Privacy Policy

01. Definitions and Key Terms

1.1 Company and Service Terms

• TrueWit, operated by CUTECALL GLOBAL LIMITED ("we," "us," or "our")
• Service: All features, programs, and content available through TrueWit
• Platform: The TrueWit website and mobile application, together with the related services.
• User: Any individual accessing or using our services ("you" or "your")

1.2 Data and Privacy Terms

• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data
• Data Controller: CUTECALL GLOBAL LIMITED, trading as TrueWit.
• Billing Entity / Merchant of Record: CUTECALL GLOBAL LIMITED, trading as TrueWit.
• Data Processor: Third parties that process personal data on our behalf
• Cookies and Similar Technologies: Browser cookies, local app storage, and advertising identifiers stored on your device. We obtain consent where required. Advertising identifiers include Apple's Identifier for Advertisers (IDFA) on iOS/iPadOS and Google's advertising ID on Android.

1.3 Security Terms

• Authentication: Process of verifying user identity
• Encryption: Process of encoding information to prevent unauthorized access
• Token: Unique identifier used for secure authentication
• SSL/TLS: Security protocols for encrypted data transmission

02. Introduction and Scope

2.1 Policy Overview

This Privacy Policy explains how TrueWit collects, uses, and protects your personal data and how you can exercise your privacy rights.

2.2 Policy Application

This policy applies to:

• All users of TrueWit globally, including users of our website and mobile applications on iOS, iPadOS, and Android
• All data collection methods
• All service features
• All platform versions and updates

2.3 Policy Updates

• We reserve the right to update this policy
• We will notify you of material changes by email
• Where required by applicable law, we will obtain your consent before introducing changes to processing that require your consent.

03. Personal Data Collection

3.1 Account Information

A. Essential Data

• Email address (required for authentication)
• Name (collected during payment processing)
• Last sign-in timestamp
• Unique account identifiers
• IP addresses

B. Optional Data

• Phone number (if provided through payment processors)
• User preferences and settings
• Communication preferences

3.2 Service Usage Data

A. Test Results

• Individual quiz answers and the option selected for each question
• Time spent on each question
• Final IQ scores
• Completion timestamps
• Performance metrics

We store your quiz answers and the time spent on each question to calculate and display your results, provide support, and improve the quiz. We retain this data while your account is active. See Section 8 for retention details.

B. Interaction Data

• Features accessed
• Time spent on platform
• Navigation patterns
• Device information

3.3 Payment Information

Website payments processed through Stripe are handled by a PCI-DSS Level 1 certified payment provider. Your full credit/debit card number, CVV, and other sensitive payment details are never transmitted to, processed by, or stored on our servers. Stripe acts as a Data Processor when processing payments on our behalf and as a Data Controller for processing whose purposes and means it determines independently, as described in Stripe's Privacy Policy.

We only receive and store the following limited payment information from Stripe:

• Tokenized payment method identifiers (Stripe tokens, not actual card numbers)
• Last four digits of payment cards (for display and support purposes)
• First six digits of payment cards (BIN, for fraud prevention)
• Card expiration dates
• Card brand (e.g., Visa, Mastercard)
• Billing name and country associated with the payment method

App-store purchases are processed by Apple App Store on iOS/iPadOS or Google Play on Android under the relevant store's privacy policy. TrueWit uses the purchase and subscription information made available by the store to verify purchases and manage your access. The stores handle your full payment credentials; these are not provided to TrueWit.

For website purchases, you authorize Stripe to store your payment method securely for processing recurring subscription charges. For more information on how Stripe handles your data, please see Stripe's Privacy Policy.

3.4 Technical and Device Data

• Operating system and version
• App version and build
• Device screen size
• Device type and model
• Language preferences
• IP address and geographic location
• Time zone settings

04. Data Processing and Usage

4.1 Primary Processing Purposes

A. Service Provision

• Account creation and management
• Authentication and security
• Feature access and customization
• Customer support
• Service optimization

B. Payment Processing

• Subscription management
• Payment authorization
• Fraud prevention
• Transaction records
• Billing support

4.2 Legal Bases for Processing

• Contractual Necessity: Account management, service provision, payment processing
• Legal Obligations: Tax compliance, financial records, regulatory compliance
• Legitimate Interests: Using operational service data to improve the Service, prevent fraud, and maintain security, where these interests are not overridden by your rights and freedoms. This does not cover analytics or advertising tracking that requires consent.
• Consent-Based Processing: Marketing communications, optional features that require consent, and non-essential analytics and advertising tracking where consent is required. Consent is obtained separately; accepting the Terms or reading this Privacy Policy does not constitute consent to these activities. You may withdraw consent by contacting us using Section 12; for website tracking, you may also use our cookie consent controls, and for app tracking, the controls in Section 6.3.

