1. Information we collect
- Test activity: the question set and version, selected answers, current question position, score, timing, completion, payment and eligibility status. We save answers to resume your test and supply the full report. A random browser access credential links these records to your browser; only its hash is stored in the database.
- Age and optional questionnaire: after the test, age checks eligibility. Gender, country and education are optional. Eligible answers increment separate grouped counts without a response row, test identifier, email, IP address, exact submission time or score. The test retains only an eligibility flag, not your selected age or optional answers.
- Purchases: order and provider references, payment status, adult authorization, delivery consent and version, agreement time, a snapshot of the purchase confirmation and terms, and the first authorized report delivery time. Delivery is not proof that someone read the report. Creem collects checkout email and payment details; the application does not store the buyer’s email from payment callbacks or full card information.
- Security and support: hosting providers may process IP addresses and request logs. The app uses hashed, time-bucketed identifiers to limit abuse. If you contact support, we receive the messages and information you send.
No account or password is required. The service does not ask for a date of birth, government ID, precise location, camera or microphone access.
2. Why we use it
- Provide the test you request, calculate and deliver reports, and save your answers and purchased reports.
- Confirm purchases, provide paid access, handle refunds or disputes.
- Respond to support and privacy requests, prevent abuse and maintain the service.
- Check minimum-age eligibility and adult purchase authorization, and prevent immediate retries after an under-age declaration.
- Understand the audience using separate demographic totals. Optional answers are voluntary, are not linked to individual scores and do not change the score or price.
- Meet applicable accounting, legal and regulatory obligations and establish or defend legitimate legal claims.
Where the GDPR or UK GDPR applies, the relevant bases are performance of a contract or steps you request before a contract, applicable legal obligations, and legitimate interests in security, age-appropriate access, fraud prevention and running the service, balanced against your rights. Optional questionnaire entries are used only to form the separate totals described above; leaving them blank does not affect access. Once combined into those totals, an individual contribution cannot be identified for access, correction or removal. Where consent is legally required for a particular use, we must obtain it separately and allow withdrawal. Accepting terms or reading this policy is not consent to unrelated marketing or research.
The current application has no advertising pixels, behavioral advertising or marketing subscriptions. It does not send answers or scores to a generative-AI service, sell personal information or share it for cross-context behavioral advertising. Reusing identifiable responses for a separate research project, advertising or AI training would require a separate assessment and notice, and consent where required; this policy does not authorize those uses.
3. Scores and automated processing
Software compares submitted answers with the question’s solution and calculates an indicative score and skill profile. This is automated scoring, not a professional psychological assessment or an age-normed IQ measurement.
We do not use the score to decide eligibility for employment, education, healthcare, credit or another consequential service. It does not affect the advertised price. If you believe a technical or scoring error occurred, contact us so it can be investigated. A score is not a measure of your worth or a prediction of your future.
4. Visits and browser storage
A necessary starp_access cookie lets this browser resume its saved test and open purchased reports without an account. It contains a random credential, not your answers or score. It is HttpOnly, SameSite=Lax and Secure on HTTPS. Its lifetime is up to one year, renewed when you return. The server stores only a hash of that credential.
Test answers and reports are saved on the server. The browser does not store them in local storage or session storage. Clearing cookies, changing browser profiles or expiration of the access cookie removes automatic access; it does not erase the server records. Download your report to keep it independently. Other people using your browser profile may have access to its reports.
Legacy account cookies and saved-visit keys are cleared. Creem may use its own necessary storage during payment, under its own notice. The current application has no non-essential tracking.
5. Service providers and disclosures
- Hosting: Cloudflare is the hosting and database provider selected for the public service. The configured application database is in its EU jurisdiction. Network delivery and operational processing can occur elsewhere, so this is not a promise that every copy or request stays in the EU. See Cloudflare’s privacy notice.
- Creem, when payments are connected: handles checkout, receipts and payment disputes. We exchange order and test references to verify a purchase. We do not send test answers or IQ estimates to Creem. Creem processes payment, fraud-prevention and legal information under its privacy notice.
- Email support: messages sent to our Gmail address are processed under Google’s consumer privacy policy. Please send only the order reference and information needed to resolve your request. Avoid attaching test results, identity documents, full payment-card details or unnecessary sensitive information.
The current service sends no verification, password-reset, report or marketing emails. Creem handles payment receipts. We may disclose information when legally required, to protect rights and security or to advisers with appropriate confidentiality safeguards. Payment integration remains inactive until configured.
6. International handling
starp operates from Israel, and infrastructure, support and payment providers may handle information in other countries. The current setup is not a promise of EU-only storage.
For EEA or UK information, a transfer requiring safeguards must use a valid mechanism, such as an applicable adequacy decision or approved contractual safeguards with any necessary supplementary measures. The production provider agreements, processing locations and onward-transfer arrangements still need to be finalized before public launch. Contact us for the applicable arrangements and information about obtaining a copy of relevant safeguards.
