Effective date: 12 October 2026 · Version 1.1
This version applies from 12 October 2026. The previous version is archived and available on request.
Effective date: 12 October 2026 Version: 1.1 Previous version: 1.0 (19 September 2026), in force until 12 October 2026 Applies to: mindmatriq.com and all pages, APIs and emails under it (the "Service")
This English version is the legally binding text. Translations are provided for convenience only and do not create separate rights or obligations. See Section 15.
MindMatriq is operated by ABC SM, a registered sole proprietorship (osek murshe) in Israel (the "Operator", "we", "us").
Contact for anything in this Policy: privacy@mindmatriq.com General support: support@mindmatriq.com
We do not offer telephone support.
MindMatriq is a free, web-based test of logical reasoning with a published methodology. It is a self-assessment tool. It is not a medical device, a clinical or psychological assessment, a diagnosis, a screening tool, or a prediction of anything about your health, education or employment.
Because the Service is a test, we necessarily process answers you give during the test. This Policy explains exactly what that involves.
| Data | When | Required? |
|---|---|---|
| Year of birth | Consent screen before the test | Yes, norms are age-based |
| Answers to test items and the time taken for each | During the test | Yes, this is the test |
| Language of the interface | Selected by you or detected from your browser | Yes |
| Email address | Only if you choose to save your result, receive a report, or create a Plus subscription | No |
| Data | Purpose | Detail |
|---|---|---|
anon_id cookie |
Recognise the same browser across a test session and later visits; link a saved result to you | Random identifier; contains no personal details; see Section 6 |
| Country (from IP, country level only) | Statistical norms, language defaults, fraud prevention | We do not store city-level or GPS location |
| Salted hash of your IP address | Abuse and fraud prevention (repeated attempts, bots) | The raw IP is not stored; the hash is kept for 30 days |
| Basic technical data (browser type, screen size, device class) | Making the test render correctly and detecting technical problems | Collected via Cloudflare Web Analytics, which does not use cookies or fingerprinting |
| Measurement conditions of your test session: device class (mobile / tablet / desktop), the size of the browser window, and a one-way hash of your browser's user-agent string | Keeping test conditions comparable between participants, checking whether screen size affects results before statistical norms are built, and improving the product | Stored in our own database and linked to the test session, not to your identity. The raw user-agent string is not stored. These values are not combined into a cross-site profile and are not shared with anyone |
| Product events without personal identifiers (e.g. "test started", "item 12 answered", "report purchased") | Understanding how the Service is used and where people drop off | Linked only to anon_id, never to email unless you saved a result |
Name, surname, exact date of birth, gender identity fields beyond what you may optionally provide in future versions (we will update this Policy first), postal address, phone number, precise geolocation, raw IP address, contacts, photos, or any data from social networks.
We do not build device fingerprints: we do not combine signals to recognise your device across other websites, and nothing we store is shared with advertising or analytics networks. The technical values described in Section 4.2 (device class, browser window size, hashed user-agent) are used only to keep measurement conditions comparable inside this Service.
If you buy a report or subscription, checkout is performed by Paddle.com Market Ltd / Paddle.com Inc. ("Paddle") acting as merchant of record. Paddle collects your payment details, billing country and email under Paddle's own privacy policy (https://www.paddle.com/legal/privacy). We receive from Paddle only: an order reference, the product purchased, the billing country, the email used at checkout, and the status of the transaction (paid / refunded / cancelled). We never receive or store card numbers.
