, when available, hashed billing country from Polar. Test events remain without email. We create or preserve _fbp and, only for a genuine Facebook click, _fbc. These optional cookies and a signed, HTTP-only backup cookie, aml_meta_browser, last up to 90 days and are bound to your consent. Withdrawal clears them. Checkout matching data is retained for up to seven days and never replaced with the worker's IP or browser.

The necessary aml_cookie_choice cookie remembers your choice and notice version for up to 180 days. It contains a signed choice and expiry time, without an account or advertising identifier. A separate secure, HTTP-only aml_marketing_consent cookie is an opaque receipt of your permission, lasting up to 180 days. We store its hash, notice version, grant/expiry/withdrawal times and account link when applicable. An expired, withdrawn or invalid choice does not enable tracking. An expanded purpose requires a fresh choice; we do not reuse older Meta-only permission to activate Clarity. Optional Meta cookies may include _fbp and _fbc; Meta determines their lifetimes as described in its cookie policy. On withdrawal we remove those cookies set for our site and stop future Pixel loading and discard queued server events and checkout attribution for that consent, including when you withdraw while signed out. A signed-in withdrawal also revokes pending measurement for your account from other browsers. We cannot directly remove cookies held on Meta's domains or erase events already received by Meta; its privacy controls explain those choices.

With your permission, a signed, HTTP-only aml_source_page cookie remembers the non-personal Facebook page or campaign-concept code in a src_page link for up to 30 days. A new labelled visit replaces the previous source; an ordinary visit does not. We attach the source to checkout attribution and include it in consented server events to measure campaign performance. It is not a test answer or result. Withdrawal removes the cookie and associated checkout attribution; attribution stored for checkout follows the seven-day retention below and is included in your account data export. Shared or copied links identify the labelled link, not a verified Facebook referrer.

Microsoft Clarity (project yj637iokit). After your acceptance, we use Clarity to understand clicks, scrolling and navigation on our public landing page through heatmaps and session recordings. Microsoft receives the permitted page URL and campaign parameters, interaction and rendering data, browser/device information and network connection data, and pseudonymous cookie identifiers. The legal basis is consent under Article 6(1)(a). We mask page text and exclude questionnaires, login, profiles, personal results, checkout and contact forms. We do not send Clarity your account ID, email, answers or readings, or use its identify API.

Clarity's first-party cookies _clck and _clsk distinguish returning browsers and group page views into sessions. We grant Clarity analytics storage only; its advertising storage signal stays denied. Reject prevents the Clarity script from loading, including its cookieless mode. Withdrawal removes Clarity cookies set for our site and unloads the tracker. Previous recordings are not automatically erased by withdrawing consent or deleting your About Me Lab profile; contact us for assistance with a data-rights request. Microsoft documents access to recordings for up to 30 days and manages its own retention. See its Clarity privacy FAQ and Microsoft Privacy Statement for processing, retention and rights. Microsoft Ireland Operations Limited provides the service to EU customers; data may be processed outside the EEA under the transfer arrangements described by Microsoft, including Standard Contractual Clauses.

For Pixel collection and transmission, the allocation of responsibilities is described in Meta's Controller Addendum. Meta may process information outside the EEA; its privacy policy explains the applicable transfer mechanisms, including adequacy decisions or contractual safeguards where applicable. You can contact us or Meta about the processing and your rights.

Storage, cookies and retention

Language selection: we use your IP address for a country-only lookup against a database on our server. We do not send your IP to a geolocation service or save an additional IP record for language selection. A language in the URL takes priority; otherwise we use your saved choice, country, supported browser language, then English. The essential aml_language cookie remembers your language for up to one year. You can change it in the language menu.

• Profile and saved readings: retained while your account is open so you can revisit your history, unless you delete a sensitive reading or your profile. We do not automatically delete purchased access simply because you have been inactive.
• Essential session cookie: aml_session keeps your session secure, normally for one day before login and up to 14 days after login. Signing out ends the current session; deleting your profile ends all account sessions.
• In-progress answers: stored in this browser tab's session storage, under keys beginning aml-, to support resuming the test. Successful saving removes that draft. You can also clear the site's browser data. A browser's session-restore feature may preserve tabs and their storage.
• Verification and reset links: valid for 24 hours and one hour respectively. Expired links and sessions are removed by routine maintenance. Application rate-limit records expire after 15 minutes and are removed by maintenance.
• Optional purchase measurement: checkout attribution is removed within 7 days. Unsent events expire after 6 days; identifying payloads are removed after delivery or final failure, and delivery records after 30 days. Consent receipts are removed within 90 days after expiry or withdrawal. Restricted withdrawal instructions survive backups so a restore cannot resume withdrawn tracking. Account deletion removes linked attribution and queued events; events already delivered to Meta are subject to its policies and privacy controls.
• Our own site and database backups: kept for a maximum of 90 days, then removed. Backups are restricted recovery copies and are not used to reopen deleted accounts.
• Hosting logs and provider backups: NEOSERV's published terms describe server-log rotation generally after 30–60 days, depending on the service and configuration. Provider-managed backups follow the hosting plan's rotation schedule. We are confirming the exact backup retention for this plan; the 90-day limit above describes our own copies, not a verified NEOSERV guarantee. Contact us for the latest information.
• Support correspondence: normally removed within 12 months after the enquiry is resolved. Necessary material connected to an ongoing dispute or legal duty may be restricted and retained until that matter and its applicable retention period end.
• Required financial records: where real transactions exist, we separate the minimum transaction reference, amount, currency, payment/refund status and dates from the deleted profile. Accounting records subject to Slovenian invoice-retention rules are generally kept for 10 years after the relevant year ends. This does not justify keeping your test answers or password.

Necessary storage supports the service you request; optional Meta and Clarity storage is gated by the choice described above. Blocking essential storage can prevent sign-in and draft recovery. No event is queued for later transmission while consent is absent or rejected.

Deleting your profile

Open Profile, expand Account settings, and choose Delete my profile. We ask you to confirm the action and verify your password, or the Google identity linked to a Google-only account. If you cannot access your account, email us for help; we may request proportionate information to verify ownership.

Deletion removes your account details, login credentials, saved answers and readings, unused tests, and test access from the active application. All account sessions are revoked. Deleting an account does not automatically request a refund and does not remove your statutory consumer rights.

Recovery copies may still contain deleted information until they expire. We keep a restricted erasure record containing an account identifier, a keyed fingerprint and an erasure date, without your email or answers, so deletion can be reapplied before a backup is brought back into service. We retain that instruction while a restorable copy may still contain the information. A financial or legal retention exception is limited to the information required for that purpose.

Your choices and rights

Subject to the conditions in the GDPR, you can request access and a copy, correction, deletion, restriction of processing, and portability of information you provided where the processing is automated and based on consent or contract. You can object to processing based on legitimate interests and withdraw consent at any time. The Download my data control in account settings provides a JSON copy of your stored profile, answers, scores and access history.

Contact info@aboutme-lab.eu to exercise these rights or ask for a different accessible format. We normally respond within one month. If a complex request requires up to two further months, we will explain the extension within the first month. Requests are generally free; any lawful exception will be explained.

You can complain to the Slovenian supervisory authority, Informacijski pooblaščenec (gp.ip@ip-rs.si), or the competent authority where you live or work in the EU. You do not need to contact us first.

Adults only, and future changes

About Me Lab is intended for people aged 18 and over. We do not offer a parental-consent route. If you believe a child has created an account, contact us so we can investigate and remove their information where appropriate.

We will update the date above when this policy changes and provide a prominent notice or direct notification for material changes. A policy update will not silently expand consent to new purposes.