Privacy Policy

• Your answers never leave your device. Scoring happens in your browser and the result is encoded as ten digits in the page URL.
• There is no database of your individual test answers and no account, profile or login. Paid purchases create the limited delivery record described below.
• While you are taking the test, your progress is saved in your own browser’s local storage and cleared when you finish.
• If you buy the Unflatter Deep Report, your email address is processed so the link to your report can be sent to you.
• One cookie exists: a functional, HttpOnly cookie that remembers this browser has paid. No advertising or analytics cookies are set.
• Nothing is ever sold, rented or used to build a profile of you.

The controller for the processing described here is Unflatter operator, a natural person in Slovenia. For anything in this policy, including a request to exercise your rights, start at support@unflatter.com — we aim to reply within two business days. Purchase and billing data is held by Lemon Squeezy as merchant of record; use the contact details on your receipt for those requests.

Controller

Unflatter operator

Address

SloveniaPostal address available on request via the contact page

Privacy contact

support@unflatter.com

Lemon Squeezy is the merchant of record for purchases and acts as an independent controller for the payment itself — it needs your billing data to take the payment, invoice you and account for tax. Its own privacy policy governs that part.

The Unflatter Deep Report is sold through Lemon Squeezy as merchant of record. You enter your email address, billing country and payment details on their checkout; we never see or receive your card number.

After a successful payment, this is what reaches us and what we do with it:

• Your email address, used to send you the link to your report and, if you ask for it later, to send that link again.
• The ten-digit result code the purchase was made for, so the right report is unlocked.
• The order reference from Lemon Squeezy, which is what tells us a payment has already been handled.

A purchase record is stored in a dedicated Supabase database. It contains the order reference, result code, delivery and refund status, a one-way HMAC derived from your email address, and the frozen content of the report-delivery email so a failed webhook can be retried without generating a different access link. The recipient address itself is not stored in that ledger. It is supplied again by the signed payment notification when a delivery retry is needed.

Your email address is still processed by the payment provider and by Resend when the report is sent. We do not use purchase addresses to build a mailing list or send marketing: transactional delivery, recovery and support are the only purposes.

Like every website, this one is served by infrastructure that records technical request data: IP address, the page requested, the referring page, the browser user agent and a timestamp. These logs exist to keep the service running and to investigate abuse. We do not use them to identify individuals or to build profiles.

To stop a single client hammering checkout, unlock or resend, the server keeps a short lived counter in memory keyed to the requesting IP address. It holds nothing else, and it disappears within minutes and on every restart.

Practical security measures: the site is served over HTTPS, access to a paid report is granted by a cryptographically signed token rather than a guessable identifier, the unlock cookie is HttpOnly so scripts cannot read it, and there is no store of answers to breach in the first place.

We use PostHog to understand aggregate traffic and the product funnel: page views, test started, test completed, report preview opened, checkout requested, checkout started, checkout failures, completed purchases and refunds. PostHog runs in cookieless mode: analytics does not write cookies, local storage or session storage. Audience continuity is handled by PostHog using its privacy-preserving cookieless server-hash mode.

Analytics receives only a sanitized page path, referral or UTM campaign information when present, and the funnel events above. Query strings are deliberately removed before analytics is sent because result and paid-report links contain private codes. Your answers, five scores, result code, report access token and email address are never sent to PostHog. IP collection is disabled at the PostHog project level.

We have disabled PostHog autocapture, session recording, heatmaps, browser console capture, performance capture and automatic web-vitals collection. There are no advertising pixels and no cross-site behavioural advertising.

Unflatter sets exactly one cookie, and only after a purchase. There is no cookie banner because there is nothing to consent to: a strictly necessary cookie that delivers something you asked for does not require consent under the ePrivacy rules, and no other cookie is set.

Name

unflatter_unlock

Purpose

Remembers which reports this browser has paid for

Contents

Result codes with a signature — no personal data

Type

Functional / strictly necessary. First party.

Flags

HttpOnly, SameSite=Lax, path /

Lifetime

One year, or until you clear cookies

Local storage holds only the saved test progress described above. Analytics does not use cookies, local storage or session storage. An unlock cookie left over from before the current name is still honoured until it expires. Deleting cookies and site data forUnflatter removes the browser-side product values, with the only consequence being that a purchased report then needs its emailed link (or the resend page) to open again.

For people in the EU, the EEA and the UK, the GDPR requires a legal basis for each purpose:

• Performance of a contract — processing your email address and payment reference to deliver the report you bought and to resend the link on request.
• Legitimate interests — keeping the site available and secure, preventing abuse and fraud, and understanding aggregate traffic. The interest is running a small service reliably; the impact on you is minimal because none of it identifies you.
• Legal obligation — tax and accounting records connected to sales, which are kept by Lemon Squeezy as the seller of record.

Taking the test needs no legal basis from us at all, because we do not process anything: it happens in your browser.

We use a small number of service providers, listed here so you can see the whole picture. They may process data only on our instructions, or — in the payment provider’s case — as a seller in their own right.

Beyond these, we disclose data only if the law requires it. We do not sell or share personal information for money or for cross-context behavioural advertising, in the sense those terms are used in California and comparable US state laws.

• Answers and results: not retained at all. They exist in your browser and in the link you hold.
• Saved test progress: on your device until you finish the test or clear site data.
• Delivery emails: retained by the email provider for a short period for delivery and troubleshooting, then deleted according to their retention schedule.
• Payment records: held by Lemon Squeezy for as long as tax and accounting law requires, typically several years.
• The purchase ledger: kept while needed to deliver and recover paid reports, prevent duplicate fulfilment, handle refunds and resolve support issues. It contains order references, result codes, one-way email keys, delivery state and the frozen delivery-email content without the recipient address. There is no automatic marketing use of this record.
• Server logs: kept for a short period by the hosting provider, in line with their standard retention.

Our providers may process data outside your country, including in the United States. Where data leaves the EEA or the UK, the transfer relies on the safeguards those providers put in place — standard contractual clauses, and adequacy decisions where they apply. Their privacy policies, linked above, set out the detail.

Depending on where you live, you have rights over personal data: access to it, correction, deletion, restriction, objection, portability, and the right not to be discriminated against for exercising them. Start at support@unflatter.com and we will deal with it within the statutory deadline, which is one month in the EU and the UK. If your request is about a purchase, include the email you paid with and use the contact details on your Lemon Squeezy receipt as well — they hold the billing record.

If you are unhappy with how we handled a request, you can complain to your data protection authority — in the EU, the authority where you live or work; in the UK, the Information Commissioner’s Office. We would rather you gave us a chance to fix it first.

Unflatter is intended for people aged 16 and over. It is not directed at children, and we do not knowingly process children’s data. If you believe a child has bought a report, tell Lemon Squeezy using the receipt and see support@unflatter.com — we will refund it and remove what little we hold.

When the product changes, this policy changes with it — most likely when a provider is added or replaced. The date at the top always reflects the current version, and material changes will be summarised there rather than slipped in quietly.