| Purpose | Data used | Legal basis (GDPR / UK GDPR) | Notes for other jurisdictions |
|---|---|---|---|
| Running the test and showing you your result | Year of birth, answers, response times, anon_id, language |
Performance of a contract (Art. 6(1)(b)): the free Terms of Service | LGPD Art. 7 V (contract); Israel PPL: consent on the entry screen |
| Calculating, validating and improving the test's statistical norms (pseudonymised) | Year of birth, country, answers, response times, language | Consent given on the entry screen (Art. 6(1)(a)); alternatively legitimate interest in operating a scientifically valid test (Art. 6(1)(f)) | This is the purpose shown on the consent screen. LGPD Art. 7 I (consent) / IX (legitimate interest) |
| Marking the first 400 completed tests as the "Founders cohort" and granting them the full report free | anon_id, completion order, email if saved |
Performance of a contract / legitimate interest | It is a flag in our records; it does not reveal anything additional about you |
| Keeping test conditions comparable and improving the test | Device class, browser window size, hashed user-agent, response times, language | Legitimate interest (Art. 6(1)(f)) in operating a measurement that is comparable between participants and in fixing what renders badly | The test is visual: the size of a figure on screen is part of how hard an item is, so screen size has to be recorded before norms are built |
| Fraud, abuse and bot prevention | Hashed IP, country, technical data, anon_id |
Legitimate interest (Art. 6(1)(f)) in protecting the Service and the integrity of the norms | 30-day retention |
| Saving your result and emailing it to you | Email, result, anon_id |
Performance of a contract: you asked us to | Transactional email only |
| Sending you the paid report / managing a subscription | Email, order reference, result | Performance of a contract | Paddle is a separate controller for payment |
| Sending you follow-up emails about your result and paid options | Consent (opt-in at the moment you save your result): you can unsubscribe from any email with one click | See Section 9 | |
| Answering your support and privacy requests | Email and the content of your message | Legal obligation (data-subject rights) / legitimate interest | |
| Complying with law, tax and accounting rules | Order references | Legal obligation | Retained per Section 8 |
Where we rely on legitimate interest, we have assessed that the processing is minimal, pseudonymous, expected by users of a test, and does not override your rights. You may object at any time (Section 10).
We use exactly one cookie:
| Name | Type | Lifetime | Purpose |
|---|---|---|---|
anon_id |
Strictly necessary, first-party, HttpOnly, Secure | 13 months | Random identifier that lets the Service recognise the same browser, resume a test, and attach a saved result to you |
Because anon_id is strictly necessary for the Service you requested, consent is not required under the ePrivacy Directive / PECR, and we do not show a cookie banner.
We use no third-party analytics, advertising, social-media or tracking cookies. Cloudflare Web Analytics measures page performance without cookies, local storage or fingerprinting.
You can delete anon_id at any time through your browser settings. Doing so will disconnect that browser from any unsaved result.
We may use localStorage in your browser to remember your interface language and test progress. This stays on your device and is not transmitted to us as a separate data set.
We do not sell personal data and we do not share it with advertisers or data brokers. We use the following providers, each bound by a data-processing agreement:
| Provider | Role | What they process | Location |
|---|---|---|---|
| Cloudflare, Inc. (Workers, D1, R2, KV, Web Analytics) | Hosting, storage, edge network, security | All Service data, including hashed IP for security; raw IP is processed transiently at the network edge by Cloudflare as part of delivering the site | Global network; data at rest in Cloudflare's EU/US regions (see Section 11) |
| Resend, Inc. | Transactional email delivery | Your email address and the content of emails we send you | United States |
| Paddle.com Market Ltd (UK) / Paddle.com Inc. (US) | Merchant of record, independent controller for payment | Payment and billing data | United Kingdom / United States |
Other possible recipients: professional advisers (accountants, lawyers) under confidentiality; public authorities where the law requires; a successor in the event of a merger, sale or reorganisation (you will be notified and this Policy will continue to apply).
| Data | Retention |
|---|---|
| Hashed IP | 30 days |
Test answers, response times, year of birth, country, language (pseudonymous, linked to anon_id) |
For as long as needed to maintain and validate the test norms; if you delete your account/result, the record is anonymised (the link to anon_id and any email is removed) so it can no longer be attributed to you, and the anonymous statistical values are kept |
| Email and saved result | Until you delete it, or 24 months after your last interaction with the Service, whichever is earlier |
| Order references received from Paddle | 7 years after the transaction, for tax and accounting law |
| Support correspondence | 24 months after the case is closed |
| Security and access logs | 30 days |
We do not send third-party advertising.
Depending on where you live you may have some or all of the following rights. We apply them to everyone regardless of location:
How to exercise them. Where you saved your result with an email address, use the self-service links Export my data and Delete my data in the Service (available at /api/me/export and /api/me/delete when logged in via your email link). Otherwise, email privacy@mindmatriq.com from the address you used, or include your anon_id (shown at the bottom of the result page) if you never saved an email. We respond within 30 days (one month under GDPR; 45 days for California residents where allowed; 15 days under LGPD for confirmation of processing). We may ask for proof that the request comes from the person the data belongs to. We do not charge for requests unless they are manifestly excessive.
