Privacy Policy

Throughout this policy, these terms have the following meanings:

IQ Report

"We," "us," or "our" — the operator of this platform.

Service

All features, functionality, programs, and content available through IQ Report.

Platform

Our website and related services, accessible from any device.

User

Any individual accessing or using our services ("you" or "your").

Personal data

Any information relating to an identified or identifiable natural person.

Processing

Any operation performed on personal data.

Data controller

IQ Report, which determines the purposes and means of processing personal data.

Data processor

Third parties that process personal data on our behalf.

Cookie

A small text file stored on your device containing data about your platform usage.

Authentication

The process of verifying a user's identity.

Encryption

Encoding information to prevent unauthorized access.

Token

A unique identifier used for secure authentication.

SSL/TLS

Security protocols for encrypted data transmission.

2.1 Policy overview

This privacy policy explains how IQ Report collects, uses, and protects your personal data. It provides detailed information about your privacy rights and how you can exercise them.

2.2 Policy application

This policy applies to:

• All users of IQ Report globally
• All data collection methods
• All service features and functionality
• All platform versions and updates

2.3 Policy updates

• We reserve the right to update this policy
• Material changes will be notified by email
• Continued use after changes constitutes acceptance

3.1 Account information

Essential: email address (for authentication), name (collected during payment), last sign-in timestamp, unique account identifiers, and IP addresses.

Optional: phone number (if provided via payment processors), user preferences and settings, and communication preferences.

3.2 Service usage data

Test results: final IQ scores, completion timestamps, and performance metrics. Individual test answers are processed in real time and are never stored.

Interaction data: features accessed, time spent on the platform, navigation patterns, and device information.

3.3 Payment information

We only receive and store limited payment information: tokenized payment method identifiers, the last four and first six digits of payment cards, and card expiration dates.

3.4 Technical and device data

• Device: operating system, browser type and version, screen resolution, device type and model, language preferences
• Connection: IP address, network information, connection type, geographic location (derived from IP), time zone
• Performance: load times, error messages, system performance metrics, network latency, application response times

4.1 Primary processing purposes

• Service provision: account creation and management, authentication and security, feature access and customization, customer support, service optimization
• Payment processing: subscription management, payment authorization, fraud prevention, transaction records, billing support
• Communication: service updates and notifications, security alerts, product information, support responses, legal notices

4.2 Secondary processing purposes

• Service improvement: usage pattern analysis, feature optimization, performance monitoring, user experience enhancement, bug identification and resolution
• Analytics and research: aggregate usage statistics, trend analysis, platform optimization, feature development, performance benchmarking

4.3 Legal bases for processing

• Contractual necessity: account management, service provision, payment processing, feature access, support services
• Legal obligations: tax compliance, financial records, legal requirements, regulatory compliance, safety and security
• Legitimate interests: service improvement, fraud prevention, security maintenance, technical optimization, business development
• Consent-based processing: marketing communications, optional features, third-party integrations, analytics participation, feature testing

5.1 Storage location and data transfers

All personal data is stored on secure servers located within the European Union, provided by leading cloud infrastructure providers, primarily Amazon Web Services (AWS). All data is transmitted over encrypted channels, and appropriate safeguards are applied to any international data transfers. We do not maintain our own data centers and rely on certified third-party providers that comply with applicable security and data protection standards.

5.2 Security measures

• Authentication and access: multi-factor authentication, passwordless email sign-in with single-use codes, automatic session termination, role-based access control, least-privilege principle, access logging and regular reviews
• Data protection: SOC 2 Type 2 compliance, AES-256 encryption at rest, TLS in transit, regular security audits
• System security: DDoS protection via Cloudflare, intrusion detection, regular patching, infrastructure monitoring
• Payment security: PCI DSS compliant processing, tokenized storage, no access to complete card numbers, encrypted transmission, immediate incident response
• Backup and recovery: regular automated encrypted backups, disaster recovery planning, geographic redundancy, data restoration procedures
• Organizational security: incident response procedures and protocols, access control policies and enforcement, a security incident reporting framework, change management procedures
• Monitoring and maintenance: real-time system monitoring and security event logging, performance tracking and analysis, regular security reviews and assessments, continuous compliance monitoring, regular system updates, vulnerability assessments, security patch management

5.3 Data breach notification procedures

Definition and scope. A data breach is unauthorized access to personal data, accidental loss or destruction of personal data, unauthorized disclosure of personal data, or any incident compromising data confidentiality, integrity, or availability.

Internal response. Upon discovering a potential breach, we will immediately initiate our incident response plan, assess the nature and scope of the breach, take immediate steps to contain it, document all aspects of the incident, and evaluate the risks to affected individuals.

User notification. We will notify affected users by email within 72 hours of breach confirmation.

Notification content. Breach notifications will include a description of the incident, the types of data affected, the potential impact on users, the steps we've taken to address the breach, recommended user actions, contact information for questions, and resources for additional support.

Regulatory compliance. Where required by law, we will notify relevant supervisory authorities, comply with jurisdiction-specific requirements, provide mandatory documentation, cooperate with investigations, and implement required remedial measures.

Post-breach measures. Following any breach, we will conduct a thorough investigation, implement additional security measures, update procedures as necessary, provide ongoing updates to affected users, and review and enhance security protocols.

6.1 Analytics and infrastructure partners

Analytics services. We use the following services to monitor and improve our platform: Google Tag Manager (managing analytics and marketing tags), Google Analytics (user behavior analysis and service optimization), Mixpanel (user interaction tracking and feature usage analysis), Google BigQuery (large-scale data analysis and reporting), Sentry (error monitoring, performance tracking, and session recording), and Cloudflare (performance analytics and security monitoring).

