Privacy policy

This privacy policy describes how Profilia collects and uses data when you visit profilia.app.

Data controller

The data controller is Adrien Albuquerque, a French sole trader (micro-entrepreneur) registered under SIRET 980 175 475 00014, APE code 6201Z. Contact: contact@profilia.app.

Data Protection Officer (DPO): no DPO is designated. Under art. 37 GDPR this is not mandatory in our case (micro-enterprise, no large-scale processing of sensitive data, no systematic monitoring at scale). For any privacy-related question, please contact the data controller directly.

Age and minors

Tests without an account and taking part in a group session are open to all ages: they require neither an email address nor any identity. The first name in a group session is optional and, if entered, relies on your consent: below the age stated in the next paragraph, leave it empty or use a pseudonym.

One feature relies on your consent and asks for an email address: the notification when the group grid opens (the full report waiting list, which also asked for one, has been closed since 18 September 2026). Under art. 8 GDPR, a child can give that consent alone from 16 by default, or from the lower age set by the law of their country, never below 13 (15 in France, 14 in Spain, 13 in Portugal, for example). Below that age, consent must be given or authorised by the holder of parental responsibility. Profilia applies the same threshold to creating an account (by email or with Google): below that age, an account is created with the agreement of a parent or legal guardian. If the law of your country sets a higher age, that is the one that counts.

Data collected

Anonymous audience measurement

When you browse Profilia, start or complete a test, we record the following events in a strictly anonymous way:

• The page or quiz and the profile obtained
• Completion duration
• Device type (mobile, desktop, tablet)
• Scores
• The option chosen at each question: which of the options offered, and since 24 September 2026 the place where it was shown in the list, never any text you typed. It is used only to spot wordings that people avoid because of what they cost socially rather than because of what they describe, so that we can rewrite them, and to spot in our statistics answers given without reading (the same place clicked from start to finish), without ever changing your result. It is erased after 13 months.
• Language used
• Country derived from the browser's Accept-Language header
• Country and region inferred by our network provider (Cloudflare) from the connection, without the IP address being kept: the country since April 20, 2026, on these events as well as on the conversions table, the region (province, state) since June 20, 2026, on test starts and completions. These tables hold neither the city nor coordinates.
• The network of origin (autonomous system number, which designates the operator, never the person) and the HTTP protocol version, passed on by Cloudflare since July 31, 2026, on test starts and completions. The network of origin is used only to measure how much traffic comes from automated clients running in data centres rather than from people; the HTTP version is recorded to support that measurement, but no processing uses it to date.
• Language detection: on your first visit, we read your browser's Accept-Language header to automatically suggest the site in your language. This information is not stored: only your explicit choice (clicking the language switcher) is remembered via a functional locale cookie.
• The domain of the page you arrived from (e.g. google.com, reddit.com): domain name only, never the full URL or query parameters
• The AI answer engine you arrived from, where applicable: answers from ChatGPT, Perplexity or Copilot add a parameter to the link they offer. We read it, but we never store its raw value: we keep only a label drawn from a closed list of seven engines, and nothing at all if the address matches none of them. That label names a product, never a person, and it cannot take any value outside those seven. It tells us what share of our visitors arrives through an AI rather than a search engine, which no other measurement can show.
• Which blocks of the result page actually appeared on your screen (comparison invite, next test suggestion, account prompt, your profile content, bottom of page, the group grid if you arrive from a session link, and the offer to create a group session described below): we measure on-screen display only, never your cursor position or reading time. This tells us whether a rarely used block is unconvincing or simply never reached.
• Whether the offer to create your own group appeared on your screen, on the page of a group session you take part in, and whether you used it: we measure on-screen display and the click, never your cursor position or reading time. This only tells us whether that offer deserves its place.
• Whether hosts come back: when you create a group session, we also measure how many sessions this same browser has already hosted (a number, never your identity or the content), to know whether the host comes back. This measurement serves no other purpose.
• The screen you asked to sign in from, and how many tests this browser has already completed: when you request a sign-in link or sign in with Google, we add to the measurement event that confirms your sign-in, or the creation of your account, the screen you started from (the block under your result, the "My DNA" page or the sign-in page: a closed list, with no free text). When a test ends, we likewise add the number of different tests this same browser has already completed, this one included (a number, never the list or your identity). The starting screen travels with your sign-in link, which is deleted as soon as you open it, or valid for 15 minutes and then automatically purged. These two measurements serve to know which screens make people want to create an account and whether visitors take several tests in a row, and serve no other purpose.
• One of these data points decides what you see, and we would rather say so: since September 12, 2026, when a test ends we count the completed tests and the distinct session fingerprints of the last sixty minutes for the combination (test, language, region). When several results concentrate on very few fingerprints, which betrays a group of people behind a shared network, we display an offer to create a group session. This calculation is about a set, never about you: it reads no history concerning you, nothing beyond the test you have just finished, its result is neither kept nor reused from one visit to the next, and it has no consequence beyond showing that block.
• Whether you opened a content tab on your result, once per page: this signal says neither which one, nor how many times, nor how long you read. It tells us whether the content is read at all, which nothing else does.
• Whether you saved your result as a PDF, and how (download or share): never the content of the document. The PDF is built entirely in your browser; it is neither sent to our servers nor kept by Profilia. The link printed in it carries a fixed label, the same for everyone, which only tells us that a visit came from a PDF.
• Your answer to the question "how did you get to this test?", asked at the bottom of the results page since 21 September 2026, and the fact that the question was shown to you. The answer is picked from a closed list of six options: there is no free-text field, so nothing you could type can be recorded. Alongside it we keep the channel our server actually saw you arrive through (search engine, social network, AI answer engine, referring site, or no signal at all), so that we can tell how reliable the declared answers are. Answering is optional and changes nothing in what you are shown. This table carries no session identifier: an answer cannot be tied to you, to your test, or to your other events.

