Privacy policy

This policy explains what personal information Psquared Inc. ("we") collects through ArchetypeScore, why, who we share it with, and your rights. It is written to meet Canada's PIPEDA, Quebec's Law 25, the EU and UK GDPR, and US state privacy laws.

Who is responsible

Psquared Inc., 1020 rue de Bleury, Montréal QC H2Z 0B9, Canada, is responsible for your personal information. Our person in charge of the protection of personal information is [not set: privacyOfficer], reachable at [email protected].

[Lawyer: GDPR Article 27 and UK GDPR representative: needed if we target EU/UK visitors.]

What we collect

Your test: your answers, the three profile questions (age band, sex, country), your optional goals, and your scores, percentiles and archetype.
Your email, when you ask for your results, and your marketing choice (opt-in only).
Payments: handled by Stripe. We receive your billing country and region, the amounts, and the status of your subscription or purchase; we never see your full card number.
The AI coach: the messages you send and the replies.
Compatibility invites: who invited whom, and the shared results if the invited person agrees to share them.
Contact requests: your email, topic and message.
Consent records: what you agreed to, the exact wording shown, when, your IP address and browser, as the law requires.
Technical data: IP address, browser type and the pages you use, for security and to run the service.
Ad measurement (only with your permission, see below): the ad click identifiers in the link you arrived from (Google "gclid"/"gbraid"/"wbraid", Meta "fbclid"), campaign tags (utm), and a browser identifier we generate.

To provide the service you asked for: scoring, results, reports, the coach, invites and support (contract).
To take payments and keep tax and accounting records (contract; legal obligation).
To send transactional emails such as your results link, receipts, trial reminders, payment and cancellation notices (contract; legal obligation).
Marketing emails, only if you ticked the box (consent). Every marketing email has an unsubscribe link.
Analytics to improve the service (consent where required; otherwise legitimate interest with an easy opt-out).
Ad measurement (consent where required; otherwise you can opt out at any time).
Security and fraud prevention, including Cloudflare Turnstile on forms (legitimate interest).
Personalising the paid report and the coach with AI, using only your scores and goals (contract).

Your answers and results are sensitive. We use them only to provide the service, never for advertising, and we never sell them.

Ad measurement

If you allow ad measurement (it is off by default where the law requires consent, and you can change it any time via Privacy choices in the footer), we tell Meta and Google when someone who arrived from one of their ads asks for results ("Lead") or pays ("Purchase"). We send: a scrambled (SHA-256 hashed) copy of your email, the ad click identifier, our browser identifier, your IP address and browser type, the time, and for purchases the amount and currency. We never send your answers, scores, archetype or coach messages. Meta and Google use this to measure and improve our ad campaigns; we do not ask them to personalise ads for you.

In California and other US states, this may count as "sharing" personal information for advertising. You can opt out with Privacy choices · Do not sell or share my personal information, and we treat a Global Privacy Control signal from your browser as an opt-out. We do not sell personal information.

We use these service providers, each under a contract limiting their use of your data:

Stripe (payments, tax): US/Ireland.
Loops (email delivery): US.
Anthropic (AI for the report's personal section and the coach; receives your scores, goals and coach messages, not your email): US.
PostHog (analytics, only with consent where required): [region].
Sentry (error reports): US.
Cloudflare (hosting network, bot protection): global.
Hetzner (servers and database): EU.
Meta and Google (ad measurement, only as described above): US/Ireland.

We may also disclose information when the law requires it, or to protect our rights, or as part of a sale of our business (with notice to you).

[Lawyer: confirm the processor list, regions and data processing agreements before launch.]

International transfers

Some providers process data outside your country, including in the United States. Where GDPR applies, we rely on the European Commission's adequacy decisions (including the EU-US Data Privacy Framework where the provider is certified) or standard contractual clauses. Quebec residents: we assessed these transfers as required by Law 25.

How long we keep it

Your account, test results, reports and coach messages: until you delete your account.
Billing records (subscriptions, purchases, refunds, disputes): 6 years for tax purposes, kept with a scrambled copy of your email once your account is deleted.
Consent records: kept as proof of consent after your account is deleted (with a scrambled email).
Unfinished anonymous tests: deleted after [to set].
Ad-measurement identifiers: deleted with your account; the click cookie expires after 90 days.

[Lawyer: confirm retention periods.]

Cookies and similar technologies

Essential (always on): `qs` (your test in progress, 30 days), `inv` (an invite link you opened), the sign-in session cookie (`better-auth.session_token`), `NEXT_LOCALE` (language), `cr` (whether your region needs consent, 1 day), and `ck` / `ca` (your analytics and ad-measurement choices, 180 days).
Analytics (with consent where required): PostHog cookies and local storage (`ph_*`).
Ad measurement (with consent where required): `attr` (ad click identifiers and campaign tags, 90 days) and `fbp` (a browser identifier we generate, 90 days). We do not load Meta or Google scripts in your browser.

You can change your choices at any time with Privacy choices in the footer.

Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your information, withdraw consent, object to or restrict some uses, and opt out of "sharing" for advertising. You can do the most common ones yourself on your account page (Download my data, Delete my account). For anything else, use the contact form (topic "Privacy") or email [email protected]. We reply within 30 days and may need to confirm your identity.

You can complain to the Office of the Privacy Commissioner of Canada, Quebec's Commission d'accès à l'information, your EU or UK data protection authority, or your state attorney general.

Automated processing

Your archetype and percentiles are calculated automatically from your answers by fixed, published scoring rules, and the report's short personal section is written by AI from your scores. These have no legal or similarly significant effect on you. You can ask us about how they work.

Security

We use encryption in transit, access controls, and providers with strong security programmes. No system is perfectly secure; if a breach puts you at risk, we will notify you and the authorities as the law requires.

Children

The service is for adults 18 and over. We do not knowingly collect information from anyone younger; the test ends if you say you are under 18.

Changes

We will post changes here with a new date and version, and tell you by email about material changes.