This Privacy Policy explains how AFOQT Lab, operated by AFOQT Lab and based in Chengdu, Sichuan, China, collects, uses, and protects information when you use afoqtlab.com (the "Service"). We aim to collect as little personal data as possible.
1. Information we collect
- Email address: when you make a purchase, request an access link, or submit it through the diagnostic flow, so we can deliver access or provide the requested experience. Our access and diagnostic records retain only a one-way SHA-256 hash rather than the plain-text address; the address is handled transiently when an email must be sent.
- Purchase information: transaction details such as product, date, amount, currency, and payment reference provided by Dodo Payments. We do not collect or store your full payment card number.
- Analytics information: page path without its query string, referring origin without its path or query string, campaign parameters, practice type and mode, anonymous answer outcomes, scores, durations, free-limit and paywall interactions, checkout transition, purchase status, access-link delivery, and access activation. Analytics uses a randomly generated anonymous identifier. We do not send email addresses, email-derived identifiers, names, IP-derived geolocation, or answer text to the analytics provider.
- Technical logs: standard server logs may include IP address, requested page, timestamp, browser, and device information needed to operate and secure the Service.
- Practice activity: answers, progress, and history are currently stored locally in your browser so the Service can display results on that device.
- Cookies and local storage: these are used to unlock purchased access, keep the anonymous free-practice starter set consistent, retain the anonymous analytics identifier, and protect the Service.
We do not intentionally collect sensitive personal information, and we do not knowingly collect personal data from children under 13.
2. How we use information
We use information to deliver and restore purchased access, process purchases, understand conversion through the practice and checkout funnel, improve the Service and its reliability, provide support, prevent abuse, and comply with legal obligations.
3. Legal bases for EEA and UK users
Where the GDPR applies, we process personal data based on performance of a contract, our legitimate interests in operating and securing the Service, consent where required, and compliance with legal obligations.
4. How we share information
We do not sell your personal information. We share information only as needed with service providers that help us operate the Service:
- Dodo Payments: Merchant of Record, payment processing, tax handling, receipts, refunds, and transmission of an anonymous checkout reference;
- PostHog: product analytics for the usage, purchase, and access funnel described above;
- Transactional email provider: delivery of access-link emails through the provider identified in our current service configuration;
- Hosting and infrastructure providers: operation and security of the website.
We may also disclose information when required by law or when reasonably necessary to protect our rights, users, or the Service.
5. Cookies and local storage
We use a secure, signed cookie that unlocks purchased access, an anonymous free-practice cookie, and a first-party cookie and local-storage entry containing a random analytics identifier. We do not use advertising cookies or enable PostHog session recording. Browser settings can remove these values, but doing so may reset the anonymous identifier or require you to restore access by email.
6. Data retention
We retain personal data only as long as needed for the purposes described here. Purchase and access records may be kept for the access period and as required for accounting, legal, dispute, and fraud-prevention purposes. We then delete or anonymize data when it is no longer required.
7. International transfers
Information may be processed in countries other than where you live, including Chengdu, Sichuan, China and locations used by our service providers. Where required, appropriate safeguards are used for international transfers.
8. Your rights
Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal data, object to or restrict processing, and withdraw consent. California residents may have rights to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information. To exercise a right, email support@afoqtlab.com.
9. Security
We use reasonable technical and organizational measures to protect information. No method of transmission or storage is completely secure, so absolute security cannot be guaranteed.
10. Children's privacy
The Service is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has provided personal data, contact us so we can delete it.
11. Changes to this policy
We may update this Policy from time to time. Changes are indicated by the "Last updated" date.
12. Contact
Questions or privacy requests: support@afoqtlab.com.