Privacy Policy

Beyond Persona ("BP", "we") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights. It applies to the Service at beyondpersona.ai.

This policy aims to comply with GDPR (EU), CCPA / state privacy laws (US), and applicable international privacy regulations.

1. Information We Collect

Category	Data	Source
Account	Email address, third-party account UID, display name	OAuth at sign-in (currently Google; additional providers may be added)
Assessment	288 item responses (7-point Likert), 36-axis scores, archetype matches	Your input during the assessment
AI chat	Persona chat messages (Plus and Max tiers only)	Your input during chat sessions
Payment	Transaction ID, amount, currency, tier purchased. We do not store card numbers; Paddle handles all payment data.	Paddle.com Merchant of Record
Technical	Browser type, language preference, approximate region (from IP), device type	Standard web logs
Anonymized analytics	Page views, session duration, feature usage. No personally identifiable information.	Firebase Analytics (anonymous identifiers only — required for service quality and statistical integrity)

2. How We Use Your Information

• Service delivery — Generate your personality analysis, AI essays, and persona chat responses
• Account management — Authentication, purchase processing, customer support
• Service improvement — Statistical analysis (in anonymized form) to refine the 36-axis model and AI prompts
• Communications — Transactional emails only (purchase receipts, account notices). No marketing emails without your explicit consent.
• Legal compliance — Tax reporting, regulatory requests, fraud prevention

3. Legal Basis (GDPR)

• Contract — Processing necessary to deliver the Service you purchased
• Legitimate interests — Service security, fraud prevention, anonymized statistical analysis (which contains no PII and is required for service quality monitoring)
• Legal obligation — Tax records, regulatory compliance
• Consent — For any future marketing communications (opt-in only)

4. Third Parties We Share With

Recipient	Purpose	Location
Google LLC (Firebase, Gemini)	Hosting, authentication, AI inference	USA (with EU Standard Contractual Clauses)
Anthropic, PBC (Claude)	AI inference for content development and tooling	USA (with EU Standard Contractual Clauses)
Paddle.com Inc.	Payment processing, VAT compliance, refund handling (Merchant of Record)	USA / UK / Germany
Cloudflare, Inc.	DNS, email routing	USA (global edge network)

We do not sell or rent your personal information to third parties for marketing purposes.

5. International Data Transfers

Your data may be processed in countries other than your country of residence, primarily the United States. For EU residents, we rely on the EU Standard Contractual Clauses to ensure adequate protection.

6. Data Retention

• Account and assessment data — Deleted immediately upon account deletion request.
• Payment records — Retained as required by applicable tax and accounting law.
• Anonymized analytics — Retained indefinitely in aggregated form (contains no PII).
• Backup data — Backups are managed by Google Cloud Firestore at standard retention (typically up to 7 days, after which they are automatically purged).

7. Your Rights

Depending on your jurisdiction, you have the following rights:

Right	Description
Access	Request a copy of all personal data we hold about you
Rectification	Correct inaccurate information
Deletion	Request deletion of your account and associated data ("right to be forgotten")
Portability	Receive your data in a machine-readable format. Your in-app report functionality also provides a downloadable view of your results.
Lodge complaint	File a complaint with your local data protection authority

To exercise these rights, email support@beyondpersona.ai. We will respond within a reasonable timeframe as required by applicable law.

8. US State Privacy Rights

Residents of certain US states (including but not limited to California, Virginia, Colorado, Connecticut, and Utah) have specific rights under applicable state privacy laws, including the right to know what personal information is collected, the right to request deletion, the right to opt out of any "sale" of personal information (we do not sell personal information), and the right to non-discrimination for exercising these rights. To exercise these rights, contact support@beyondpersona.ai.

9. Children's Privacy

The Service is not directed to children under 14. We do not knowingly collect personal information from children under 14. Users between 14 and 17 are considered minors and require parental or guardian consent to use the Service. If you believe a child under 14 has provided us with personal information, please contact us for prompt deletion.

10. Security

• All data in transit is encrypted via TLS 1.2+ (HTTPS)
• Data at rest in Firebase Firestore is encrypted by Google Cloud (AES-256)
• Authentication via third-party OAuth (no password storage by BP)
• Access to user data is restricted to authorized personnel only
• Regular security reviews and dependency updates

11. Cookies

BP uses essential cookies for authentication and session management. We also use anonymized analytics cookies that contain no personally identifiable information. We do not use third-party advertising cookies.

12. Changes to This Policy

Material changes will be communicated by email and posted on this page at least 10 business days in advance. The "Last updated" date at the top of this policy indicates the most recent version.

13. Contact

For privacy questions, requests, or to exercise your rights, email support@beyondpersona.ai.