Session recording. Through Sentry, we implement session recording with the following safeguards: automatic masking of all user inputs, no collection of personally identifiable information, exclusion of all data entry fields, anonymization of all user interactions, and usage limited to bug investigation and performance optimization.

Data collection scope. These services may collect usage patterns, feature interaction data, performance metrics, error information, anonymized user flows, and aggregate statistics.

6.2 Advertising partners and data sharing

Advertising partners. We work with various advertising partners, including Facebook, Google, Snapchat, TikTok, Taboola, Outbrain, AppLovin, and Pinterest.

Data sharing practices. These partners may receive anonymous identifiers, email addresses (for advertising purposes), usage data, device information, and interaction metrics.

Partner data usage. Our advertising partners may track user interactions, measure ad performance, optimize ad targeting, create audience segments, and analyze campaign effectiveness.

6.3 Your control over tracking

Tracking limitations. You can limit tracking through browser cookie settings, ad-blocker extensions, device settings, and platform-specific controls.

Opt-out options. Available tools include the Digital Advertising Alliance (DAA) opt-out tools, the Network Advertising Initiative (NAI) opt-out platform, platform-specific advertising settings, and individual advertising partner opt-outs.

Impact of limiting tracking. Limiting tracking may affect platform functionality, service personalization, feature availability, and user experience. Core service features will remain functional.

7.1 Universal rights

All users have the following basic rights:

• Access their personal data
• Correct inaccurate data
• Request data deletion (see Section 8 for procedures)
• Object to processing
• Data portability
• Withdraw consent

7.2 Regional privacy rights

European Union and UK residents (GDPR). Core rights include the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights regarding automated decision-making.

California residents (CCPA/CPRA). Additional rights include knowledge of personal information collection, knowledge of information sharing, deletion rights, correction rights, opt-out rights, non-discrimination rights, and portability rights.

Australian residents. Privacy Act rights include collection notification, access rights, correction rights, purpose specification, use limitation, and disclosure transparency.

Canadian residents. PIPEDA rights include access rights, accuracy rights, consent withdrawal, use transparency, and protection expectations.

7.3 How to exercise your rights

Submission methods. Privacy rights requests can be submitted through any of our official contact channels listed in Section 12.

Verification process. To protect your privacy, we require initial verification through email verification and account authentication (if applicable), and identity documentation if needed for sensitive requests. For sensitive requests or authorized agents, we may require a government-issued ID, proof of authority (for agents), and additional security checks as needed.

Response timelines. Initial acknowledgment within 72 hours, a standard response time of 30 days, a maximum extension period of 45 days (with notification), and appeal decisions within 30 days. California residents receive acknowledgment within 10 days per CCPA requirements.

Data delivery. Personal data will be provided in a machine-readable format (CSV or JSON), with a complete data inventory, via encrypted transmission.

Appeal process. If you're unsatisfied with our response, you may submit an appeal within 30 days, including your reason for appeal and any additional information, and you will receive a decision within 30 days.

8.1 Retention periods

8.2 Deletion process

9.1 International data transfers

For users outside the European Union, we ensure appropriate data protection through standard contractual clauses for international data transfers, technical and organizational security measures, regular compliance monitoring and assessments, adherence to international data protection requirements, and continuous evaluation of data protection mechanisms.

9.2 Legal jurisdiction and dispute resolution

Escalation process. Before pursuing legal action, users must follow our escalation procedure.

• First-level escalation: email [email protected] with the subject line "Escalation", including your reference number and prior communication history; a response is provided within 5 business days.
• Second-level escalation: if unsatisfied, request senior management review through the same channel, with a final decision within 15 business days.
• Informal dispute resolution: following the escalation process, parties will attempt informal resolution over a 30-day good-faith negotiation period through direct communication.

Formal legal proceedings. If escalation and informal resolution are unsuccessful: this privacy policy is governed by the laws of the State of Nevada, United States; any legal proceedings shall be exclusively resolved through binding arbitration as detailed in Section 14 of our Terms & Conditions; arbitration shall be conducted by the American Arbitration Association; users expressly consent to the personal jurisdiction of Nevada courts for matters exempt from arbitration; and all claims must be brought within six months of the incident date. For complete dispute resolution procedures, including arbitration rules, exceptions, and the class action waiver, please refer to Section 14 of our Terms & Conditions.

• Minimum age: 18 years
• No intentional collection of data from minors
• Accounts are terminated if an underage user is discovered

11.1 Modification rights

We reserve the right to modify this privacy policy at any time.

11.2 Types of changes

Material changes. Changes that significantly affect your rights or our obligations, including major changes to data sharing with third parties, fundamental changes to data processing purposes, and significant changes to user privacy rights.

Non-material changes. Changes that don't substantially affect your rights include, but are not limited to: updates to reflect current practices, adding new product features or services, changes to contact information, clarifications of existing terms, grammatical or formatting updates, security enhancements, technical documentation updates, service improvement descriptions, analytics and tracking updates, changes to advertising partners and analytics providers, updates to third-party integrations, and regional compliance updates.

11.3 Notice requirements

Material changes: email notification will be provided 5 days before implementation; changes are effective upon the notification date, and continued use constitutes acceptance.

Non-material changes: these may be implemented immediately with no advance notice required, and the updated policy will be posted on the website.

11.4 Your options

You may review the current privacy policy on our website at any time, discontinue use of the service if you disagree with changes, or continue use, which indicates acceptance of changes.

For all inquiries, including privacy-related matters:

• Email: [email protected]
• Phone: +1 (775) 618-IQIQ (4747)
• FAQ: iq.report#faq
• Postal address: IQ Report, 5575 Simmons St Num 1-265, Las Vegas, Nevada 89031

All inquiries are handled according to the response timelines detailed in Section 7.3.