Privacy Policy
1. Who we are
The controller of your personal information is Luis Junior, who operates Cogniva as an individual based in Brazil. For any privacy question or request, email privacy@cognivainstitute.org.
2. Summary
Here is the short version. We collect your email and your test answers so we can show your result and deliver what you buy. We don't sell your personal information for money, and your answers and results never go to advertisers. We use Google Analytics, and Meta's ad tools on the test pages, to see which pages and ads work, and you can opt out. We may email you a few follow-ups about your result, and we ask first where the law requires it. Our newsletter always needs your consent, and every marketing email stops with one click. You can ask us for a copy of your data or to delete it at any time, and we finish within 30 days.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers | Email address, visitor ID, IP address | You, your browser |
| Test data | Answers, time per question, score, band, estimated range, your self-estimate | You |
| Commercial information | Purchases, amounts, refunds | You, Stripe |
| Payment data | Card brand, last 4 digits, billing country (full card number stays with Stripe) | Stripe |
| Internet activity | Pages viewed on the site and the test, ad click IDs, device and browser type, recordings of the test, checkout and offer screens with what you type hidden | Your browser, Meta Pixel, Google Analytics, PostHog |
| Approximate location | Country and region from IP | Your browser |
| Communications | Emails you send us, survey answers, tutor messages | You |
4. How we use it
- To deliver your result and your report.
- To send service emails, such as your result, receipts and access links.
- To send follow-up emails about your result and marketing emails, following the consent rules for your country described in section 13 of our Terms.
- To measure which pages and ads bring visitors and purchases.
- To prevent fraud.
- To calibrate our norm with de-identified answer data.
- To meet our tax obligations.
5. Legal bases (UK, EU and Switzerland)
- Contract: your result, your report and your purchases.
- Consent: follow-up and marketing emails, and analytics and advertising cookies in the EEA, the UK, Switzerland and Canada.
- Legitimate interest: security, fraud prevention and de-identified calibration of the norm.
- Legal obligation: tax records.
6. Your test results
Your answers, scores and results are used to produce your result and report, and in de-identified form to calibrate our norm. They are never sent to Meta, Google or any other advertising platform, and never sold.
7. AI processing
To write your report and the tutor's answers, we send our AI provider (OpenRouter and the OpenAI model it routes to) your pattern of answers and your calculated results, without your name or email. Our requests tell OpenRouter to use only providers that don't keep data for training.
8. Advertising and cookies
On the test pages we use Meta's Pixel and Conversions API to send page, sign-up and purchase events, including the purchase value and currency. We never send your results.
On this website and the test pages we use Google Analytics to count visits and see which pages, searches and ads bring people to Cogniva. Google receives the page address without IDs or personal details, the site you came from, your device and browser type, your approximate location, and sign-up and purchase events with the purchase value and currency. It never receives your email, your name, your answers or your results. Google signals and ad personalization are off, so Google uses this to measure, never to build ad audiences.
To see how fast our pages load for real visitors, Cloudflare, which hosts this website, measures loading times with Cloudflare Web Analytics on every page. It sets no cookie and keeps no ID: it receives the page address, timing figures, your browser type and your approximate country, never your email, your answers or your results.
When you visit our site, our advertising partner (Meta) may receive information about your visit, which California law may treat as 'sharing' for cross-context behavioral advertising. You can opt out at any time.
| Cookie | Purpose | Lasts |
|---|---|---|
| cv_vid | Recognizes your browser on the test | 400 days |
| cv_att | Keeps your test attempt and result open | 30 days |
| cv_consent | Stores your consent choice and your opt-out | 365 days |
| cv_ft | Remembers how you first arrived | 30 days |
| _fbp, _fbc | Meta ad measurement | 90 days |
| _ga, _ga_* | Google Analytics: tells visits apart | 13 months |
| _gcl_* | Google ad measurement, when you arrive from a Google ad | 90 days |
In the US, Australia and every other country not listed next, the Pixel and Google Analytics load by default, and you can opt out; we honor Global Privacy Control. In the EEA, the UK, Switzerland, all of Canada, and when we can't tell your country, they load only after you accept in the cookie banner. On this website (the pages outside the test), Google Analytics follows the same rules and the choice you made on the test pages, and it is the only outside tool there besides Cloudflare's page-speed measurement described above.