We do NOT collect any individual marketing attribution (campaign UTM, ref_code) on these tables. That information is persisted only at conversion events, on a dedicated table: a test completed after arriving through a share or campaign link, an outbound share, an account creation, a sign-in link requested or confirmed, and, until 18 September 2026, a sign-up to the full report waiting list. That table carries no session identifier: a conversion can only be tied to the completed test it concerns and, where relevant, to the share that brought it, never to your other events. Two exceptions, listed above and deliberately bounded: the entry page path, normalised before storage, and the AI answer engine label, drawn from a closed list. Neither can carry your identity nor take a free-form value, and neither is campaign data.

Rotating session identifier

To group events from the same visit we compute a session identifier from a truncated IP address (last octets zeroed), a coarse User-Agent (browser and OS family only, no version) and a secret salt regenerated every day and immediately thrown away. This "rotating salt" technique guarantees it is impossible to link two visits from the same user across different days. The identifier is therefore genuinely anonymous under the CJEU C-413/23 P ruling of 4 September 2025 and the CNIL guidelines of 4 July 2025 on consent-exempted audience measurement.

Aggregated data

Individual data is aggregated into daily statistics (number of completions per quiz and per profile). These aggregated statistics contain no individual information.

User account (optional)

Profilia offers optional account creation. Tests remain accessible without registration. If you choose to create an account, the following data is collected:

• Email address: used for magic link or Google authentication, to confirm an account deletion request (no password is stored) and, occasionally, to ask for your feedback (see below)
• Name: to personalize your dashboard
• Sign-in with Google (if you choose it): your Google account identifier and the link to your profile picture on Google (the image itself is not copied), sent by Google along with your name and email address
• Quiz history: completed quizzes, profiles obtained, scores, and dates are saved to allow you to track your evolution

You may sync quiz history completed before account creation (stored locally in your browser) to your account. This synchronization is voluntary.

If you have an account, we may also write to you occasionally, to ask for your feedback on the service or on a feature you have used, with the sole aim of improving it. These messages are rare and launched by hand, to people who have used the service. There is never a newsletter or any marketing, your address is never sold, rented or passed on, and you only have to write to us at contact@profilia.app (or reply to one of these messages) to stop receiving them. Replies we receive are kept for 12 months at most.

When you have created a group session from your account, this request for feedback takes the form of a single email sent by Resend (see below), which contains a personal link to a short form. This link is valid for 14 days at most and never beyond the end of the session, it can only be used once, and opening it does not count as a reply: nothing is recorded until you submit the form. The invitations table (host_feedback_invitations) contains no email address: only the fingerprint of the link (the link itself is not kept in this table), the dates of sending, expiry and use, and the session it is attached to; it disappears with the session, 30 days after it was created. So that we do not ask you twice, we note on your account the date of the last invitation and, if you ask us not to receive anything more, that refusal: these two marks are kept for as long as your account exists, and exported with your data.

