Privacy policy
We collect as little as we can, we never sell your data, and we use no advertising trackers. You can export or delete everything at any time from your privacy centre.
What we collect, and why
| Data | Why | Lawful basis (GDPR and UK GDPR) |
|---|---|---|
| Email and first name | Sign-in, and so your invites can say who they are from | Contract |
| Test answers and scores | To produce your results | Contract |
| Ratings of you | To show Second Sight averages | Contract |
| A rater's answers and a hashed device identifier | To calculate averages and prevent duplicates. The identifier is deleted after 90 days | Legitimate interests |
| Optional photo | Your profile | Consent |
| Purchases | Payment, receipts, refunds and tax records | Contract and legal obligation |
| First-party events | To understand and improve the product | Legitimate interests |
| Marketing opt-in | Occasional news, only if you tick the box | Consent |
Who processes data for us
These providers process data outside Australia, including in the United States:
- Cloudflare: hosting, database, storage and cookieless web analytics.
- Stripe: payments. We never see your card number.
- Postmark: transactional email.
If the optional Compass or Rehearsal features are switched on and you use them, your messages and the relevant results go to Anthropic to generate replies.
How long we keep it
- Your account data: until you delete it.
- Event logs: 13 months, then aggregated and deleted.
- Email logs: a hashed recipient only.
- Rater device identifiers: 90 days.
- Financial records: as tax law requires, with your name and email removed once you delete your account.
Cookies
We use strictly necessary cookies only: your session, an anonymous ID, and a rater duplicate check. Experiment assignment follows the anonymous ID. Cloudflare Web Analytics does not use cookies. We store your light or dark theme choice in your browser.
Your rights
You can access, correct, export and delete your data, and withdraw consent, under the Australian Privacy Act 1988 and, where they apply, the GDPR and UK GDPR. Most of this is one click in your privacy centre. Exports show ratings you received as averages, which protects other people's anonymity. You can also complain to the Office of the Australian Information Commissioner or your local regulator.
Under 18s
Selfcarta is for adults. We do not knowingly collect data from minors, and we delete it if we discover it.
If there is a breach
We contain and assess it, notify affected people and regulators where the law requires (including under Australia's Notifiable Data Breaches scheme, and within 72 hours under the GDPR where it applies), and fix the cause.
Contact
Write to hello@selfcarta.com, or use the report form. See also our terms and safety page.