Personomist
Sign in

Privacy Policy

Effective date: 9 October 2026
Data controller: University of Tartu (registry code 74001073), Ülikooli 18, 50090 Tartu, Estonia ("Personomist", "we", "us"). Contact: info@personomist.com.

1. What data we collect.

  • Account data: your email address and, optionally, your name.
  • Questionnaire answers: your responses about your personality, mood, wellbeing, interests, and related topics, plus optional free-text notes. Some of this (for example mood and wellbeing answers) can reveal information about your health, which we process only with your explicit consent, given when you choose to take those questionnaires.
  • Response patterns: the order the questions were shown in and the time spent on them, on which your results page bases its description of your response patterns.
  • Demographics: age, gender, and preferred language, used to statistically adjust your scores so they reflect your psychology rather than typical age or gender effects.
  • Other people's descriptions of you: answers given by people you invited to describe you. These are shown to you only in aggregate (combined across at least two describers), never individually.
  • Your descriptions of other people: stored linked to the person you described, and shown to them only in the same aggregated form.
  • Sharing and organisation data: records of what you explicitly shared with whom (for example an organisation's share request you responded to).
  • Technical data: server logs (IP address, timestamps, requests) kept for security and troubleshooting, and the cookies described in section 6.

2. What we use it for, and on what legal basis.

  • Computing and showing your results, combining your answers with other people's combined answers, and providing the sharing features you invoke — performance of our contract with you.
  • Processing answers that can reveal health-related information — your explicit consent, which you can withdraw at any time by deleting the relevant results or your account.
  • Service emails: sign-in links, notifications that results are ready or that someone described you, and occasional reminders — legitimate interest in operating the service; reminder emails include an unsubscribe link.
  • Security, abuse prevention, and diagnostics — legitimate interest in keeping the service safe.
  • Improving our questionnaires, scoring, and predictive models and developing new features, using only anonymised data that cannot be linked back to you — legitimate interest in improving the service.
  • We do not sell your data, use it for advertising, or use third-party analytics.

3. Who sees your data.

  • People you invite see only that you invited them and the questions about you — never your own results, unless you explicitly share them.
  • People and organisations you share with see exactly the results named in the sharing dialog at the moment you confirm, and you can revoke a share at any time.
  • Processors acting for us: the University of Tartu HPC Center (managed Kubernetes hosting within the University of Tartu network, Estonia), Postmark (transactional email delivery, US — safeguarded by the EU–US Data Privacy Framework and standard contractual clauses), and Cloudflare (bot-protection challenges on public forms). They process data only on our instructions.
  • We disclose data to authorities only where the law requires it.

4. How long we keep it. Your data is kept while your account exists. You can delete your account yourself at any time. Deletion of an account with an email address takes effect after a 30-day grace period during which you can keep your account, after which your account data and results are permanently removed. A private-link account's data and results are deleted immediately. An account whose email address is never confirmed is deleted 30 days after it was created. If it holds questionnaire results, we email you first and do not delete it: no sooner than 7 days after that email we remove your email address, your name and the ability to sign in, and keep your questionnaire answers for the purposes in section 2, without your name or email address. If you later show that the address is yours, we can restore access. Your descriptions of other people survive in aggregated form (they are part of other people's combined results and cannot be traced back to you); the link between those aggregates and your identity is removed. Anonymous sessions expire after 1 year without activity, after which they can no longer be accessed. Access and security logs are kept for up to 2 years.

5. Your rights. You have the right to access the data we hold about you, to correct it, to receive a copy in a portable format, to object to processing based on legitimate interest, to withdraw consent, and to have your data erased. Most of these are available directly in the app (account settings, results download, account deletion); for anything else, email info@personomist.com. You also have the right to complain to a supervisory authority — in Estonia, the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).

6. Cookies and local storage. We use only cookies and browser storage that the service needs to function — there are no analytics, advertising, or cross-site tracking cookies, which is why we do not show a cookie consent banner:

  • session — keeps you signed in (essential).
  • anon_session — lets an anonymous survey run continue and be saved later (essential).
  • demo_return: keeps your own sign-in while you look at an example account, and brings it back when you leave (essential).
  • preferred-language — remembers your chosen language (preference you set).
  • Cloudflare bot-protection cookies (e.g. __cf_bm) — security on public forms (essential).
  • Browser local storage — keeps unfinished survey answers on your device so a reload does not lose them. This data stays on your device; it is no longer used after 24 hours, is removed when you submit, and expired drafts are deleted the next time you open any questionnaire on that device.

7. Children. The service is not directed at children under 16; we do not knowingly process their data.

8. Changes. We will post changes here and, if they are material, notify you by email or by a notice in the service. The effective date above shows the current version.

Questions about this policy or your data: info@personomist.com.