Comparison sessions

The "Challenge a friend" feature creates a comparison session that allows you to compare your results with a friend's. These sessions:

• Are accessible via a unique link (UUID) that you share
• Contain participant scores and profiles (anonymous data)
• Automatically expire after 30 days
• Anyone with the link can view the results

Personality DNA sessions

The "My DNA" feature generates a cross-quiz personality profile. By default your DNA is computed entirely in your browser from your local history: nothing is sent to the server. A session is only persisted in our database if you explicitly click "Share". In that case:

• It is accessible via a unique link (UUID)
• It contains profiles and dimensions from your quizzes (anonymous data)
• It automatically expires after 30 days

Group sessions

The "Group mode" feature lets several people take the same test and see the aggregated breakdown. These sessions:

• Are reachable through a unique link (UUID) shared by the host
• Contain the participants' scores and profiles, with no personal identifier
• Show no breakdown until at least 3 people have answered: below that, the grid would point at each of them
• May carry an optional first name, visible to the host only, and an optional email address
• Keep, only if the host is not signed in to an account, the approximate country and region the session was created from, supplied by Cloudflare (never the city or the IP address): they tell us where sessions come from, never who creates them
• Can be linked to one another when the host runs the same test again for another group: the new session keeps a link to the previous one and its rank in the series, so we can count relaunches. No answer and no first name carries over from one session to the other, and the link disappears with the previous session
• Expire automatically after 30 days
• Let the host, from their own view, give feedback on the service: whether they ran the test again for another group, what held them back, and an optional free text. This feedback is optional, contains neither your name nor your email address, and stays attached to the session during its 30 days; when it is submitted we copy a few facts about the session into it (test, language, rank in the series, the page the session was created from, the date it was created, number of participants who finished, whether the host was signed in to an account), and the link to the session disappears with it. The feedback itself is kept for 12 months in the host_feedback table. Please do not write any name or email address in the free text. If you have an account, the same feedback may also be asked of you by email, under the conditions described above

The email address, if you enter one, serves a single purpose: telling you once that enough people have answered for the grid to appear. It is never used for marketing, is tied to no account, is visible neither to the other participants nor to the host, and disappears with the session after 30 days. Nothing is pre-ticked: entering the address is the consent, and leaving the field empty takes nothing away from your participation.

Full report waiting list

From 21 August to 18 September 2026, the end of a test offered to notify you when a paid "full report" launched. That report does not exist. This offer has ended: no address is collected there any more. For the addresses left during that period:

• They serve no purpose other than the one announced: no email has been sent, and none will be sent for any other reason
• Each is stored with the test concerned, the language of the page and the amount that was shown, and nothing else: no IP address, no session identifier, no quiz history
• No account was created, no payment requested, no banking data collected
• They are automatically deleted 12 months after they were recorded
• You can ask for yours to be deleted at any time by writing to contact@profilia.app

Cookies and third-party trackers

Profilia does not use any third-party cookies or trackers for advertising or analytics. No advertising script (Google Ads, AdSense, Meta Pixel) or third-party analytics tool (Google Analytics, Google Tag Manager) is loaded.

Web audience measurement is handled by Umami, an open-source solution that we self-host on the subdomain stats.profilia.app (Hetzner Germany infrastructure, no data transfer to a third-party vendor). Umami is cookieless: it does not set any cookie in your browser. For logged-out visitors, the visitor identifier is derived from your IP, User-Agent, and a monthly rotating salt, which limits to one calendar month the ability to link two visits from the same browser, and removes it beyond that. Events are retained for 25 months maximum and then automatically purged, in line with the CNIL ceiling for consent-exempt audience measurement (CNIL recommendation of 4 July 2025). For each visit, Umami also records the approximate country, region and city inferred from the connection (headers passed on by Cloudflare or, failing that, Umami's built-in geolocation database), never the IP address itself or coordinates.

For users logged into a Profilia account, a stable pseudonymous identifier (your internal user ID, never your email or name) is associated with your Umami sessions so we can retrieve your quiz history across devices. This association is opt-out at any time from Settings → Data & privacy, and is automatically cleared at logout. Legal basis: contract performance (you created the account voluntarily). Logged-out visitors remain strictly anonymous as described above.

Third-party services

Resend (transactional emails)

Transactional emails are sent via the Resend service: the login link, the confirmation of an account deletion request, the group grid unlocked notification if you asked for it, and the invitation to give feedback described above if you have created a group session from your account. Your email address is transmitted to Resend solely for sending these emails. Learn more: Resend's privacy policy.