05. Data Storage and Security

5.1 Storage Location

• All personal data is stored in secure data centers
• Data is transmitted globally using encrypted channels
• We employ appropriate safeguards for international data transfers
• We monitor compliance and maintain security measures

5.2 Security Measures

• TLS encryption for data in transit
• PCI DSS-compliant payment processing through the payment provider; this does not mean that the entire TrueWit product is PCI DSS certified

5.3 Data Breach Notification

In the event of a personal data breach, we will meet the notification requirements of applicable law. Where the GDPR applies, we will:

• Notify affected users without undue delay when the breach is likely to result in a high risk to their rights and freedoms, subject to the exceptions provided by law
• Describe the incident and the types of data affected
• Explain steps we've taken to address the breach
• Recommend user actions
• Notify the relevant supervisory authority of a reportable breach without undue delay and, where feasible, within 72 hours of becoming aware of it. This period is not postponed until our internal investigation is complete

06. Analytics, Advertising, and Third-Party Services

6.1 Third-Party Service Providers

We share personal data with the service providers listed below. A provider acts as a Data Processor when it processes data on our behalf and follows our instructions. It acts as a Data Controller when it determines why and how data is processed. Its role depends on the activity. Apple App Store and Google Play process payments under their own privacy policies. Section 3.3 explains how TrueWit uses the purchase and subscription information provided by these stores.

A. Payment Processing

• Stripe, Inc. (United States): Payment processing, subscription management, fraud prevention. Data shared: email, name, payment method details, IP address, transaction history. Stripe is PCI-DSS Level 1 certified. It acts as a processor for payment processing on our behalf and may act as an independent controller for its own processing, as described in its Privacy Policy. Stripe Privacy Policy

B. Email and Communications

• Brevo (Sendinblue) (France/EU): Transactional and marketing email delivery. Data shared: email address, name, language preference, subscription status. Brevo Privacy Policy

C. Analytics and Advertising

• Google Analytics (United States): User behavior analysis, service optimization, traffic measurement. Data shared: anonymized IP address, device information, browsing activity, referral sources. Google Privacy Policy
• Meta (Facebook) Pixel (United States): Advertising performance measurement, conversion tracking, audience targeting. Data shared: IP address, browser information, page views, conversion events (e.g., purchases). Meta Privacy Policy
• TikTok Pixel (TikTok Pte. Ltd., Singapore / United States): Advertising performance measurement, conversion tracking, and audience targeting. Data shared: IP address, browser information, page views, conversion events. TikTok Privacy Policy
• Microsoft Advertising (Bing UET tag) (United States): Advertising performance measurement and conversion tracking. Data shared: IP address, browser information, page views, conversion events. Microsoft Privacy Statement
• MediaGo Pixel (United States): Advertising performance measurement and conversion tracking. Data shared: IP address, browser information, page views, conversion events.

D. Infrastructure and Hosting

• Supabase (database and backend hosting): Stores your account data, quiz answers, results, and analytics events. Supabase Privacy Policy
• Cloud hosting providers for application and database hosting
• Content delivery networks (CDNs) for performance optimization
• Error monitoring and performance tracking services
• Security monitoring services

6.2 Data Sharing Principles

We only share personal data with third parties when:

• It is necessary to provide the Service (contractual necessity)
• You have given any required consent for analytics and advertising. Apple's App Tracking Transparency permission applies where required on iOS/iPadOS; it does not apply to Android
• We are required to do so by law or legal process
• It is necessary to protect our rights, safety, or property

We do not sell your personal data to any third party. All third-party processors are bound by data processing agreements that require them to protect your data in accordance with applicable data protection laws.

6.3 User Control Over Tracking

Users can limit tracking through:

• On iOS/iPadOS: declining the App Tracking Transparency prompt when shown, or turning TrueWit off under Settings → Privacy & Security → Tracking
• On Android: using your device's advertising controls to reset or delete your advertising ID, typically under Settings → Privacy → Ads. The available options and menu path vary by device and Android version. On some older versions, you can opt out of ad personalization instead. These device settings do not replace any consent required for TrueWit's analytics or advertising; you may withdraw that consent as described in Section 4.2
• Deleting the app removes locally stored app data but does not delete your account or personal data stored on our servers and does not cancel your subscription. To request account deletion, see Section 8.3.
• Our cookie consent banner and your browser's cookie settings, when you use our website
• The ad preference settings in your Facebook and Google accounts

07. Your Rights and Choices

7.1 Your Privacy Rights

The scope and conditions of your privacy rights depend on applicable law. Where the GDPR applies, these rights include:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of your personal data, subject to applicable legal exceptions
• Object to processing based on legitimate interests, subject to applicable conditions, and object to direct marketing
• Receive data you provided in a portable format where processing is automated and based on consent or a contract
• Withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing before withdrawal
• Request restriction of processing where the applicable conditions are met
• Lodge a complaint with a competent supervisory authority

7.2 How to Exercise Your Rights

To exercise your privacy rights, contact us using the details in Section 12.

