Legal
Privacy Policy
The short version.
We keep your test answers, your first name and your email address. We use them to produce your report, to send it to you, and to answer you if you write to us. We also measure how many people visit the site and which pages they read. We do not sell your data and we do not use it for advertising. You can ask us to delete everything at any time, and we will.
The rest of this page is the detail required by data protection law.
1. Who is the controller
The controller of your personal data is:
FUTURE FIRST ALEKSANDRA GAWĘDA SPÓŁKA KOMANDYTOWA
ul. Chmielna 2 / 31, 00-020 Warszawa, Poland
KRS: 0001242611
NIP: 5253091030
REGON: 544815459
Email: contact@owngrain.com
We have not appointed a Data Protection Officer. For any data protection matter, write to the address above.
2. What data we collect
2.1. Data you give us
- Test answers - your responses to the 50 questionnaire items, and the profile calculated from them.
- First name - used on the report and in emails to you.
- Email address - used to deliver access to the report and to correspond with you.
- Correspondence - the content of messages you send us.
2.2. Data collected automatically
- Technical data - IP address, browser and device type, referring page, timestamps. This is standard server log data.
- Local storage - your answers are held in your own browser while you take the test, before anything is sent to us.
2.3. Payment data
We do not collect or store card details. Payments are handled entirely by Stripe. We receive only confirmation that a payment succeeded, along with the transaction identifier and the email used.
A note on the nature of the answers. The questionnaire asks about how you work - how often you do certain things, and how they leave you feeling afterwards. It does not ask about health, diagnoses, treatment, beliefs, origin, or sexual life, and it is not designed to reveal them. We therefore do not treat your answers as special category data under Article 9 GDPR. We do recognise that they are personal and can feel private, and we handle them accordingly.
3. Why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running the test and calculating your free summary | Test answers | Art. 6(1)(b) - steps taken at your request before a contract |
| Producing and delivering the paid report | Answers, first name, email | Art. 6(1)(b) - performance of a contract |
| Processing your payment | Email, transaction data | Art. 6(1)(b) - performance of a contract |
| Accounting and tax records | Transaction data | Art. 6(1)(c) - legal obligation |
| Answering your messages and handling complaints | Correspondence, email | Art. 6(1)(b) and 6(1)(f) - legitimate interest in responding |
| Measuring traffic and how the site is used | Page views, referring source, approximate location, device and browser type | Art. 6(1)(a) - your consent, where analytics cookies are used; otherwise Art. 6(1)(f) - legitimate interest in knowing whether the site works |
| Security, abuse prevention, diagnostics | Technical data | Art. 6(1)(f) - legitimate interest in a secure service |
| Establishing or defending legal claims | As necessary | Art. 6(1)(f) - legitimate interest |
| Improving the methodology and building reference norms | Anonymised answers only | Art. 6(1)(a) - your separate, optional consent |
The last purpose is optional and separate. It is never a condition of taking the test or of receiving your report. If you consent, your answers are stripped of name, email and any identifier before being used, and cannot afterwards be linked back to you. You may withdraw consent at any time, with effect for the future.
4. Profiling and automated decisions
Producing your report involves profiling within the meaning of Art. 4(4) GDPR: an algorithm evaluates your answers and describes patterns in how you work.
It is not automated decision-making producing legal or similarly significant effects under Art. 22 GDPR. The result is a description delivered to you. It does not determine access to any service, price, employment or entitlement, and we never share it with employers or third parties.
The logic is straightforward and we state it plainly: each pattern receives two values - how often you reported the behaviour relative to your other answers, and how the corresponding work leaves you feeling. Those two values place each pattern in one of four zones. The report explains this in its methodology section.
5. Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing. We use the following processors, each under a data processing agreement:
| Processor | Purpose | Data |
|---|---|---|
| Stripe | Payment processing | Email, transaction data. Card details go to Stripe directly and never reach us. |
| Supabase | Database and application backend | Answers, result, first name, email |
| Vercel | Hosting and delivery of the website | Technical data, server logs |
| Resend | Transactional email | First name, email, message content |
| DataFast | Website analytics | Page views, referring source, approximate location, device and browser type. No test answers and no email address are ever sent to it. |
We may also disclose data to public authorities where we are legally required to do so.
6. Transfers outside the EEA
Some processors listed above are established in, or process data in, the United States. Where personal data is transferred outside the European Economic Area, the transfer is based on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one applies to that recipient.
You may request a copy of the safeguards applied by writing tocontact@owngrain.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Answers to a test that was never purchased | 90 days, then deleted |
| Answers and result behind a purchased report | 24 months from purchase, so you can retake and compare - then anonymised |
| The report itself | For as long as you want access to it, unless you ask us to delete it |
| Name and email | As above, deleted together with the account data |
| Accounting records | 5 years from the end of the tax year, as required by law |
| Correspondence | 24 months from the last message |
| Server logs | 12 months |
| Anonymised answers used for norms | Indefinitely - no longer personal data |
8. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy;
- rectify data that is inaccurate;
- erase your data, where one of the grounds in Art. 17 applies;
- restrict processing in the circumstances set out in Art. 18;
- data portability - receive your data in a structured, machine readable format;
- object to processing based on legitimate interest;
- withdraw consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out beforehand.
To exercise any of these, write tocontact@owngrain.com. We respond within30 days. Deletion means deletion - not deactivation - subject only to records we are legally required to keep, such as invoices.
9. Cookies and local storage
We do not use advertising cookies, and we do not run any tracking that follows you across other websites. Nobody buys or receives your data for their own marketing.
9.1. What is strictly necessary
- Local storage - holds your answers in your own browser while you take the test, so you can stop and come back. This never leaves your device until you choose to purchase.
- Session data - identifies your purchase so the report can be shown to you.
- Stripe - sets its own cookies on the payment page, required for fraud prevention. Those are governed by Stripe's privacy policy.
None of the above requires your consent, because without it the service cannot work.
9.2. Analytics
We use DataFast to count visits and see which pages people read. It tells us how many people arrived, where from, and where they stopped. It is never connected to your test answers, your name or your email address, and we never use it to build a profile of you as an individual.
DataFast can run in two modes, and the mode we use is stated here honestly:
- Cookieless mode - no cookies are set. Visitors are counted using short-lived server-side identifiers that rotate roughly every 24 hours. Because nothing is stored on your device, no consent is required.
- Standard mode - a cookie is set so that a returning visitor is recognised across days. This is not strictly necessary for the site to work, so it is only used after you agree to it, and you can decline without losing access to anything.
Whichever mode is in use, you can block analytics entirely with your browser's do-not-track or tracking-protection settings, or with any content blocker. Nothing on this site stops working if you do.
10. Security
We apply measures appropriate to the risk, including:
- encryption in transit (TLS) and at rest;
- access to personal data limited to those who need it;
- row-level access rules in the database, so one user's data is not reachable from another user's session;
- report access granted through unguessable tokens rather than sequential identifiers;
- no storage of payment card data at any point.
Should a personal data breach occur that is likely to result in a high risk to your rights, we will notify you without undue delay, and the supervisory authority within 72 hours.
11. Children
The Service is not intended for people under 16. We do not knowingly collect their data. If you believe a child has provided us with personal data, write to us and we will delete it.
12. Changes
We may update this policy. The current version is always published here with its date and version number. Where a change materially affects how we process your data, we will notify holders of a report by email before it takes effect.
13. Contact and complaints
For any question about this policy or your data, write tocontact@owngrain.com.
You also have the right to lodge a complaint with a supervisory authority - in Poland:
If you live in another EU country, you may also complain to your local supervisory authority.