Privacy Policy

This Privacy Policy describes how Persona ("we," "us," "our") collects, uses, shares, and protects your personal information when you use startpersona.com and associated services (the "Service").

1. Who we are

Persona operates the Service. Our registered contact for privacy inquiries is privacy@startpersona.com. If you are an EU/UK resident, you may also contact our designated representative at the same address with the subject line "EU Representative" or "UK Representative" as applicable.

2. What we collect

What we don't collect

We don't ask for — and don't want — government IDs, social-security numbers, driver's-license numbers, full card numbers, medical records, biometric identifiers, precise GPS location, or content from third-party services you haven't explicitly connected.

3. How we use it

• Run the Service: score your quiz, generate your reading, power AI coach chat and habit suggestions, show your mood patterns, maintain connections.
• Account management: create and maintain your login, send transactional emails (receipts, password resets, important security notices).
• Billing: charge your subscription, handle refunds, prevent fraud and chargeback abuse (including via card-funding checks — see our Terms).
• Improve the product: analyse aggregate usage patterns (e.g. drop-off points in the funnel, which features correlate with retention).
• Communicate with you: respond to support requests, notify of material changes, send relevant marketing if you've opted in (you can unsubscribe at any time).
• Legal obligations: comply with tax, accounting, anti-fraud, or other law-enforcement requirements.
• Security: detect and prevent abuse, fraud, unauthorised access, bugs, or attacks.

We do not use your quiz answers or personal data to train third-party AI models. The data you submit to AI features (chat, reading) is sent to Anthropic's API for processing; by their API terms Anthropic does not use API-submitted data to train their models.

4. Legal bases (EEA / UK / Switzerland)

If you're in the EEA, UK, or Switzerland, we process your data on one or more of these legal bases under the GDPR / UK GDPR:

• Contract: to deliver what you paid for (quiz scoring, reading, AI features, subscription management).
• Legitimate interests: to keep the Service secure, improve features, prevent fraud, and conduct aggregate analytics — balanced against your privacy interests.
• Consent: where required (e.g. non-essential cookies, marketing communications). You can withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation: to comply with tax, accounting, and regulatory record-keeping.

5. Who we share it with

We use a short list of named processors. Each is contractually bound to act only on our instructions and keep your data secure:

We do not sell personal information to third parties. We do not share your individual quiz answers, chat history, or psychological scores with advertisers. Aggregated, anonymised patterns may appear in public posts or research, but never in a way that identifies you.

We may disclose information if we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation or valid law-enforcement request, (b) protect our rights or property, (c) protect users' safety, or (d) detect and address fraud or security issues.

6. International transfers

Our infrastructure is based in the United States. If you are in the EEA, UK, or Switzerland, your data is transferred to the US and potentially to our processors' regions. We rely on:

• The EU-US and UK-US Data Privacy Frameworks where a processor is certified (Stripe, Meta).
• Standard Contractual Clauses (SCCs) with all other processors not covered by the DPF.
• Supplementary technical measures including encryption in transit (TLS 1.3) and at rest where supported by the processor.

7. How long we keep it

8. Security

We apply industry-standard safeguards including:

• TLS 1.3 encryption in transit for all site traffic.
• Database encryption at rest on our cloud provider.
• Passwords stored as bcrypt hashes (never in plaintext).
• API keys and secrets stored in encrypted environment variables, never committed to source control.
• Access controls, least-privilege database roles, and audit logging for admin actions.
• Per-user monthly caps on AI spending to limit abuse blast radius.
• Automatic blocking of prepaid cards to reduce chargeback and fraud risk.

No system is perfectly secure. If you spot a vulnerability, please email security@startpersona.com and we'll acknowledge within 48 hours.

9. Your rights

Regardless of where you live, you have the following rights over your data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct data that's inaccurate or incomplete.
• Erasure: request deletion of your account and associated data (subject to retention obligations above for billing/tax).
• Portability: receive your data in a structured, machine-readable format (JSON).
• Restriction: ask us to limit how we use your data in specific circumstances.
• Objection: object to processing based on legitimate interests, including direct marketing.
• Withdraw consent: where processing is based on consent, you can withdraw at any time.
• Lodge a complaint: with your local data-protection authority if you believe we've mishandled your data.

To exercise any of these rights, email privacy@startpersona.com. We respond within 30 days.

10. California privacy (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know what personal information we collect, use, disclose, and sell (we don't sell, but this is your right to ask).
• Right to delete your personal information (with limited exceptions).
• Right to correct inaccurate information.
• Right to opt out of sale or sharing of personal information (N/A — we don't).
• Right to limit use of sensitive personal information (N/A — we don't collect sensitive information beyond what's needed for our service).
• Right to non-discrimination for exercising any of these rights.

To exercise any CCPA/CPRA right: privacy@startpersona.com with subject line "California Privacy Request." We verify identity via the account email before responding.

11. Children

Persona is for adults. We do not knowingly collect data from anyone under 18. If a minor has created an account or provided information, a parent or guardian can contact privacy@startpersona.com and we will delete it promptly.

12. Cookies

We use strictly-necessary cookies to run the app, plus optional analytics cookies from Microsoft Clarity and the Meta Pixel. You can block these at the browser level without breaking core functionality. See the Cookie Policy for the full list, purposes, and how to opt out.

13. Data-breach notifications

If we suffer a personal-data breach that creates a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours.
• Notify affected users without undue delay by email, with a summary of what happened, what data was involved, what we've done, and what steps you can take.
• Post a public incident report on our status page.

14. Changes to this policy

We may update this policy over time. Material changes are announced via an updated "Last updated" date and, where required, a direct email notification. Your continued use of the Service after changes take effect constitutes acceptance.

15. Contact & Data Protection Officer

• Privacy inquiries: privacy@startpersona.com
• Data Protection Officer (informal role): same email, subject line "DPO request"
• EU / UK / Swiss representative: same email with subject line "EU Representative" / "UK Representative"
• General support: support@startpersona.com