Privacy Policy

• Most of your diagnostic data — your responses, your profile name and email, your results — is stored in your browser’s local storage on your own device. We do not have a copy on our servers.
• When you make a purchase, we use Stripe or PayPal to process payment. We do not store your card number.
• When you request your report by email, your name and email address are transmitted to Resend so the email can be delivered.
• We use analytics and advertising pixels (only those we have configured) to understand how the site is used and to measure ad performance.
• You have rights of access, deletion, correction, portability, and opt-out described below.

• To operate the Service and generate your diagnostic profile;
• To process purchases, deliver receipts, and grant unlocked content;
• To deliver requested emails (such as your PDF report);
• To measure traffic, debug, secure the Service, and prevent fraud;
• To measure the performance of marketing campaigns;
• To comply with legal obligations and enforce our Terms;
• With your consent, for any other purpose disclosed at the point of collection.

Legal bases (for individuals in the EEA / UK): performance of a contract, our legitimate interests in operating and improving the Service, consent (for non-essential cookies and marketing), and compliance with legal obligations.

We share information with the following categories of service providers, and only as needed to operate the Service:

• Payment processors. Stripe, Inc. and PayPal, Inc. See stripe.com/privacy and paypal.com/privacy.
• Email delivery. Resend (resend.com) processes the content of emails we send on your request.
• Hosting and infrastructure. Our hosting provider stores logs and serves the site. (Default: Vercel Inc. Swap if you self-host.)
• Analytics. Where configured: Google Analytics 4.
• Advertising. Where configured: Google Ads, Meta (Facebook / Instagram), LinkedIn, TikTok, and X / Twitter pixels. These set cookies and may receive event data such as page views and purchases to measure ad performance.
• Legal and safety. We may disclose information to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, property, or safety of any person.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information for money. Some advertising-pixel disclosures may be considered a “sale” or “sharing” under California law; see the California section below for your opt-out right.

We and our service providers may process information in the United States and other countries. Where we transfer personal data of EEA or UK residents outside those regions, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms.

Diagnostic responses, profile information, and unlock status are kept in your browser’s local storage for as long as you keep them there. You can delete them at any time using the “Reset everything” control on the Dashboard, or by clearing site data in your browser.

Payment and transaction records are retained by us and our processors for as long as required for tax, accounting, audit, and fraud prevention (typically up to seven years).

Analytics and advertising data are retained per the configuration set with each provider (typically 14 months to 26 months).

We use TLS in transit, principle-of-least-privilege access controls, and vendor selection criteria designed to protect your information. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

Some browsers offer Do Not Track or Global Privacy Control signals. We treat a valid GPC signal as a request to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising on the browser that sent the signal.

We may update this Policy. The “Last updated” date above will reflect the latest revision. We will provide additional notice for material changes where required by law.

For privacy questions, requests, or complaints, contact us at privacy@workfitiq.com or by mail at WorkFit IQ, [[Your registered business mailing address]].