Privacy policy.

The short version

We collect what we need to give you a what-world-way test and a personal portrait. For Glimpse (Fast) we keep only your What, World and Way result (and close matches) — not your item answers. For Insight, Deeper, extras, and paid reports we keep the answers needed to produce those results. If you sign up or buy unlocked content we keep an email address. Payments are handled by Stripe; we don’t see your card details. For traffic measurement we use first-party, cookieless analytics on our own servers that count visits in aggregate and never identify you. We don’t use Google Analytics or Plausible, we don’t set tracking cookies, and we don’t share your data with advertisers. If you just browse without starting a test, the only trace is an anonymous pageview in those aggregate counts — nothing that says it was you. Your data is encrypted in transit and at rest. You can delete your account at any time and we’ll erase it.

data controller

Potentialisation Ltd, registered in England & Wales. See Company details .

data-protection contact

privacy@potentialisation.com

What we collect

Test answers and results

Glimpse (Fast): we score your answers, then keep only your What, World and Way result and close matches. We do not keep the item answers. Insight, Deeper, extras, and paid reports: we keep your responses, the scores derived from them, and the resulting assignments. Those are the core of the deeper service.

Account information

If you create an account: your email address, a hashed password (we never store the plain text), and the date you joined. Optional: a display name. We don’t require any other personal information.

Guest data

If you take the test without signing up, an anonymous “guest” account is created for you on our servers when you start your first test, identified only by an internal ID — no email, no name. For Glimpse we store the result (and close matches) against that guest, not the item answers. For Insight, Deeper, extras, and paid reports we store the answers needed for those results. If you later provide an email to save your results, the same account becomes a full account with your email on it. If you sign in instead to an existing account from a previous visit, the guest account’s data is merged into your existing account and the guest record is removed.

If you visit our site without starting a test, no account is created. The only trace is an anonymous, aggregate pageview in our first-party analytics (see “Technical data” below), which does not identify you.

Payment information

If you buy paid content, payment is processed by Stripe , which handles your card details directly under its own privacy policy . We receive only a confirmation that the payment succeeded, the amount, and a Stripe transaction reference — we don’t see your full card number, CVC, or billing address. We store the transaction reference, the date, the amount, and what was unlocked against your account, for accounting and customer-service purposes.

Technical data

Standard server logs (IP address, user-agent, request path and timestamp) are kept for security and debugging, retained for 30 days, and not used for any analytics or marketing purpose.

For aggregate traffic measurement we run first-party analytics on Potentialisation servers. Your browser may send a short beacon with a page path or funnel step name. We set no analytics cookies and load no third-party analytics script. We store daily aggregate counts (for example pageviews by path, approximate daily uniques, and country where known). For uniques and country we may use your IP address in memory only (a one-way daily hash and an offline country lookup) and we do not store the IP in our analytics database. We do not record path keys that could identify you — share links ( /share/… ), your account area, and admin pages are excluded; everything else, including your result and the portrait pages, is counted only in aggregate. We do not use Google Analytics or Plausible, and we do not share data about your visit with advertisers or anyone else.

Usage events on your own account

Once you start a test, we record a small number of usage events — test starts and completions, combo page views, feedback clicks, share clicks — tied to your user account (whether you’re a guest or a registered user). We use these solely to understand how the product is being used so we can improve it. These events are stored on our own servers, retained for 90 days as individual rows, and then rolled into anonymous daily aggregates that we keep indefinitely. They are not shared with anyone outside Potentialisation Ltd. Our legal basis is legitimate interest in improving the service; the assessment is documented in our internal Legitimate Interest Assessment.

Anonymous channel attribution

Links to our site that we publish on social media, in newsletters, or in shared documents may include a short tag in the URL — for example ?src=fb-launch . When you land on a page carrying such a tag, our server increments an anonymous counter so we can see how many people each channel sent us. The counter does not identify you, store anything in your browser, or link to any other data. We are simply counting the link clicks.