9. Selling and sharing (California and other US states)
We don't sell your personal information for money, and your answers and results never go to advertisers. Our use of Meta's advertising tools on the test pages may count as 'sharing' for cross-context behavioral advertising under California law. You can opt out at cognivainstitute.org/privacy-choices, and we treat a Global Privacy Control signal as an opt-out.
Categories disclosed for advertising in the last 12 months:
| Category | Disclosed to | Purpose |
|---|---|---|
| Identifiers (hashed email, IP address, cookie IDs) | Meta Platforms | Measuring which ads bring visitors and purchases |
| Internet activity (test pages viewed, ad click IDs) | Meta Platforms | Measuring which ads bring visitors and purchases |
| Commercial information (purchase value and currency) | Meta Platforms | Measuring which ads bring purchases |
10. Who processes data for us
| Provider | Purpose | Data |
|---|---|---|
| Cloudflare | Hosting, CDN, queues, storage, PDF generation, bot protection, email delivery, page-speed measurement | All data in transit; files in storage; email address, email content and delivery events |
| PlanetScale | Database | All stored data |
| Stripe | Payments, fraud prevention | Email, payment details, IP address, billing address |
| OpenRouter and the provider of the model it routes to (OpenAI) | Writing the report and the tutor's answers | Performance data without identifiers; tutor messages |
| Meta Platforms | Ad measurement | Page and purchase events, hashed email and phone, IP address, user agent (never test results) |
| Sentry | Error reporting for the site and the servers | Error type and stack, browser and operating system, page path without IDs or parameters (never email, IP address or test results) |
| PostHog | Usage analytics of the test and recordings of the test, checkout and offer screens, with what you type hidden | Visitor ID, test page events, browser, operating system and device, recordings kept for 30 days (never email, IP address or test results) |
| Analytics of the site and the test, and ad measurement (Google Analytics) | Page addresses without IDs or personal details, the referring site, browser, device and approximate location, sign-up and purchase events with value and currency, kept for 14 months (never email, name or test results) |
11. International transfers
Your data is processed in the United States. Transfers from the UK, the EU and Switzerland rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or the processor's certification under the Data Privacy Framework.
12. How long we keep it
| Data | Kept for |
|---|---|
| Visit and ad-click data when you didn't give us your email | 13 months after your last visit |
| Test answers when you didn't give us your email | 13 months, then de-identified |
| Your email address and free result if you didn't buy | Until you unsubscribe, or 24 months after you last clicked a link in one of our emails, then deleted (your test answers are de-identified) |
| Unsubscribe and suppression records | As long as needed to honor your choice, stored only as a one-way hash of your email |
| Purchase, tax, refund and dispute records | 7 years (tax law) |
| Reports, practice plans and practice answers of buyers | 3 years from purchase. We email you 30 days before deletion so you can download your report |
| Tutor messages | 12 months |
| PDF files | 90 days (regenerated on request) |
| Emails we sent you | 24 months |
| Survey answers | 24 months, then de-identified |
| Challenge and share links | 24 months after the last visit |
| Advertising and site event data | 25 months, then kept only as daily totals |
| IP address and browser details sent with ad events | 8 days |
| IP address and browser details stored with a purchase | 90 days (fraud prevention) |
| IP address and browser details recorded with your email consent | 90 days (the date and wording of your consent stay as its record) |
| Sign-in sessions, with their IP address and browser details | Deleted when they expire, 7 days after you last used them |
| Notifications from our payment and email providers | 30 days |
| Records of your privacy requests | 24 months |
| Server logs | 7 days |
| Database backups | Up to 7 days |
| De-identified answer data used for the norm | Indefinitely (can't be linked back to you) |
13. Your rights
You can ask to access, correct, delete or take a copy of your data; opt out of the sale or sharing of your personal information; limit how we use it; withdraw consent; object to processing; and complain to a data protection authority (in the UK, the ICO). We won't treat you differently for using these rights.
To make a request, email privacy@cognivainstitute.org. To opt out of sale and sharing right away, use Your privacy choices. We confirm every request within 10 business days and finish it within 30 days, wherever you live. We email you when we receive the request, when your copy of the data is ready and when the deletion is done.
14. Children
Cogniva is for adults 18 and over. We don't knowingly collect data from children under 13, and if we learn that we have, we delete it.
15. Security
Data is encrypted in transit, access is restricted to the people who need it, and payments are tokenized by Stripe, so your full card number never reaches us.
16. Changes and contact
The date at the top shows the last update. We email you before a material change takes effect. Questions: privacy@cognivainstitute.org.