Sentry (error tracking)

The website uses Sentry to detect and fix technical errors. Sentry collects technical diagnostic data: error messages, execution traces, browser type and version, URL visited at the time of the error, and IP address. IP addresses are automatically anonymized by Sentry and are not used for identification purposes. No other personal data (name, email, etc.) is transmitted. This processing is based on our legitimate interest in ensuring service stability. Learn more: Sentry's privacy policy.

Legal basis

• Legitimate interest: anonymous quiz tracking allows us to improve the service (usage statistics, abandon rates, profile distribution). Technical error tracking (Sentry) also falls under legitimate interest.
• Performance of contract: collecting your email during account creation is necessary to provide the authentication and quiz history service.
• Legitimate interest: writing, rarely, to ask for feedback from someone who has an account and has used the service, in order to improve it. This is neither marketing nor a newsletter, and you can object at any time by writing to the data controller.
• Consent: sign-ups to the full report waiting list, collected until 18 September 2026, relied on you voluntarily entering your email address, in a form whose sole purpose was that. No box was pre-ticked.
• Consent: the notification when the group grid opens likewise relies on you voluntarily entering your email address, in an optional field whose sole purpose is that. You can withdraw this consent at any time by writing to the data controller.
• Consent: the optional first name in a group session relies on you voluntarily entering it, in a field you can leave empty without losing anything of your participation. It is erased with the session, 30 days after the session was created (daily purge). You can withdraw this consent at any time by writing to the data controller or, while the field is still offered to you, by clearing it and clicking "Add to the group" again from the same browser.
• Legitimate interest: collecting the feedback of a group session host on the service (host_feedback table), from their own view, in order to improve it. Answering is optional, and you can object at any time by writing to the data controller.
• Legitimate interest: inviting the signed-in host of a group session, by a single email with a personal link, to give this feedback (host_feedback_invitations table), and noting on their account the date of the last invitation as well as any refusal to receive more. This is neither marketing nor a newsletter, and you can object at any time by replying to the email or by writing to the data controller.

Data retention

• Option chosen at each question (described above): erased after 13 months, the completion it belongs to then following the rule below.
• Anonymous audience measurement data (quiz completions, starts, page views, including the entry path and the AI engine label described above): retained for up to 25 months, then purged automatically (CNIL maximum for consent-exempted audience measurement).
• Attributed conversion data (tests reached through a share or campaign link, shares, account creations, sign-in links, report waiting list sign-ups): retained for up to 13 months.
• User account data: retained as long as your account is active. When you delete your account, a 30-day grace period lets you cancel via an email link; after that, all of your personal data (account, email, sessions, badges) is permanently erased and your quiz results are detached from your identity (kept for aggregate statistics only).
• Magic link authentication tokens: valid for 15 minutes, then purged hourly.
• Comparison sessions: automatically deleted after 30 days.
• Shared DNA sessions: automatically deleted after 30 days.
• Group sessions (including the optional first names and email addresses they carry): automatically deleted after 30 days.
• Host feedback (host_feedback table: answers, ticked reasons, optional free text and the facts copied from the session): automatically deleted after 12 months, well after the session it was attached to, whose link disappears after 30 days.
• Feedback invitations (host_feedback_invitations table: fingerprint of the link, dates, attachment to the session, never an email address): deleted with the session, 30 days after it was created. The date of the last invitation and any refusal to receive more, noted on the account, last as long as the account does.
• Server access logs (nginx): IP addresses are truncated (/24 for IPv4, /48 for IPv6) before being written.
• Aggregated statistics (DailyStat): retained indefinitely as they cannot be linked to any individual.
• Full report waiting list (email address, test concerned, language, amount shown): automatically deleted after 12 months.

Sub-processors and non-EU transfers

Profilia relies on a limited set of providers. The first four below are sub-processors covered by a Data Processing Agreement and, for US vendors, by the EU-US Data Privacy Framework. The last two concern only the mailbox behind the contact address:

• Hetzner Online GmbH (Germany): servers and database hosting. No non-EU transfer.
• Resend (United States, DPF): sending magic link emails, account deletion emails, the group grid unlocked notification and the feedback invitation sent to a group host.
• Sentry (United States, DPF): technical error monitoring, IPs anonymised at source.
• Cloudflare (United States, DPF): CDN and anti-DDoS protection, processes anonymised technical logs and infers from the connection the approximate country, region and city it passes on to our servers (see above), along with approximate coordinates and a postal code, which neither our application nor Umami stores.
• IONOS SARL (IONOS SE group): registration of the profilia.app domain name and forwarding of the contact@profilia.app address. The messages you write to us pass through it before reaching our inbox. A data processing agreement, incorporated into IONOS's general terms and conditions, applies.
• Google (Google Ireland Limited, Ireland, and Google LLC, United States, DPF): the contact address is forwarded to a personal Gmail account of the data controller, where the messages exchanged with you are kept. This consumer account is governed by Google's terms and privacy policy: there is no signed data processing agreement with Google for this mailbox. For that reason, please do not attach sensitive data to your messages.