How we use your data

• To compute and display your what-world-way result.
• To save your account and let you return to your portrait.
• To send service emails (sign-in, password reset).
• To process payments for unlocked content (via Stripe) and to keep a record of what you’ve bought.
• To improve Insight and Deeper — anonymised, aggregated patterns across many users help us refine wording and validation. Glimpse item answers are not kept and are not used for this.
• To understand how people are using the product — which combinations land well, where people drop off, how long people spend reading their portrait — so we can improve it. We don’t use this data for marketing or to make decisions that affect you individually.
• To meet legal obligations (e.g. responding to lawful requests from authorities).

Research use of anonymised responses

We may use anonymised Insight and Deeper responses to improve the science behind what-world-way — refining wording and validation across many people. We do not keep Glimpse item answers, so they are not used for research. Once responses are anonymised they can no longer be identified as yours. This never changes the result you see.

Glimpse item answers are not kept and are not used for research. For Insight and Deeper we ask for your explicit, optional consent before you start, which you can withdraw on the Data & research page. Opting out means your responses are used only to compute and show you your own result.

What we don’t do

• We don’t sell your data to third parties.
• We don’t share your individual results with employers, insurers, or marketers.
• We don’t use your answers to train external AI models.

Legal basis (UK GDPR / EU GDPR)

We process your data on these bases:

• Performance of a contract — to deliver the test you asked for.
• Legitimate interests — for security, fraud-prevention, server-side usage analytics, and aggregated product improvement, balanced against your rights and freedoms. Our Legitimate Interest Assessment for usage analytics is documented internally and available on request.
• Legal obligation — to keep accounting records for the period required by UK tax law.

Retention

Inactive accounts (no sign-in for 24 months) are flagged for deletion and erased after a 30-day grace period.

Your rights

You have the right to:

• Access — request a copy of the personal data we hold about you, including your Glimpse result and, where we keep them, test answers and results, any saved profile information, and a list of usage events tied to your account from the last 90 days. Email privacy@potentialisation.com from the address attached to your account.
• Correct it if it’s inaccurate.
• Erasure — delete your account at any time from your account settings, or email us. All personal data, test results, and usage events are removed within 30 days. Anonymous aggregates that contained your data before deletion remain in our statistics, but they no longer link to anything identifying you.
• Receive a portable copy.
• Object to processing based on legitimate interests.
• Lodge a complaint with the UK Information Commissioner’s Office (ICO) or your local supervisory authority.

To exercise any of these, email privacy@potentialisation.com . We’ll respond within 30 days.

Cookies

We use only strictly necessary cookies (sign-in session, guest identity, security tokens). We do not set analytics cookies, marketing cookies, or any other non-essential cookie. Because we don’t use non-essential cookies, we don’t need a cookie banner. See our cookie notice for the full list.

How we keep your data safe

Your data is encrypted both in transit and at rest. Connections to our site use HTTPS/TLS, so your answers travel encrypted between your browser and our servers. The database that holds your answers and results sits on an encrypted volume (AES-256), and our backups are encrypted too — so even at the level of physical storage, your data is unreadable without keys we hold separately. Account passwords are hashed, never stored in readable form. Our servers are hosted in the EU (Germany) on ISO 27001-certified infrastructure, with access limited to the people who run the service.

International transfers

Our infrastructure is hosted in the EU/UK. We do not transfer personal data outside the UK or EEA for analytics or marketing purposes.

Children and under-18s

Glimpse is intended for 16+. We may process a result (three labels + close matches) without an age tap. We do not keep item answers. We do not use Glimpse answers for research or ads. An account needs 13+ — that is when we keep an email. Insight, Deeper, extras, pay, and Inside are 18+ and we ask then. Under 13: we do not offer an account. If we find one, we delete it. Contact privacy@potentialisation.com. You can delete a Glimpse-only account from the account page (email code). Guests: we do not keep answers; results sit on a temporary guest until they expire. This wording is pending legal counsel review.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top of this page reflects the most recent change. For material changes affecting how we process your data, we’ll notify account holders by email.