Privacy Policy
How Personality Result handles assessment, account, payment, consent and delivery data.
Data Controller
Personality Result is operated by YU SUN Digital, Lützowstraße 37, 10785 Berlin, Germany. For privacy requests, contact info@personalityresult.de.
German operation and database region
Personality Result is operated by a German controller in Berlin. Primary database storage is configured in the Central EU (Frankfurt) region. This is a storage-region statement, not a promise that every provider, log, payment, email, support or AI processing step happens in Germany.
DPO and privacy contact
Personality Result has not published a formally appointed Data Protection Officer for the current release. The privacy contact is info@personalityresult.de. If a DPO is appointed later, the DPO contact will be listed separately from general support.
China and remote access boundary
The public operating model has no separate China operating entity, support desk or contractor team for production personal data. If remote maintenance access from outside the EEA is needed under the German controller's authority, it must use documented access controls, least privilege and logging, and any qualifying transfer must be assessed under GDPR Chapter V.
Personal data we process
We process technical data such as IP address, device and browser information, locale, security logs and cookie preferences; account data such as email address and login status; assessment answers, generated result summaries, report preview data, secure result recovery data, payment-session metadata, payment status, paid-access status, support messages and consent records.
Purposes
We use this data to operate the assessment, save and restore your result, show the Free Initial Signal, prepare the Quick Snapshot (€9.99) or Professional Report (€39.99), create secure payment sessions, unlock paid access after payment, provide downloads, respond to support requests, maintain security, prevent abuse, keep accounting records and improve product reliability.
Legal Bases
Processing needed to provide the assessment, account, checkout and paid report is based on GDPR Art. 6(1)(b). Consent-based cookies, analytics, marketing and optional communications use Art. 6(1)(a) and applicable TDDDG consent rules. Security, fraud prevention and product reliability use Art. 6(1)(f). Tax, accounting and legal retention use Art. 6(1)(c).
Assessment and result data
Your assessment answers are used to calculate the Free Initial Signal and, if purchased, the Quick Snapshot or Professional Report. Secure result recovery data may be stored on your device so the same result can be restored. Paid access is bound to the saved result and the account or email identity used at payment.
Payments and digital delivery
Payments are processed through Stripe. We receive payment-session, payment, invoice, paid-access and refund-status metadata, but we do not store full card numbers. Stripe may process payment data as an independent controller under its own privacy terms.
Cookies and tracking
Necessary cookies and local storage support login, security, language choice, assessment progress, consent status, payment return and result recovery. Optional analytics and marketing tools are activated only after your consent. You can change or withdraw optional consent in Privacy Settings.
Recipients
Data may be processed by service providers required to run the product, including Vercel for hosting, Supabase for authentication and database services, Stripe for checkout and payments, email or support providers when configured, and professional advisers where required. These providers receive only the data needed for their role.
AI-assisted report and cover letter generation
If you explicitly request AI generation, structured assessment or CV facts may be sent to the configured AI service provider, currently OpenAI, to generate paid report content, CV suggestions, job-description comparison support or a cover letter opening. We do not send payment secrets, secure result recovery data, source CV files, portrait photos or email addresses to the AI service provider for this generation. AI-generated outputs are derived personal data when they can be linked to you. AI-generated report, CV and cover letter content is removed under the retention matrix; purchase and paid-access records may be retained where required.
Browser extension profile import
If you use the optional Chrome profile importer, a temporary LinkedIn-only page guide may appear after you start an import from Profile Kit. The guide checks only the current LinkedIn URL and whether a visible sign-in form is present; it does not read input values, passwords, cookies, authentication tokens or hidden browser storage. After you trigger capture, the extension reads only profile information visibly present on the active LinkedIn or Xing profile page. This may include profile URL, name, headline, about text, experience, education, skills, certifications, languages and visible contact fields. The extension does not crawl in the background and does not write back to LinkedIn or Xing. Captured data is stored temporarily in chrome.storage.session under a one-time nonce for up to 10 minutes and is deleted after Personality Result reads it. The website validates the import again and shows editable fields before any Profile Kit generation.
International Transfers
Some providers may process limited data outside the European Economic Area or through global infrastructure. Where this happens, we rely on appropriate safeguards under GDPR Chapter V, such as EU Standard Contractual Clauses, adequacy decisions, the EU-US Data Privacy Framework where applicable, transfer impact assessment and provider security controls.
Profiling and automated decisions
Personality Result provides self-reflection, drafting and career-planning support. The service does not make hiring, visa, education, lending, salary, insurance or similar decisions, and there is no automated decision with legal or similarly significant effect.
Storage Duration
Assessment drafts and consent preferences are kept only as long as needed for product operation or until you clear them. Account, payment, paid-access, invoice and support records are retained for contractual, security, accounting and legal limitation periods. Data that is no longer needed is deleted, anonymized or minimized.
Your Rights
Depending on your location, you may have rights to access, rectification, deletion, restriction, portability, objection and withdrawal of consent. You may also lodge a complaint with a competent data protection authority. Contact info@personalityresult.de to exercise privacy rights.
Minors
Personality Result is intended for users aged 18 or older. If we identify an under-18 use attempt, marketing, remarketing and advertising-audience tracking are disabled, and we may remove or restrict related data where required.
Security and changes
We use technical and organizational measures such as access controls, token hashing, least-privilege service roles and payment webhook verification. We may update this Privacy Policy when the product, providers or legal requirements change.