Privacy Policy

Last updated: · Applies to cognitiontype.com and all associated services

1. Who we are

CognitionType is operated by a Singapore-registered private limited company. For the purposes of the Personal Data Protection Act 2012 (PDPA), we are the organisation responsible for personal data in our possession or under our control. For users in the European Economic Area or UK, we also comply with GDPR as a data controller. Contact: privacy@cognitiontype.com

2. What we collect and why

Quiz responses
Your answers to the 30 assessment questions are processed in your browser to calculate dimension scores. The scores (six integers, 0–100) are transmitted to our servers when you initiate checkout. We do not store your individual question responses. Scores are embedded in your payment session and in your signed report token.

Payment information
Payment is processed by Stripe. We do not receive or store your card number, CVV, or full payment details. We receive a Stripe session ID confirming payment was successful, and your email address if provided during checkout. Stripe's privacy policy applies to payment processing: stripe.com/privacy

Analytics events
We record anonymised events (quiz started, report viewed, link clicked) in our analytics database (ClickHouse Cloud). These events contain:

• Event name and timestamp
• A one-way hash of your IP address (not the IP itself — irreversible)
• A one-way hash of your browser user-agent string
• Your country (derived from IP by Vercel's edge network, not stored alongside raw IP)
• Your dimension scores (if you have a valid paid report token)
• Which ad slots you viewed or clicked, and where those links went

No persistent identifiers (cookies, device fingerprints, cross-site trackers) are used for analytics. Events are retained for 2 years then automatically deleted.

Session storage
Your browser's sessionStorage holds your quiz session ID and report token during your visit. This data is local to your device and browser tab. It is not transmitted to third parties. It is deleted when you close the tab.

3. Legal basis for processing

Under Singapore PDPA: We collect, use, and disclose personal data only with your consent, or where permitted by law (e.g. to fulfil the contract to deliver your report, or to comply with legal obligations). You may withdraw consent at any time, subject to legal or contractual restrictions.

For EEA/UK users (GDPR Art. 6): Contract performance (delivering your paid report), legitimate interests (anonymised analytics), and legal obligation (tax record retention).

4. Who we share data with

• Stripe — payment processing (EU-US Data Privacy Framework certified)
• Vercel — hosting and serverless functions (EU region available; SOC 2 Type II)
• ClickHouse Cloud — analytics database (EU region; SOC 2 Type II)
• Resend — transactional email delivery (if you provide an email address)

We do not sell, rent, or share your data with advertisers, data brokers, or any third party for marketing purposes.

5. Affiliate links and tracking

The report contains affiliate links to products and services (iHerb, Amazon, etc.). These links go through our redirector (/api/r), which appends affiliate tracking parameters and logs the click event in our analytics. When you click an affiliate link, the destination site's privacy policy applies. We receive a commission if you make a purchase — this does not affect the price you pay.

6. The nature of the assessment

CognitionType is a cognitive style assessment for informational purposes. It is not a medical device, clinical evaluation, or diagnostic tool. The dimension scores and profile results do not constitute health data under GDPR Art. 9, as they are self-reported personality-adjacent indicators rather than medical diagnoses. We do not infer, store, or share any clinical or health conclusions about you.

7. Your data rights

Singapore (PDPA): You have the right to request access to and correction of personal data we hold about you. Contact us at privacy@cognitiontype.com.

EEA/UK users (GDPR): You additionally have the right to:

• Access — request a copy of data we hold about you
• Erasure — request deletion of your analytics records (note: because we store only hashed IPs, we cannot guarantee complete linkage)
• Rectification — correct inaccurate data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

To exercise any right, contact privacy@cognitiontype.com. We respond within 30 days. If unsatisfied with our response, Singapore users may contact the Personal Data Protection Commission (PDPC) at pdpc.gov.sg. EEA users may lodge a complaint with their national supervisory authority. UK users may contact the ICO.

8. Data retention

• Analytics events: 2 years (automatic TTL deletion in ClickHouse)
• Stripe payment records: 7 years (legal requirement)
• Report tokens: expire after 7 days (cryptographic expiry, nothing stored server-side)
• Email address (if provided): retained until you request deletion

9. Cookies

We do not use cookies for tracking or advertising. We do not use Google Analytics, Meta Pixel, or any third-party tracking scripts. The only browser storage we use is sessionStorage (tab-local, cleared on close) for your quiz state and report token.

10. Children

This service is intended for adults (18+). We do not knowingly collect data from children. If you believe a child has submitted a response, contact us for immediate deletion.

11. Changes

We will post any material changes to this page with an updated date. Continued use of the service after changes constitutes acceptance.

12. Governing law & contact

This Privacy Policy is governed by the laws of Singapore. Disputes are subject to the non-exclusive jurisdiction of the Singapore courts, without prejudice to your rights under applicable local consumer protection law.

Data controller: CognitionType (Singapore Pte. Ltd.)
Email: privacy@cognitiontype.com
Response time: within 30 days for all rights requests