How we handle your answers, and everything else.

1. Who we are

Wellington is operated by Therabot Labs LLC (“we”), the data controller for the personal data described here. Contact for privacy matters: [email protected].

2. What we collect

Things you give us

• Email address, when you save your progress or sign in. Optionally a first name and time zone.
• Assessment answers: your response (1 to 5) to each item, the item identifier, when you answered it and how long it took. Answers are the core of the product and are held against your account.
• Which traits you flag as mattering to you, used to build your growth plan.
• Messages you send us through the contact form or by email.

Things created when you use Wellington

• Scores: raw means, z-scores, percentiles and bands for each trait, with the norms version used.
• Reports: a stored summary of each report you have viewed and the PDF generated from it.
• Funnel events: first-party analytics such as “snapshot started”, “paywall viewed” or “PDF downloaded”, with the page path and a random anonymous identifier kept in your browser before you give your email. An analytics event never contains an answer or a score.
• Email events: which messages we sent you and whether they were opened or clicked, so we can stop sending reminders that are not wanted.
• Session data: a signed-in session token, stored only as a hash and referenced by the wl_session cookie described in the cookie policy, and your browser’s user-agent string.
• Consent records: proof of what you agreed to and when, described fully in section 8.
• Attribution: the campaign parameters and referring site on your first visit, if any.

Payment

Payments and subscription management are processed by Stripe, which hosts our checkout page and our billing portal. We receive a customer identifier, the product bought, the amount and currency, and the payment status. We do not receive or store your card number. Stripe’s handling of your payment data is governed by Stripe’s privacy policy, and Stripe sets its own cookies on the checkout page it hosts, which our cookie policy also covers.

3. Why we use it, and our lawful basis

Where the GDPR or the UK GDPR applies to you, the law requires us to name the lawful basis for each use. Here they are:

4. Who sees it

The following processors handle data on our behalf, each under a data processing agreement that limits their use of it to providing their service to us:

We may disclose data if the law requires it, or to protect the rights or safety of any person.

5. International transfers

Our processors run in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, giving us your data is therefore an international transfer. We rely on the Standard Contractual Clauses with our processors, or an equivalent recognised safeguard, so that your data is protected to the same standard wherever it is processed. Write to [email protected] for a copy of the relevant safeguard.

6. Where it is stored and for how long

Data is stored in the United States. We do not keep things longer than we need them for:

If you delete your account, everything in the first two rows is removed immediately and permanently.

7. Research and norms

To make percentiles meaningful we estimate, for each trait, the mean and spread of scores among adults who have completed Wellington. This uses answers stripped of your email, name and any identifier, in aggregate, and the result is a table of statistics that cannot be traced to any person. We may publish those statistics and describe our methods. We will never publish or share individual response records. If you would rather your answers were not included even in this de-identified form, tell us at [email protected] and we will exclude them.

8. Consent records

Every time you are asked to receive email beyond the transactional messages that always send, we keep a consent record: the timestamp, the purpose (marketing email, news about future Therabot Labs products, or acceptance of these terms), the exact wording and version you saw, where you saw it, a one-way hash of your IP address rather than the address itself, and whether you were shown a box you had to tick yourself rather than one already ticked.

After you first sign in with Google, Apple or an email link, we offer a separate choice about Wellington marketing emails. Unless a country-specific default-enrollment option is enabled as described below, the box starts unticked. Declining does not prevent you from viewing your results. Existing unsubscribes are not reset by signing in. Other newsletter and checkout forms display their own choices. Earlier and other form wordings:

The new sign-in preference uses this wording: “Email me practical personality insights and occasional offers for Wellington reports and memberships. I can unsubscribe anytime.” It covers Wellington personality insights and offers for Wellington reports and memberships, not permission to advertise unrelated Therabot Labs products or upload your email to advertising audiences.