Your rights

Under the GDPR, you have the following rights:

• Right of access: know what data concerns you
• Right to rectification: have inaccurate data corrected
• Right to erasure: request the deletion of your data
• Right to object: object to the processing of your data
• Right to data portability: receive your data in a structured format

If you have an account: you can export all of your personal data as JSON from the "Data & privacy" section of your settings, and trigger account deletion with a 30-day grace period from the same screen.

Anonymous audience measurement data: thanks to the daily rotating salt, it is technically impossible for us to identify your visits among aggregate data. We cannot honour an individual erasure request on these tables, but they are purged automatically after 25 months at the latest.

Right to object to audience measurement: you can object at any time, with no account and no justification, using the button below. No third-party marketing or analytics cookies are set on this site.

Right to complain: if you believe your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL).

For any questions or requests, contact us at: contact@profilia.app.

Changes

This policy may be updated at any time. The date of the last modification is indicated below.

Cookie and local storage declaration

Below is everything this site stores on your device, cookies as well as browser local storage. Article 82 of the French Data Protection Act covers both in the same way, so both are declared here. Everything is either strictly necessary to operate the service or falls under consent-exempt audience measurement.

Cookies

• laravel_session, XSRF-TOKEN: form security and temporary session identification (session duration).
• locale: stores your language preference if you've selected one explicitly (12 months).

Audience measurement

• profilia_attempt:<test>: random identifier for a test attempt, sent along with your anonymous result. It only prevents the same attempt from being counted twice, for example if you reload the results page. It contains no information about you, cannot link you across days or across sites, and disappears when the tab closes or a new attempt starts.
• profilia_engaged_<test>: fixed-value marker that prevents your engagement in the same test from being counted twice within the same tab (tab duration).
• profilia_tracking, profilia_tracking_v2: arrival context of the visit (source, entry page), kept for a rolling 30 minutes. No personal identifier. If you arrive through a comparison challenge, the identifier of that challenge is added; it designates the game played, not the person who started it.
• profilia_own_refs: the share markers this browser placed itself, so you are never counted as arriving from your own link. Ten at most, no identifier.
• profilia_guest_intro_arm: if you arrive through a link someone sent you, the version of the test introduction randomly assigned to you (guest or control), so you always see the same one and we can compare the two. No identifier, nothing about the person who sent you the link.
• profilia_guest_intro_seen_<test>: fixed-value marker that prevents this introduction from being counted twice within the same tab (tab duration).

Your content, which stays with you

• profilia_quiz_history, the tests' progress state, profilia_badges_known and profilia_badge_events: your in-progress answers, your results and your badges. They live in your browser and are only sent to our servers if you ask us to, by creating an account or sharing a link.

Display preferences

• profilia_theme, profilia_locale_nudge, profilia_adn_capture_dismissed, profilia_auth_prompt_dismissed, profilia_consent: your theme, and whether you've already dismissed a given suggestion, so we don't show it to you again.
• profilia_group_*: markers that let you find your way back to a group session you created or joined.
• profilia:guess:<challenge>: the answer you gave to a “Guess my profile” challenge, so that reloading the page does not give you a second try. It stays in your browser and holds no identifier.

Technical markers

• __profilia_probe__: trial key, written then immediately erased, used to check whether your browser allows storage.
• profilia_build_reload: marker set once per tab, which prevents the page from reloading in a loop when a site update has left a stale file in your browser cache.
• _tracking_err_<endpoint>: marker set when a measurement request failed, so the incident is reported once per tab rather than thousands of times. It only holds the technical name of the request concerned.

Your opt-out

• profilia_tracking_opt_out, umami.disabled: remember your refusal of audience measurement if you exercise it. As long as they are set, nothing is written or sent, including the attempt identifier above.

No advertising cookie, third-party analytics tracker or profiling tracker is set.

Last updated: October 2, 2026