Response Timelines:

• Initial acknowledgment: We aim to acknowledge your request within 72 hours
• GDPR response time: Without undue delay and within one month of receiving your request
• GDPR extension: Up to two additional months where permitted due to the complexity or number of requests. We will notify you of the extension and explain the reasons within the first month of receiving your request
• Appeal review: We aim to review appeals within 30 days. You may still complain to a supervisory authority or seek a judicial remedy. For requests governed by other laws, the applicable statutory deadlines apply

08. Data Retention and Deletion

8.1 Retention Periods

• Account data (email, name, preferences): Retained while the account is active and for 30 days after account deletion request
• Billing and payment records (transaction history, invoices, payment method identifiers): Retained for a minimum of 7 years after the last transaction, as required by applicable tax and financial regulations (including EU VAT Directive 2006/112/EC and Cyprus tax law)
• Subscription records (plan type, start/end dates, cancellation records): Retained for 7 years after subscription termination for legal compliance and dispute resolution
• Test results and IQ scores: Retained while the account is active; anonymized or deleted upon account deletion. If specific results are necessary for an ongoing dispute, only the data necessary for that dispute is retained until it is resolved. Billing record retention does not automatically apply to all test results
• Analytics data: Aggregated and anonymized data retained indefinitely for service improvement; personally identifiable analytics data retained for 26 months
• Communication records (support emails, correspondence): 2 years from the date of last communication
• Security and access logs: 13 months
• Cookie consent records: Retained for the duration of consent validity. Retention of consent evidence is separate from the period for remembering your preferences and from individual cookie lifetimes

8.2 Right to Deletion vs. Legal Obligations

Under GDPR Article 17 (Right to Erasure), you may request deletion of your personal data. We must retain some data to meet legal obligations, even after a deletion request:

• Billing records: We must retain transaction records, invoices, and payment identifiers for at least 7 years to comply with tax and financial regulations. These records cannot be deleted upon user request.
• Fraud prevention data: Data related to chargebacks, disputes, or suspected fraud may be retained as necessary to protect our legitimate interests.
• Legal proceedings: Data relevant to ongoing or reasonably anticipated legal proceedings will be retained until the matter is resolved.

When you request account deletion, we will delete or anonymize all personal data that is not subject to a legal retention obligation. You will be informed of any data that cannot be deleted and the reason for its retention.

8.3 Deletion Procedures

• Account deletion: Requests are handled within the response periods in Section 7.2. Under the GDPR, the period runs from receipt of the request, subject to applicable identity-verification rules; it does not restart when support confirms the request
• Personal data removal: Systematic deletion from active systems
• Backup removal: Within 90 days of deletion from active systems
• Third-party notification: We will instruct processors acting on our behalf to delete personal data covered by your deletion request. Data may be retained where required by law or necessary for the establishment, exercise, or defence of legal claims; we will explain any applicable exception
• Verification: Confirmation of deletion sent to your email

09. International Data Transfers

As our Service operates globally and some of our third-party processors are located outside the European Economic Area (EEA), your personal data may be transferred to and processed in countries outside the EEA, including the United States. Such transfers occur in the following cases:

• Stripe, Inc. (United States): Payment processing data is transferred to Stripe's servers in the US under Standard Contractual Clauses (SCCs)
• Google LLC (United States): Analytics data is transferred under SCCs and Google's data processing terms
• Meta Platforms, Inc. (United States): Advertising and conversion data is transferred under SCCs and Meta's data processing terms
• Brevo (Sendinblue) (France/EU): Email data is primarily processed within the EU

For all international transfers, we ensure appropriate safeguards through:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Data Processing Agreements (DPAs) with processors; a DPA alone is not a legal basis for an international transfer, which must also rely on an applicable transfer mechanism
• Technical measures including encryption of data in transit and at rest
• Regular assessment of the legal framework in recipient countries
• Compliance with GDPR Chapter V requirements for cross-border transfers

You may request a copy of the safeguards we use for international transfers by contacting us at [email protected].

10. Children's Privacy

TrueWit is intended for users aged 18 and over, as stated in our Terms of Use. We do not knowingly collect personal data from persons under 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly, subject to applicable legal obligations. The minimum age for using TrueWit is separate from the age at which a child may consent to data processing under applicable law.

If you believe we may have collected information from a person under 18, please contact us immediately using the contact information in Section 12.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for material changes

Where required by applicable law, we will obtain your consent before introducing changes to processing that require your consent.

12. Contact Information

For any questions or concerns about this Privacy Policy or our data practices, please contact our Data Controller, CUTECALL GLOBAL LIMITED, trading as TrueWit, at the address below: