Privacy Policy

• Your answers never leave your device. Scoring happens in your browser and the result is encoded as ten digits in the page URL.
• There is no database of answers and no account, profile or login. The only record kept is one line per purchase, described below.
• While you are taking the test, your progress is saved in your own browser’s local storage and cleared when you finish.
• If you buy the Unflatter Deep Report, your email address is processed so the link to your report can be sent to you.
• One cookie exists: a functional, HttpOnly cookie that remembers this browser has paid. No advertising or tracking cookies are set.
• Nothing is ever sold, rented or used to build a profile of you.

The controller for the processing described here is Benjamin Lipošek, a natural person in Slovenia. For anything in this policy, including a request to exercise your rights, start at support@unflatter.com — we aim to reply within two business days. Purchase and billing data is held by Lemon Squeezy as merchant of record; use the contact details on your receipt for those requests.

Controller

Benjamin Lipošek

Address

Benjamin Lipošek, SloveniaPostal address available on request via the contact page

Privacy contact

support@unflatter.com

Lemon Squeezy is the merchant of record for purchases and acts as an independent controller for the payment itself — it needs your billing data to take the payment, invoice you and account for tax. Its own privacy policy governs that part.

The Unflatter Deep Report is sold through Lemon Squeezy as merchant of record. You enter your email address, billing country and payment details on their checkout; we never see or receive your card number.

After a successful payment, this is what reaches us and what we do with it:

• Your email address, used to send you the link to your report and, if you ask for it later, to send that link again.
• The ten-digit result code the purchase was made for, so the right report is unlocked.
• The order reference from Lemon Squeezy, which is what tells us a payment has already been handled.

Those three things are written to a small purchase ledger — one line per order, holding the order reference, the result code, the time, whether it was refunded, and your email address as a one-way HMAC rather than as text. It does two jobs: payment providers retry their notifications, so the ledger stops you being emailed the same link five times, and it is how a link can be rebuilt later for someone who asks for it again. Because the address is hashed, the file can answer “what did this address buy” but cannot be read as a list of customers or used as a mailing list.

The email itself is handed to an email delivery provider to send. We do not build a mailing list from purchase addresses, and you will not receive marketing from us: the only emails we send are the ones that deliver or resend what you bought.

Like every website, this one is served by infrastructure that records technical request data: IP address, the page requested, the referring page, the browser user agent and a timestamp. These logs exist to keep the service running and to investigate abuse. We do not use them to identify individuals or to build profiles.

To stop a single client hammering checkout, unlock or resend, the server keeps a short lived counter in memory keyed to the requesting IP address. It holds nothing else, and it disappears within minutes and on every restart.

Practical security measures: the site is served over HTTPS, access to a paid report is granted by a cryptographically signed token rather than a guessable identifier, the unlock cookie is HttpOnly so scripts cannot read it, and there is no store of answers to breach in the first place.

If analytics is switched on for this deployment, it is a privacy-preserving, cookieless product (Plausible or Umami) that counts page views and a handful of funnel events — test started, test completed, checkout started, purchase completed. It sets no cookies, stores no identifiers on your device, does not follow you across sites, and produces aggregate counts rather than records about individuals. Your answers, your result code and your email address are never sent to it.

No analytics script is loaded at all unless the deployment has one configured, and we do not use advertising networks, retargeting pixels, session recording or heatmaps.

Unflatter sets exactly one cookie, and only after a purchase. There is no cookie banner because there is nothing to consent to: a strictly necessary cookie that delivers something you asked for does not require consent under the ePrivacy rules, and no other cookie is set.

Name

unflatter_unlock

Purpose

Remembers which reports this browser has paid for

Contents

Result codes with a signature — no personal data

Type

Functional / strictly necessary. First party.

Flags

HttpOnly, SameSite=Lax, path /

Lifetime

One year, or until you clear cookies

Local storage holds the saved test progress described above, on your device only. An unlock cookie left over from before the current name is still honoured until it expires. Deleting cookies and site data for Unflatter removes both, with the only consequence being that a purchased report then needs its emailed link (or the resend page) to open again.

For people in the EU, the EEA and the UK, the GDPR requires a legal basis for each purpose:

• Performance of a contract — processing your email address and payment reference to deliver the report you bought and to resend the link on request.
• Legitimate interests — keeping the site available and secure, preventing abuse and fraud, and understanding aggregate traffic. The interest is running a small service reliably; the impact on you is minimal because none of it identifies you.
• Legal obligation — tax and accounting records connected to sales, which are kept by Lemon Squeezy as the seller of record.

Taking the test needs no legal basis from us at all, because we do not process anything: it happens in your browser.

We use a small number of service providers, listed here so you can see the whole picture. They may process data only on our instructions, or — in the payment provider’s case — as a seller in their own right.

Beyond these, we disclose data only if the law requires it. We do not sell or share personal information for money or for cross-context behavioural advertising, in the sense those terms are used in California and comparable US state laws.

• Answers and results: not retained at all. They exist in your browser and in the link you hold.
• Saved test progress: on your device until you finish the test or clear site data.
• Delivery emails: retained by the email provider for a short period for delivery and troubleshooting, then deleted according to their retention schedule.
• Payment records: held by Lemon Squeezy for as long as tax and accounting law requires, typically several years.
• The purchase ledger: kept while the service runs, so purchases are not delivered twice and links can be re-sent. It holds order references, result codes and hashed email addresses.
• Server logs: kept for a short period by the hosting provider, in line with their standard retention.

Our providers may process data outside your country, including in the United States. Where data leaves the EEA or the UK, the transfer relies on the safeguards those providers put in place — standard contractual clauses, and adequacy decisions where they apply. Their privacy policies, linked above, set out the detail.

Depending on where you live, you have rights over personal data: access to it, correction, deletion, restriction, objection, portability, and the right not to be discriminated against for exercising them. Start at support@unflatter.com and we will deal with it within the statutory deadline, which is one month in the EU and the UK. If your request is about a purchase, include the email you paid with and use the contact details on your Lemon Squeezy receipt as well — they hold the billing record.

If you are unhappy with how we handled a request, you can complain to your data protection authority — in the EU, the authority where you live or work; in the UK, the Information Commissioner’s Office. We would rather you gave us a chance to fix it first.

Unflatter is intended for people aged 16 and over. It is not directed at children, and we do not knowingly process children’s data. If you believe a child has bought a report, tell Lemon Squeezy using the receipt and see support@unflatter.com — we will refund it and remove what little we hold.

When the product changes, this policy changes with it — most likely when a provider is added or replaced. The date at the top always reflects the current version, and material changes will be summarised there rather than slipped in quietly.