Privacy Policy

While YZR is closed

YZR is closed right now. You cannot create an account, sign in, or take the test. Our host, Vercel, still keeps technical logs of visits, such as the IP address, browser and page requested, to run and protect the site. If you already have an account or a test from before, we keep it under the retention rules on this page. To ask for access, correction, deletion or a copy, write to hello@yzr.ca. You do not need to sign in.

Who we are

The operator is named below.

Age

The test and paid checkout are for people who are 18 or older. We store that you confirmed this. We do not ask for a date of birth. Minors should not use the service.

Account and test data

An account stores an email, an optional name, and a hash of the password. We do not store the password itself. A test stores the answers, whether each one was counted correct, timing, and a session id. The report can show you an estimate and area counts. Those values are not put in the page address and are not sent in analytics events.

Performance data

We store how long each answer took, and the session elapsed time, with the test session. That timing is performance data for the session. It is not a clinical or diagnostic reading, and it is not a membership benefit.

AI

Aria shows fixed messages written in advance. Aria is not a person or an AI, and does not give a clinical test or a diagnosis.

Aria is a fixed message bank on this platform. No third-party AI vendor receives answers, timing, or the estimate. Answers are not used to train a model. There is no vendor switch for training, because nothing is sent to a vendor. See the AI notice.

Consent record

We store the price text you were shown, the text version, the time, the country when the request includes one, an HMAC hash of the IP address, the user agent (up to 300 characters), and a session id. We do not store the raw IP address in those rows. The start-of-test record also stores the age sentence, the country, a retain-until date, and the terms and privacy text version. Consent records are kept for 5 years.

Legal basis

This section is subject to legal review. Contract: the account, the test, and delivery of the estimate (LGPD art. 7, GDPR art. 6, PIPEDA consent). Consent: optional membership when it is offered. Legal obligation and the record of consent: price-consent and payment rows, including sensitive-data rules where they apply (LGPD arts. 7 and 11).

Processors

Vercel hosts the site. Supabase provides the Postgres database. This page does not name the region where that database runs. Stripe processes payments. Tag Manager is not configured, so Google Analytics is not used. Google Workspace hosts the hello@yzr.ca mailbox. It holds support mail and any feedback you send us during a private test. Resend sends transactional email, including, if you ask for it, the notice that your estimate is released. Upstash stores hashed rate-limit keys and does not receive the raw email or IP address. No third-party AI vendor receives answers.

Retention

Answers and accounts are kept while the account is in use and for 24 months after the last recorded activity, or until you ask us to delete them. If you joined through a private-test invitation, we delete your e-mail, answers, result and feedback within 30 days after the test ends, or sooner if you ask; we keep only the record of your agreements, for 5 years. A result that has not been released yet is kept in your account until the release time, 24 hours after you finish. Consent records are kept for 5 years. Payment records, if there are any, are kept for at least 3 years. Email logs are deleted after 90 days and do not store the full reset or cancel link after send. Scheduled reminder rows are deleted 90 days after they are sent, skipped, failed, or cancelled. Cancel and password-reset tokens are stored only as hashes and are deleted 30 days after they expire. Stripe webhook rows keep the event id and type so a replay stays idempotent; the stored payload is cleared after 90 days. The mail cron does these deletions. Share links expire after 30 days or when you stop sharing.

Payments

Paid checkout uses Stripe. We store Stripe customer, checkout, subscription, and price identifiers when a Stripe session exists. Stripe collects the billing country and the email on the payment. We do not receive the full card number.

Cookies and local storage

Details are on the cookies and storage page. Required cookies cover the guest test (yzr_guest, and older superiq_guest) and the signed-in session. yzr_beta_gate: a cookie that only remembers, in this browser, that your invitation code was already accepted. It does not store the code and lasts 14 days. Local storage holds the guest token, the session id, event keys yzr.evt.v1:*, the consent key yzr.consent.v1, the text-size choice yzr.textSize, and, for invited testers, a beta marker (yzr.cohort) and, only in the open tab, the consent id (yzr.betaConsent). This site does not add advertising pixels. Tag Manager is not configured, so there is no cookie banner.

Analytics

Tag Manager is not configured, so there is no cookie banner and Cookie settings is not shown. We do not load Google Tag Manager or Google Analytics. We do not run advertising tags.

Sharing

If you create a share link, we store a hash of the token, not the token, plus whether you authorized it, when it expires, and whether you stopped it. The page shows the estimate and not your name.

Automated scoring

The estimate is calculated on this platform from your answers. It does not decide access to a job, a school, or a benefit. It is an estimate for entertainment and curiosity, not a decision about you.

International transfers

The operator is in Brazil. Vercel, Supabase, Resend, Upstash and Google may process data outside your country, including in the United States and Brazil. This page does not name a transfer mechanism, such as standard contractual clauses or an adequacy decision. No third-party AI vendor receives test answers. The company's administrator also accesses the system from Canada. That access is by the company itself.

Rights

You can ask for access, correction, deletion, portability, a copy, objection, and to withdraw consent for analytics. Write to the support address in the identity block. Some payment and consent rows are kept for the legal period even after a deletion request.

Complaints

You may complain to the ANPD in Brazil, the Office of the Privacy Commissioner of Canada, or an EU data protection authority, as the law that applies to you allows. This sentence is subject to legal review.

Privacy contact

Privacy questions go to hello@yzr.ca. A data protection officer is not named on this page.