7. How long information is kept
Our standard retention period is one year (365 days). Unpaid tests expire one year after they start. Purchased reports and purchase/consent records expire one year after payment confirmation; uncompleted checkout records expire one year after creation. Return visits do not extend these periods. Download your report and purchase confirmation if you want to keep them longer.
Expired records stop being accessible immediately and are removed by scheduled cleanup in small batches. Security counters expire much sooner, normally within minutes or hours; an under-age browser restriction lasts 24 hours. Payment-event references are kept for up to one year. A deleted browser’s random credential hash is kept for up to one year solely to prevent access or restoration of its erased data; it contains no answers, score, name or email.
You can delete saved browser data sooner using the controls below. If a payment is still being resolved, contact support first. A specifically required legal preservation may delay deletion; it is not our normal retention policy. If an age below 16 is submitted to our server, unpaid tests linked to that browser are deleted and questionnaire answers are not added to totals. The form blocks under-16 submissions; selecting that age without submitting does not itself erase saved answers. Use the deletion controls below or contact us to remove them.
We aim to delete support email conversations within one year of the last substantive reply, unless an unresolved request or a specific legal requirement needs them longer. This is handled manually in the support mailbox. Separate anonymous questionnaire totals contain no individual response records and may be kept. Earlier private prototypes are separate from the public service; their account data is not imported into the public application database.
Hosting backup copies expire on the provider’s separate backup schedule. If a backup is restored, deletion records and retention deadlines must be reapplied before the service resumes. The one-year limit covers ordinary records in the starp application. Required business invoices, payout statements and accounting correspondence may be kept separately in email or accounting records for the period required by law, without retaining test answers for that purpose. Creem and Google also hold records under their own policies; for example, Creem specifies seven years for accounting data. Deleting starp data does not erase those provider records.
8. Your choices and privacy rights
Use this browser to download its saved test answers and purchase information, or delete its saved tests and reports. The download contains your submitted answers; worked solutions remain in purchased report downloads.
Contact starptests@gmail.com to request access, correction, deletion, a copy of your information or an explanation of its use. Depending on applicable law, you may also request portability or restriction, object to particular processing, withdraw consent, appeal a refusal, or use an authorized agent. These rights can have legal conditions and exceptions.
We may ask for proportionate information to verify you or an authorized representative. Do not send an identity document unless a justified, secure method has been agreed. For guest data, an attempt or purchase reference and proof of access may be needed; we must not disclose someone else’s report.
Requests must be handled within the deadlines that apply to them. Under the GDPR or UK GDPR, this is normally one month, with a permitted extension only where its conditions and notice requirements are met. The controls above work with records linked to this browser. You can also make a request by email. Clearing cookies alone does not delete server records; use the deletion control or contact us.
You may complain to the Israel Privacy Protection Authority, your EEA data-protection authority, the UK Information Commissioner or another competent regulator. Applicable US state rights may include access, correction, deletion, portability, appeal and opting out of sale, targeted advertising or certain profiling. The current service does not sell data or perform targeted advertising; rights and thresholds differ by state.
9. Young people
The service is intended for people aged 16 and over, including 16–17-year-olds with parent or guardian permission. An adult must authorize and make purchases. We do not offer an under-16 enrollment or verified parental-consent workflow.
Young people should know: we save the answers you give so we can provide your test and report; your results are not public; we do not use them for advertising. You can contact us for help with your information. If you believe a child under 16 has supplied personal information, contact starptests@gmail.com so we can investigate and take appropriate steps, including deletion where required.
The age check uses self-declaration, not an identity document or independent verification. It occurs after the initial test, so test answers are saved before we know the visitor’s age. Parent or guardian permission and adult purchase authorization are also declarations, not independently verified consent. A risk assessment and any stronger safeguards required for the intended markets remain necessary before public launch.
10. Security
The application uses HTTPS in production, hashed access credentials, access checks and rate limiting. These measures reduce risk but cannot guarantee absolute security. Keep your browser profile and downloaded reports private. If a personal-data breach occurs, affected people and regulators must be notified where applicable law requires it.
11. Changes and contact
We will update this policy when the service or its data practices change and provide additional notice or request consent where required. Check the date at the top for the latest revision.
For privacy questions, requests or an accessible copy, email starptests@gmail.com. For payment or report help, include only your order reference and a short description. Do not email passwords, browser cookies, identity documents or full card details. Please use “Privacy” in the subject if convenient; it is not a requirement for exercising your rights.
12. Data controller and contact details
David Motorany, trading as starp, is the controller responsible for personal information used to operate starp-tests.com. The business is based in Israel. Contact us about privacy at starptests@gmail.com, or write to the business address listed in our operator details.
Any required EU or UK representative and their contact details must be confirmed before public launch in those markets.