Privacy Policy

1. Controller

Tricellix OÜ is the controller of your personal data. Contact: privacy@tricellix.com (or contact@tricellix.com).

2. What we collect

• Account data: email, name (optional), password hash, sign-in provider, email-verification state, account tier and purchases.
• Assessment data (Human Intelligence Profile): your answers to questionnaires, timing and interaction data from cognitive tasks (used for scoring and to detect invalid attempts), the scores and generated reports, and — if you tell us — your reason for taking the assessment.
• Commission data: the subject, requirements, contact details and any documents or survey answers you give us for a commissioned report.
• Contact and newsletter data: what you type into the contact form, your email for briefings, and the source of the sign-up.
• Usage and security data: server logs (IP address, user agent, pages requested, error references), rate-limit counters, bot-check results, audit records of administrative actions, and acceptance records for our legal documents (which version, when, from which IP).
• Payment data: order amounts, invoice references and the status of payments. Card details are entered on our payment provider's pages and never reach our servers.

3. Why we process it and on what basis

• To provide what you asked for — an account, an assessment, a report, a course, a subscription (performance of a contract).
• To keep the Platform secure and honest — bot checks, rate limits, anti-cheat checks on assessments, audit logs (legitimate interest in security and integrity).
• To bill, invoice, keep accounts and comply with tax and anti-fraud obligations (legal obligation).
• To send transactional emails — verification links, receipts, delivery notices, order updates (contract). To send briefings only when you subscribed, and every briefing carries an unsubscribe link (consent).
• To improve the assessments: aggregate, non-identifying statistics on scale distributions and reliability are computed from completed profiles (legitimate interest; no individual is identifiable in the output).

4. Automated generation and the use of AI

Several outputs are produced with a large language model operated by Anthropic (Claude): the narrative sections of your profile and master report, scenario scoring in the cognitive assessment, narratives in reports and dossiers, and draft insights. To produce them we send the model the data it needs — for a profile that includes your questionnaire scores and your written answers; for a commission it includes the subject and your requirements. We instruct the provider not to train on this data, and the provider processes it under its commercial terms and data-processing agreement. We do not send your email, name or payment details to the model unless they are part of the text you asked us to analyse.

You can take the free assessment without any narrative being generated; narratives are produced when you unlock a tier or request them. Profile results are indicative and are not used by us to make automated decisions with legal or similar effect about you.

5. Who processes data for us

• Supabase (database, authentication, file storage) — EU-hosted project.
• Vercel (web hosting and edge network) and Fly.io (background processing worker).
• Anthropic (language-model generation, as described above).
• Resend (transactional email delivery).
• Cloudflare Turnstile (bot check on the free assessment; it may set a cookie in its own iframe).
• Our payment provider (Paddle, as merchant of record for card payments) and our bank for transfer and invoice payments.

Each provider acts on our documented instructions under a data-processing agreement. Some are located outside the European Economic Area; transfers rely on the European Commission's standard contractual clauses or an adequacy decision. We do not sell personal data and we do not share it with advertisers.

6. Cookies

We set only cookies that are necessary to run the service: authentication session cookies, a theme-preference cookie and, on the free assessment, the bot-check cookie. We do not currently run third-party analytics or advertising cookies. If that changes, this policy and a consent notice will be updated first.

7. How long we keep data

• Account, purchase and invoice records: for the life of the account and then for as long as tax and accounting law requires (seven years in Estonia).
• Assessment answers and profiles: for the life of the account. Anonymous sessions that never add an email are deleted after 30 days.
• Commission inputs and deliverables: for the engagement plus three years, unless the NDA sets a different period.
• Contact-form messages: 24 months. Newsletter subscription: until you unsubscribe.
• Server and security logs: 90 days. Legal-acceptance records: for as long as the related purchase record exists.

8. Your rights

You can ask for a copy of your data, correct it, have it deleted, restrict or object to processing, and receive the data you gave us in a portable format. You can withdraw consent (for briefings) at any time. Write to privacy@tricellix.com; we respond within one month. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to your local supervisory authority.

Deleting your account removes your profile, answers and generated reports; invoices and the minimal purchase record are retained under the accounting obligation above.

9. Security

Data is encrypted in transit; passwords are hashed; access to production systems is limited to the operator and logged; administrative actions are audited; premium data is served through gated, rate-limited endpoints. No system is perfectly secure — if we learn of a breach affecting you we will notify you and the supervisory authority as the law requires.

10. Children

The Platform is for adults. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

11. Changes

We will post the new version here with a new effective date and, for material changes, email account holders.