Privacy Policy

1. Who we are (data controller)

The data controller responsible for your personal data is CoreSelf Labs LLC, 9110 Selborne Lane, 220, Palmetto, GA 30268, USA. You can reach us at [email protected].

2. Data we collect

Information you give us: your email address, your first name (if you choose to share it), your screening answers and any free-text responses, and your support messages.

Information collected automatically: IP address, device and browser details, language and time zone, session and cookie data, the referring URL, and your activity on the Service (pages viewed, test progress).

Payment information: payments are handled by trusted processors such as Stripe. We do not store full card numbers, expiry dates or security codes. We receive only limited data such as the last four digits, the card brand, the transaction status and your billing country.

3. How we use your data

• Create and manage your account.
• Run the screening, compute results and deliver your report.
• Operate, secure, debug and improve the Service.
• Process payments and manage your subscription.
• Detect fraud and abuse and enforce our Terms.
• Send transactional emails (receipts, results, account notices).
• Provide customer support and meet legal obligations.

We do not use your answers to make automated decisions that produce legal or similarly significant effects about you.

4. Legal bases (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you bought); legitimate interests (to secure and improve the Service); consent (for non-essential cookies and marketing, which you may withdraw at any time); and legal obligations (tax, accounting and consumer-protection rules).

5. How we share your data

We share data only with service providers acting on our behalf — payment processors, hosting and cloud infrastructure, analytics, transactional-email and customer-support tools, and fraud-prevention services — each under a written data-processing agreement. We may also disclose data where required by law or to protect rights and safety. We do not sell your personal data.

6. International data transfers

Because we use international providers, your data may be processed outside your country. Where it is, we use appropriate safeguards such as Standard Contractual Clauses (and the UK equivalent) and adequacy decisions where available.

7. Data retention

We keep personal data only as long as needed to provide the Service, comply with legal obligations and resolve disputes. Your answers and reports may be kept while your account is active so you can revisit them; when you request deletion or the data is no longer needed, it is deleted or anonymised.

8. Your rights (GDPR / UK GDPR)

• Access the data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent at any time where processing is based on consent.

To exercise any right, email [email protected]. You may also complain to your local data-protection authority.

9. California privacy rights (CCPA / CPRA)

California residents may know what we collect, request deletion or correction, opt out of any "sale" or "sharing" for cross-context advertising, limit use of sensitive information, and not be discriminated against for exercising these rights. We do not sell or share personal information as defined under the CCPA/CPRA. Email [email protected] to exercise a California right.

10. Children

The Service is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it promptly.

11. Security

We use technical and organisational measures — including TLS encryption in transit, encryption at rest, role-based access controls and ongoing monitoring — to protect your data. No method of transmission or storage is completely secure, but we will notify you and the relevant authority of any breach as required by law.

12. Sensitive topics & well-being

The ADHD screener touches on sensitive areas of mental health. Your responses are treated with the same confidentiality as the rest of your account data and are used only to generate your report. The screener is for self-reflection, not diagnosis — if you are struggling, please reach out to a qualified professional or a local support service.

13. Cookies & tracking technologies

Cookies are small text files placed on your device when you visit a website; similar technologies include local storage, session storage and pixels. We use them to keep the Service working, remember your preferences, measure performance and — with your consent — show relevant messaging.

Strictly necessary — required for sign-in, security and remembering your place in a test; these cannot be switched off.

Performance & analytics — help us understand how the Service is used, in aggregate form (for example, Google Analytics).

Functional — remember choices such as your language and region.

Advertising & marketing — measure campaigns and show relevant messaging; set only with your consent where required by law.

Where consent is required (for example, in the EU or UK), a banner lets you accept all, reject non-essential, or customise cookies by category. You can change your choice at any time via the banner or your browser settings; disabling strictly necessary cookies will stop parts of the Service from working.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date above reflects the current version, and we will make reasonable efforts to notify you of material changes in advance.

15. Contact

For any privacy question or request, contact us at [email protected] or using the details below.