Privacy Policy

IQtonics (iqtonics.com) is operated by Barosoft Limited ("we", "us", "our"). We are the controller of the personal data described in this policy. For any privacy question or request, contact us at info@barosoft.co.uk.

• Account data: your email address and, if you add them, your name (used on your certificate) and preferred language.
• Test and training data: your answers, response times, scores, IQ estimate, certificate details and training progress.
• Payment data: payments are processed by Stripe. We never see or store your full card number; we receive your name on card, billing country, card brand and last four digits, and the amounts and dates of your payments.
• Communications: messages you send us and records of emails we send you.
• Technical and usage data: pages visited, device and browser type, approximate location (country/city) derived from your IP address, and error reports. Our analytics tools discard IP addresses after deriving the approximate location.
• Cookies and similar technologies: see our Cookie Policy.

• To provide the test, your results, your account and your membership: performance of our contract with you.
• To take payments, keep accounting and tax records and handle refunds and chargebacks: contract and legal obligation.
• To send service emails (results, login links, receipts, trial reminders, cancellation confirmations): contract.
• To send marketing emails: only with your consent, which you can give or withdraw at any time in your account settings; every marketing email also has an unsubscribe link.
• To keep the service secure, prevent fraud, abuse and bots (including Cloudflare Turnstile and rate limiting) and to fix errors: our legitimate interest in a safe, working service.
• To measure how the site is used: cookieless, pseudonymous measurement on the basis of our legitimate interest; analytics cookies only with your consent.
• To establish, exercise or defend legal claims: our legitimate interest.

Your IQ estimate and area scores are calculated automatically from your answers. They are provided for entertainment and self-development only and are not used to make any decision that has legal or similarly significant effects on you.

We share personal data only with service providers that process it on our behalf under contract, and only as far as needed:

• Supabase — database and login (United States)
• Vercel — website hosting (United States, with a global network)
• Stripe — payment processing and fraud prevention (Stripe also acts as an independent controller for some payment data)
• Resend — transactional email (United States)
• Cloudflare — DNS, security and bot protection (global)
• Sentry — error monitoring (United States)
• PostHog — product analytics (United States)
• Google — Google Analytics, only if you accept analytics cookies
• Sanity — content management for our website (no customer data)

We may also disclose data where required by law or to protect our rights. We do not sell your personal data and we do not share it for targeted advertising.

Some of our providers are located outside the UK, the EU and Türkiye, mainly in the United States. Where data is transferred, we rely on appropriate safeguards: the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, the EU-US Data Privacy Framework and its UK Extension where the provider is certified, and, for data of people in Türkiye, standard contracts under Article 9 of Law No. 6698 (KVKK).

• Account, test and training data: for as long as your account exists. When you delete your account in your account settings, your profile, test results and training progress are deleted.
• Test results not linked to an account: until you ask us to delete them or we no longer need them to let you access your results.
• Payment, invoice and tax records: for 6 years, as required by UK law.
• Analytics data: pseudonymous and kept only as long as needed to understand long-term usage trends.
• Error reports: up to 90 days.

We protect your data with encryption in transit, access controls, least-privilege keys, bot protection and regular monitoring. No online service can be completely secure; if a breach affects you, we will inform you and the authorities as the law requires.

Depending on where you live, you have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw consent at any time without affecting earlier processing. You can download or delete your data yourself in your account settings, or email info@barosoft.co.uk. We reply within one month.

If you are unhappy with how we handle your data, please contact us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in your country.

This section is our information notice under Article 10 of the Personal Data Protection Law No. 6698. Your personal data is collected electronically through our website and processed by Barosoft Limited as data controller for the purposes and on the legal grounds described above (Article 5: performance of a contract, legal obligation, legitimate interest and, where required, explicit consent). It may be transferred to the service providers listed in section 5, including abroad, under Article 9. Under Article 11 you may ask whether your data is processed, request information about it, learn the purpose of processing, know the third parties it is transferred to, request correction or deletion, object to results arising exclusively from automated analysis, and claim compensation for unlawful processing. Send your request to info@barosoft.co.uk; we respond within 30 days at the latest.

In the last 12 months we collected the categories described in section 2: identifiers (email, name), commercial information (purchases), internet activity, approximate geolocation and inferences (your test scores). We use them for the purposes in section 3. We do not sell or share personal information, including for cross-context behavioral advertising, and we do not use sensitive personal information for any purpose that requires an opt-out. You may request to know, access, correct or delete your personal information by emailing info@barosoft.co.uk; you may use an authorized agent, and we will not discriminate against you for exercising your rights. We verify requests by confirming control of your account email.

IQtonics is not intended for anyone under 16 and we do not knowingly collect their data. You must be at least 18 (or the age of majority where you live) to buy a membership. If you believe a child has given us data, contact us and we will delete it.

We may update this policy. The date at the top shows the latest version. If a change materially affects you, we will tell you by email or on the site before it takes effect.