If you never gave us an email, your data is linked only to a random cookie value. We can act on your request only if you provide that anon_id; without it we have no way to identify which record is yours.
We are established in Israel. Data is stored and processed on Cloudflare's global network and by providers in the United States and the United Kingdom.
Your score is calculated automatically from your answers using our published methodology and compared with age-based norms. This is the Service you requested. It is not an automated decision that produces legal or similarly significant effects: no one, including us, uses it to grant or refuse you anything. Our Terms of Service prohibit using MindMatriq for hiring, employee evaluation, admissions or any other decision about a person.
The Service is intended for people aged 16 or over. We ask for your year of birth before the test and do not allow the test to start if it indicates you are under 16. We do not knowingly collect data from anyone under 16 (under 13 for the purposes of the US COPPA rule, and under 12 for Brazil's LGPD Art. 14). If you believe a child has used the Service, email privacy@mindmatriq.com and we will delete the data.
Controller: ABC SM (Section 1). Legal bases: Section 5. Supervisory authority: you may complain to the authority in your country of residence; a list is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK: Information Commissioner's Office (ico.org.uk). [Representative: see Q1.]
We do not sell or share personal information for cross-context behavioural advertising and we do not use sensitive personal information for purposes other than providing the Service. We honour Global Privacy Control signals as an opt-out where required, although we have nothing to opt out of. You have the rights in Section 10, including the right not to be discriminated against for exercising them. You may use an authorised agent. If we deny a request you may appeal by replying to our response; we will answer the appeal within 45 days. Categories of personal information collected in the last 12 months: identifiers (anon_id, email if provided, hashed IP), demographic data (year of birth, country), internet activity (test interactions), commercial information (purchases via Paddle). Sources: you and your browser. Disclosed for a business purpose to the service providers in Section 7.
This Policy also serves as the notice required under Section 11 of the Protection of Privacy Law, 5741-1981, as amended (Amendment 13, in force 2025). You are not legally obliged to provide any data; the consequence of not providing year of birth is that the test cannot be normed and therefore cannot be taken. Data is held in a database whose owner is ABC SM. You have rights of review and correction under Sections 13–14 of the Law; requests to privacy@mindmatriq.com. Supervisory authority: Privacy Protection Authority (gov.il/ppa).
Controller (controlador): ABC SM. Person in charge (encarregado): [NAME / privacy@mindmatriq.com]. Legal bases per Art. 7 LGPD are listed in Section 5. You have the rights in Art. 18 LGPD, including confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD).
Where these laws apply, ABC SM is the data controller (responsable) and you have rights of access, rectification, cancellation and opposition (ARCO / habeas data). Argentina: Agencia de Acceso a la Información Pública. Mexico: INAI. Colombia: Superintendencia de Industria y Comercio. Chile: Agencia de Protección de Datos Personales (when operational).
Only the free test is available; paid products are not sold in Russia. Data of Russian users is processed as described in this Policy on infrastructure outside Russia.
This Policy is written in English, which is the legally binding version. Where we provide a translation, it is for information only; in case of conflict, the English text prevails, except where the law of your country requires the local-language version to prevail for consumers. [See Q8 for Brazil.]
We may update this Policy. Material changes will be announced on the Service (and by email if you have saved an email with us) at least 14 days before they take effect. The effective date at the top tells you when the current version started to apply. Previous versions are available on request.
Data is encrypted in transit (TLS) and at rest by Cloudflare. Access to production data is limited to the Operator and protected by multi-factor authentication. IP addresses are hashed with a secret salt before storage. We have no employees with data access other than the Operator. In the event of a personal-data breach that is likely to result in a risk to you, we will notify the competent authority within the legally required time (72 hours under GDPR) and, where required, notify you directly.
Privacy requests: privacy@mindmatriq.com Everything else: support@mindmatriq.com Postal address: ABC SM, Yad Lebanim 180, Haifa 3269843, Israel