Last updated 5 November 2026

Privacy Policy

This policy explains how your personal data is processed on this site, in line with the EU General Data Protection Regulation (GDPR), the Italian Privacy Code (D.lgs. 196/2003 as amended by D.lgs. 101/2018), the EU AI Act and Italian Law 132/2025 on artificial intelligence.

1. Controller

[LEGAL NAME / DITTA], [REGISTERED ADDRESS], Italy. VAT [PARTITA IVA]. Email [CONTACT EMAIL]. PEC [PEC, if any]. No Data Protection Officer has been appointed, as one is not required for this processing.

2. What we collect

• Account: email address, sign-in times, age confirmation.
• Tests: your answers, the results calculated from them, and reports generated from them.
• Observations you enter about other people (subscriber features): the indicators you mark. Do not enter names, contact details or other identifying information about another person.
• Consent records: what you agreed to, which version, and when.
• Purchases: what you bought, when, order reference and status. Card and billing details are collected by our payment provider; we never see your card number.
• Referrals: who invited whom, for crediting bonuses.
• Technical data: session cookies, IP address and logs needed to run and secure the site.

3. Sensitive data and explicit consent

Some questions concern your relationships, attraction and intimate life. Answers may count as data concerning sex life, a special category under Article 9 GDPR. We process them only on the basis of your explicit consent, given separately before each test (Art. 9(2)(a)), and only to calculate, generate and store your results. You can withdraw consent at any time by deleting your data in your account; withdrawal does not affect processing already carried out. We do not derive health information or any diagnosis from your answers.

4. Purposes and legal bases

• Account, tests, reports, storage in your account — contract (Art. 6(1)(b)) and explicit consent for answers (Art. 9(2)(a)).
• Payments, invoicing and tax — legal obligation (Art. 6(1)(c)).
• Emails about new tests, offers and the book — consent (Art. 6(1)(a)), only if you switch them on. Every email contains an unsubscribe link.
• Referral programme — contract (Art. 6(1)(b)).
• Security, fraud and abuse prevention, defending legal claims — legitimate interest (Art. 6(1)(f)).

5. Automated processing and AI

Your result is calculated automatically from your answers using the scoring rules published in The Leak. Full reports are written with the help of an AI model, which receives your scored result, the relevant answers and excerpts of the book — never your email or name. This produces no legal or similarly significant effect on you, so Article 22 GDPR does not apply; you can nonetheless ask us to explain how a result was produced. You are always told when content is AI-generated (Art. 50 EU AI Act). We do not use your data to train AI models, and our AI provider is contractually barred from doing so. We do not sell or rent your data and do not use it for advertising profiles.

6. Recipients and processors

• Supabase Inc. — database and authentication; data stored in the EU (Frankfurt).
• Vercel Inc. — website hosting and delivery.
• Anthropic PBC — AI generation of reports.
• Our payment provider, acting as merchant of record — checkout, payment, VAT and invoicing. For purchases it is an independent controller under its own privacy policy.
• Our email delivery provider — sign-in codes and emails you opted into.

If you choose “Show Irina my result”, your 40 Identity Code answers (and nothing else) are sent once to the Irina Voss chat service on Fanvue, operated by the same controller, when you paste the one-time code there. That service asks for its own consent and applies its own subscriber privacy notice.

All processors are bound by data processing agreements under Art. 28 GDPR. Where data is transferred outside the EEA (e.g. to the USA), transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. You can request a copy of the safeguards.

7. Retention

• Answers, results, reports and observations — until you delete them or close your account.
• Consent records — as long as the related data is processed, then deleted with it.
• Purchase and tax records — 10 years, as required by Italian law (art. 2220 Civil Code).
• Security logs — up to 90 days.
• Inactive accounts — deleted after 24 months without sign-in, after a reminder email.

8. Your rights

You have the right to access, rectify, erase, restrict, port and object to processing, and to withdraw consent at any time (Arts. 15–21 GDPR). You can delete answers and results yourself in your account. For anything else, including closing your account or exporting your data, write to [CONTACT EMAIL]; we reply within one month. You can lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) or the authority of your EU country of residence.

9. Age

The site is for adults aged 18 and over. We do not knowingly process data of minors; if we learn that an account belongs to a minor, we delete it.

10. Cookies and local storage

We use only technical cookies strictly necessary to keep you signed in and to secure the site, which do not require consent (art. 122 Italian Privacy Code; Garante guidelines of 10 June 2021). Answers to a test in progress are kept in your browser's local storage so you do not lose them, and are removed when you submit. We use no analytics, advertising or tracking cookies. If this changes, we will ask for your consent first.

11. Security

Data is encrypted in transit and at rest, access is restricted per user at database level, and staff access is limited to what is needed to operate the service.

12. Changes

We will publish any changes on this page and, for material changes, notify you by email.