Privacy Policy

Effective date:

This Privacy Policy describes how Enneagram helper (“we”, “us”, “our”) collects, uses, discloses and protects personal data when you use the Enneagram assessment, website, apps and services at https://enneagram.stuntrocket.co (collectively, the “Service”). This Policy applies in addition to any other privacy notices we may provide in specific contexts.

1. Who we are & contact details

Enneagram helper
Registered in England & Wales.
Registered office:
Company number:
VAT number (if applicable):
Data Protection Officer / Privacy contact: privacy@example.com

You can contact us with any privacy enquiries, or to exercise your rights, via the email above or by post to our registered office.

2. Scope & controller

This Policy applies to all personal data processed in connection with your use of the Service, including when you register, take the assessment, use a paid feature, or when we operate analytics, marketing or team features.

We act as the data controller for all such personal data (unless in some cases you or an organisation you represent is the controller). We determine the purposes and means of processing your data.

3. What data we collect & how

We collect various categories of personal data, either directly from you or automatically. Below is a non-exhaustive list of typical data types and sources.

3.1 Data you provide

• Account registration: name, email address, password (hashed), optional profile info
• Assessment inputs / responses: your answers to questionnaire items
• Payment data: where applicable, transactional metadata (amount, date, user ID). We do not store full credit card numbers if using third-party processors
• Communication & support: messages, emails, feedback or queries you send
• Marketing preferences: whether you opt in to newsletters / updates

3.2 Data collected automatically

• Usage & interaction data: time stamps, pages visited, session duration, navigation paths
• Device & technical metadata: browser type & version, operating system, device identifiers, screen resolution
• IP address and geolocation approximate (city / country)
• Cookies, tracking pixels and similar technologies (see section Cookies & tracking)

4. Legal bases & purposes for processing

We rely on one or more lawful bases under UK GDPR / Data Protection Act 2018 to process your data, including:

• Contractual necessity: to fulfil our agreement with you (e.g. enabling your account, delivering the assessment, providing paid features)
• Legitimate interests: e.g. administering the Service, improving features, detecting abuse, performing analytics, sending non-marketing updates
• Consent: where required (e.g. for marketing emails, optional features, non-essential cookies)
• Compliance / legal obligation: to comply with laws, enforce our Terms, prevent fraud

We use your data for purposes including:

1. Operating and providing the Service
2. Generating and delivering reports, insights, and team dashboards
3. Billing, fraud detection and account management
4. Analytics, testing and service improvements
5. Marketing, newsletters and user communications (if opted in)
6. Legal compliance, safety and security

5. Cookies & tracking

We and third parties use cookies, web beacons, tracking pixels and similar technologies to collect and analyse data about your interactions with the Service.

You will be offered a cookie consent banner / preference centre to accept or decline non-essential cookies. Essential cookies required for the Service’s operation may be used without opt-in.

Typical categories:

• Essential cookies: user session, login, security
• Performance / analytics cookies: to analyse usage, errors, trends
• Functional cookies: to remember settings or preferences
• Advertising / marketing cookies: for remarketing, ad targeting (if applicable)

You can manage or disable cookies through your browser settings or via our cookie consent controls, though disabling some may affect functionality.

6. Sharing & disclosures

We do not sell your personal data. We may share your data with:

• Service providers and processors: e.g. hosting, email providers, payment gateways, analytics platforms (under contract, with security obligations)
• Team / organisation accounts: if you are a member of a paid team, administrators may see aggregated or individual results depending on settings
• Legal / regulatory authorities: when required by law or to comply with a court order
• Business transfers: in connection with a merger, acquisition or sale of assets, provided that your data continues to be protected

We take steps to ensure that any third parties process your data in compliance with this Policy and applicable law.

7. International transfers

Some of our service providers or processors may be located outside the UK or EEA. When we transfer your personal data internationally, we ensure appropriate safeguards, such as:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions under UK law
• Other appropriate technical and organisational measures

We will always aim to minimise cross-border transfers and maintain protections over your data.

8. Data retention & deletion

We retain personal data only as long as necessary for the purposes described or as required by law. Retention durations depend on data type (account data, assessment results, logs, marketing preferences).

After the retention period:

• We may anonymise or aggregate data so it no longer identifies you
• Or securely delete or irreversibly destroy the personal data

If you request deletion or erasure (see section Your rights), we will comply unless we have lawful grounds to retain.

9. Your rights & choices

Under UK GDPR / Data Protection Act, you have rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”): where lawful, request deletion
• Right to restrict processing: request limits on how we use your data
• Right to object: to processing based on legitimate interests (or direct marketing)
• Right to data portability: obtain data in a structured, machine-readable format
• Right to withdraw consent: for processing that’s based on consent

To exercise any of these rights, contact us at privacy@example.com. We may verify your identity for security.

If you are unhappy with our handling of your data, you also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

10. Security & safeguards

We implement technical and organisational security measures to protect your data against unauthorised or accidental access, loss, alteration, disclosure or destruction. Measures include:

• Encryption in transit (TLS)
• Secure server infrastructure and firewalls
• Access controls and role-based permissions
• Regular security testing and audits
• Limiting internal access to those who need it

In the event of a data breach that is likely to result in risk to your rights, we will notify you and relevant supervisory authorities (e.g. ICO) as required by law.

11. AI & algorithmic / model-based outputs

Some parts of the Service — e.g. the scoring, report generation, summarisation or recommendation logic — may use algorithmic or AI processes. While we strive for accuracy, these processes:

• Can make errors or produce unexpected outputs
• May contain or reflect biases inherent in models or training data
• Are for informational and developmental use only

You should interpret algorithmic or AI-driven outputs as guidance, not definitive knowledge. We do not guarantee that these outputs will always be accurate, fair or suitable for your particular context.

12. Minors & children’s data

The Service is intended for users aged 16 and above (or the legal age of digital consent in your country).
We do not knowingly collect or solicit personal data from children younger than 16. If you believe we have collected such data, please contact us to request deletion.

13. Changes to this Policy

We may update this Privacy Policy from time to time (for example, when we change services or adapt to new legal requirements).
We will publish the updated version with a new effective date. Your continued use of the Service after that date indicates your acceptance of the changes.
We may also notify you (e.g. via email) in the case of significant changes.

14. Links to other websites

The Service may contain links to third-party websites or embed external content. This Policy does not apply to those other websites. You should review the privacy policies of any linked site before submitting data.

15. General

• Third-party policies. Our Policy does not cover how third parties (e.g. advertisers, analytics) handle your data—check their policies.
• Severability. If any part of this Policy is held invalid, the rest remains in force.
• Assignment. You may not assign your rights under this Policy. We may assign ours in connection with corporate transactions.
• Governing law. This Policy is governed by and construed under the laws of England & Wales. Disputes fall under the exclusive jurisdiction of the English courts.

Questions or requests?
Contact us: privacy@example.com
Or by mail: ****

© 2026 Enneagram helper. All rights reserved.