Data controller
The controller for data collected on this site is GHIS (SASU), Allée des Tilleuls, 04200 Aubignosc, France, represented by its president Ghislain Levreau.
For any question about your data: contact@brain-quiz.com.
What we collect
We collect only what the service needs. No data is bought from third parties and no profile is enriched by a data broker.
- Account: your email address and, if you provide them, your first name, last name, age and language.
- Questionnaire answers: your answers, the computed score, the matching profile and the date you took the test.
- Order: billing details. Your card details are entered directly with our payment provider and never pass through our servers.
- Support: the content of the messages you send us.
- Audience measurement: aggregated traffic statistics, only if you consent.
- Technical logs: IP address, timestamp and request type, kept to secure the service and limit automated activity.
- Entertainment tests collect no health data and require no account.
Health data: explicit consent
Answers to self-observation tests (attention, mood, anxiety, work exhaustion, traits associated with neurodevelopmental functioning, attachment style) are data concerning health within the meaning of article 4(15) GDPR. They belong to the special categories of data covered by article 9.
We process them only on the basis of your explicit consent, under article 9(2)(a) GDPR.
That consent is collected before you start a self-observation test, through a dedicated checkbox, separate from accepting the terms of use, never pre-ticked and written in plain language. Declining does not prevent you from using the rest of the site.
- Why: to compute and show your profile, to let you find it again in your account area, to compare your attempts over time if you retake a test, and to produce the detailed report if you order one.
- What we never do: we do not sell them, rent them, or pass them to any advertiser, insurer or employer, and we never use them for advertising.
- Who can access them: within GHIS, only its president Ghislain Levreau, and only when necessary (support at your request, technical incident, legal obligation). The technical processors listed below have access limited to their own service.
- For how long: see the retention section. You can delete your attempts at any time from your account area.
- Withdrawal: you can withdraw your consent at any time, without justification. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Purposes and legal bases
- Taking a self-observation test and showing a result: your explicit consent (article 9(2)(a) GDPR).
- Taking an entertainment test: performance of the service you asked for (article 6(1)(b)).
- Creating and managing your account, sending you a sign-in link: performance of the contract (article 6(1)(b)).
- Selling and delivering a detailed report, issuing the invoice: performance of the contract and legal accounting obligations (articles 6(1)(b) and 6(1)(c)).
- Sending you a retake reminder you scheduled: your consent, revocable in one click from the email or your account area.
- Securing the service and preventing fraud and automated activity: our legitimate interest in protecting the service and its users (article 6(1)(f)).
- Measuring site traffic: your consent, for as long as a tool using a tracker is in place.
- None of these purposes involves advertising prospecting.
Detailed report and automated processing
The paid detailed report is written by a language model from your answers and scores. The text puts your profile into words, within safety instructions, and is not a medical assessment.
The data sent to the inference provider is limited to the test identifier, the axis scores, the total score, the profile title, the number of answers and the language. Your name, your email address and your payment data are never sent.
No decision producing legal effects concerning you or similarly significantly affecting you is taken on that basis, within the meaning of article 22 GDPR.
Trackers and audience measurement
No audience measurement tracker is activated before you choose. Until you accept, only what is strictly necessary for the site to work is stored.
- Session cookie: keeps you signed in to your account area. 30 days. Strictly necessary, therefore exempt from consent.
- Language cookie: remembers the language you picked. 30 days. Strictly necessary.
- Record of your tracker choice: kept for 6 months in your browser so we do not ask again on every visit.
- Audience measurement: loaded only if you accept it. It counts visits and helps spot pages that cause problems.
- No advertising cookie is used. No ad network operates on self-observation tests.
Recipients and processors
Your data is never sold, rented or traded. Technical providers take part in running the service, each under a processing agreement within the meaning of article 28 GDPR and only for the service concerned.
- OVHcloud (France, Gravelines): hosting of the site, the domain name and the database holding accounts and attempts.
- Stripe: card payment processing and receipts.
- Resend: delivery of sign-in, reminder and order emails.
- Cloudflare (Turnstile): anti-bot verification of forms, with no cookie and no advertising tracking.
- xAI: generation of the detailed report text, from the data listed above only.
- Audience measurement tool: only if you consented to it.
Transfers outside the European Union
The site and the database are hosted in France, in the OVHcloud data centre in Gravelines. Your test answers, your account and your reports are stored there and nowhere else: none of that data is kept outside the European Union.
Some processors are established in the United States, notably Stripe, Resend and xAI. Those transfers rely on the appropriate safeguards set out in chapter V GDPR, in particular the European Commission standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
Only one of those transfers involves your test answers: writing the detailed report you purchased. The provider concerned receives the test identifier, your scores, the profile title, the number of answers and the language, never your name, your email address or your payment data.
We keep what is transferred limited to what each service needs. You can write to us for details about those safeguards.
Retention periods
- Account and linked attempts: for the life of the account, then 12 months after the last sign-in, unless you delete them earlier.
- Attempts taken without an account: 12 months.
- Purchased detailed reports: for the life of the account, so that you can read them again.
- Accounting records and invoices: 10 years, legal obligation (article L.123-22 of the French Commercial Code).
- Sign-in tokens: until they expire, a few days at most.
- Technical and security logs: 12 months.
- Traffic statistics: 13 months at most.
- After those periods, data is deleted or irreversibly anonymised.
Data security
Exchanges with the site are encrypted (HTTPS). The database is not published on the internet: it can only be reached from the site's own server, over a private network, and no interface allows it to be queried from a browser. Passwords, where they exist, are stored as hashes and never in clear text.
Access to data is restricted to the people who need it, sign-in tokens are single use and expire, and sensitive routes are rate limited.
No system is infallible, so we commit to notifying the French data protection authority and, where the risk requires it, the people concerned, under articles 33 and 34 GDPR.
Minimum age
Self-observation tests are reserved for people aged 16 or over. Entertainment tests are open from age 13 and collect no health data.
If you notice that a younger person has used the service, write to us: the account and the related data will be deleted without delay.
Your rights
You have the right to access, rectify, erase, restrict, object and port your data, the right to withdraw your consent at any time, and the right to set instructions on what happens to your data after your death.
Two of those rights are exercised straight away from your account area, without writing to us: downloading a copy of your data, and deleting your account together with all your attempts.
For any other request, write to contact@brain-quiz.com. We answer within one month, extended to three months for complex requests, in which case we tell you within the first month.
We may ask for proof of identity where there is reasonable doubt about who is asking. This exists for one reason only: never to hand health data to the wrong person.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr).
Changes to this policy
Any change is published on this page with a new update date.
For a substantial change, in particular a new purpose or a new processor involving health data, we inform you by email and collect your consent again.