Where we enable a legally applicable default-enrollment option, we disclose it before enrollment: “You’ll also receive emails with practical personality insights and occasional offers for Wellington reports and memberships. You can unsubscribe anytime.” In eligible EU countries, this relies on the existing-customer exception for our own similar products or services, with a visible option at collection: “No thanks, I don’t want personality tips or Wellington offers by email.” A US notice-only option may be used where applicable. We record these as default enrollment, not affirmative consent. Country-specific activation requires review of the applicable rules and compatibility with our sending provider; it is not automatically applied to all visitors outside the EU. All marketing emails provide an unsubscribe option.

Transactional mail, your results, your receipt, your sign-in link, is how the Service works and is not covered by any of this; it always sends and cannot be unsubscribed from while your account exists.

9. Your rights

Wherever you live, you can reach every one of these from your dashboard, the unsubscribe page, or by writing to [email protected].

Under the GDPR and UK GDPR

• Access and portability. Ask us, or use GET /api/account/export from your dashboard, and we will give you every answer, score and report we hold on you in a machine-readable form.
• Rectification. Correct your email, name and time zone in your account. Answers cannot be edited, only retaken.
• Erasure. Delete your data from your dashboard, which is immediate and does not require you to write to us.
• Objection and restriction. Unsubscribe from all non-essential email in one click, and object to the research use in section 7.
• Withdrawing consent. Withdraw marketing consent at any time, with no effect on anything already done under it.
• Complaint. You may complain to your local data protection authority. We would rather hear from you first.

Under the CCPA and CPRA (California, and similar state laws elsewhere in the United States)

• Right to know what personal information we collect, use and disclose, as described in this policy.
• Right to delete your personal information, from your dashboard.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. You can opt out of the sale or sharing of your personal information, including for cross-context behavioural advertising, any time from your dashboard, which is our “Do Not Sell or Share My Personal Information” control. We also honour Global Privacy Control signals sent by your browser.
• Right to non-discrimination for exercising any of these rights.

We respond to requests within one month (GDPR) or 45 days (CCPA/CPRA), and may need to confirm that a request comes from the email address on the account.

10. Cookies, analytics and advertising measurement

Wellington sets one essential cookie to keep you signed in. With your permission (which is the default in the United States and a choice you make first in the EU, EEA and UK) it also sets a first-party visitor cookie and an attribution cookie so that we can see which pages people read, which campaign brought them, and where they stop. Those cookies hold random identifiers and campaign labels, never an answer or a score, and they are read only by Wellington.

With the same permission we load advertising measurement from Google (Google Analytics and Google Ads) and Meta (the Meta pixel), and when a purchase completes we tell the same platforms from our server, with your email hashed. This lets us know which advertisements lead to purchases and stop paying for the ones that do not. Google and Meta act as our processors for measurement and, for their own advertising products, as independent controllers under their own privacy policies. We honour the browser’s Global Privacy Control signal as a refusal of advertising measurement, and you can turn all of it off at any time on the cookie page. The cookie policy lists every cookie by name.

When advertising measurement is allowed, we also send TikTok completion, share-click and purchase events from our server, with the event value, purchased product where applicable, TikTok ad click identifier when available, IP address and browser information. TikTok does not receive your email, assessment answers, scores, trait names or private report links through this integration. Purchases use the permission recorded at checkout. TikTok processes the events under its advertising data terms and privacy policy; our cookie page explains how to switch measurement off.

11. Children

Wellington is for adults. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has given us data, write to [email protected] and we will delete it.

12. Security and breach notification

Sign-in is passwordless: a single-use link expiring in 20 minutes, with tokens stored only as hashes. Session cookies are HTTP-only and, in production, sent only over HTTPS. Data is encrypted in transit and at rest by our providers. No system is perfectly secure. If we learn of a breach likely to risk your rights or freedoms, we will notify the relevant supervisory authority within the time the law requires and tell affected users without undue delay, describing what happened and what we are doing about it.

13. EU and UK representatives

Under Article 27 of the GDPR and the equivalent UK GDPR provision, where we are required to appoint a representative in the European Union or the United Kingdom, their name and address will be published here. Until then, direct any request or complaint to [email protected] and we will respond as the controller.

14. Changes

If we change this policy in a way that matters, we will email account holders before the change takes effect and keep the previous version available on request.

Therabot Labs LLC, United States. Questions about this document: [email protected], or the contact form.