Privacy policy

1. Data-controller roles

The seller and service provider identified below is the controller for account, authentication, self-initiated assessment, security, support, payment, and PsyMI legal-obligation data.

For a specific candidate assignment, the company or freelance recruiter cabinet owner is the controller, a company recruiter acts for the company, and PsyMI is the processor acting on that controller's documented instructions.

2. Data we process

• registration and contact details: name, email, and optional telephone and photo;
• login identifiers, security settings, protected server-side sessions, and technical logs;
• assessment assignments, completion status, and derived results; unfinished answers may be stored temporarily in the browser and sent to the server for validation and scoring, but the current implementation does not retain them as a permanent question-by-question answer set;
• vacancy, invitation, role, and workspace data required for the requested workflow;
• order details, amount, currency, status, and technical payment reference; WayForPay processes complete card details;
• support communications and notification preferences.

3. Purposes and legal grounds

• account creation and delivery of assessments, results, reports, and business features — performance of a contract;
• payments, accounting, and tax records — contract performance and legal obligations;
• account security, fraud prevention, audit, and reliability — legitimate interests where permitted;
• marketing messages — separate consent that may be withdrawn;
• a candidate assignment and work report — the controller's documented ground, the specific assignment and role, prior notice, and explicit assignment acceptance; special-category data requires a separate appropriate ground.

4. Recipients

We use only providers needed for each function: HOSTiQ.ua for server infrastructure; Google for optional Google sign-in; Brevo for transactional email; UptimeRobot only to check the public URL and notify an operator; and WayForPay for payment when that method is activated.

A freelance recruiter cabinet owner sees results issued from that cabinet. Company owners and administrators see company-issued results; a company recruiter sees their vacancies, assignments, and results where they are a reviewer. Broader recruiter access requires a separate default-off audited setting.

A company or recruiter does not receive individual answers, every personal assessment, unrelated results, or candidate purchase data.

5. International processing

Some providers may process data outside Ukraine. We use available contractual and organisational safeguards and minimise transferred data as required by applicable law.

6. Retention

Data is retained only while needed for the account, purchased service, security, dispute handling, or mandatory accounting and legal periods. A web session lasts no more than 30 days and expires after 14 days of inactivity.

Identity in a terminal unaccepted candidate invitation is retained for no more than 30 days. A completed organisation report is retained for no more than 365 days after acceptance; closing the vacancy shortens this to the earlier current deadline or 180 days after closure. Payload-free audit is retained for up to 12 months. The candidate sees the exact deadline.

Following a valid request, data is deleted, corrected, blocked, or anonymised as required by law, except for the minimum supported by a lawful longer-retention ground.

7. Cookies and local storage

PsyMI uses a protected HttpOnly cookie for the server-side session and a separate cookie for CSRF protection. Local storage is used for selected account context, technical completion of Google sign-in, and unfinished assessment progress, including temporary answers. No authentication token is kept in localStorage. Optional advertising or analytics is not enabled without notice and, where required, consent.

8. Your rights

• receive information and access your personal data;
• request correction, deletion, or restriction where provided by law;
• withdraw consent without affecting prior lawful processing;
• obtain an available data export and object or complain to the competent authority;
• decline or withdraw a candidate assignment before completion; after completion, use the privacy contact to request access, correction, objection, legality review, or deletion of the organisation report.

9. Security and age

We use role- and workspace-based access controls, protected server-side sessions, MFA for privileged roles, logging, secret encryption, backups, and proportionate safeguards. No system is absolutely secure; confirmed incidents are notified as required by law.

PsyMI is intended for people aged 18 and over. We do not knowingly collect children's data for independent use of the platform.

10. Enquiries and changes

Send personal-data requests to the privacy email below. Material changes are published with a new version date and, where required by law or the nature of the change, communicated directly to the user.