Privacy Policy

Version 1.0 — effective 3 November 2026

This Privacy Notice explains how Cacao Mobile collects and uses your personal information when you use BrainZan on brainzan.com.

Data Controller

CACAO MOBILE SPOLKA Z OGRANICZONA ODPOWIEDZIALNOSCIA (KRS 0000920978), ul. Nowogrodzka 31/414, 00-511 Warsaw, Poland, is the data controller responsible for your personal data. For privacy-related inquiries, contact us at [email protected].

Data We Collect

We may collect the following categories of personal data:

  • Account data: email address.
  • Test data: your answers to test questions, response times, and the scores and reports generated from them.
  • Payment data: transaction records, the country of your card and the last 4 digits of the card. Full card details are processed by our payment providers and are not stored by us.
  • Consent records: the time you accepted our Terms and billing terms, your IP address, your email, and the versions of the checkout and Terms you accepted.
  • Usage data: pages visited, device type, browser, IP address, and advertising identifiers.
  • Communications: messages you send to our support team.

How We Use Your Data

We use your personal data to:

  • Provide the test, calculate your results and deliver your report and training.
  • Process payments, manage subscriptions and send subscription emails.
  • Keep a record of your consent to our Terms and billing terms.
  • Communicate with you about your account, updates, and support requests.
  • Measure and improve our marketing and the Service.
  • Detect and prevent fraud, abuse, and violations of our Terms of Use.
  • Comply with applicable legal obligations.

If you are located in the EU/EEA, we process your data on the following legal bases:

  • Contract performance: processing necessary to provide the Service and your subscription.
  • Legitimate interests: fraud prevention, security, and service improvement.
  • Legal obligation: compliance with applicable laws, including accounting and payment-scheme rules.
  • Consent: analytics and advertising cookies, and marketing emails.

Sharing of Data

We do not sell your personal data. We may share it with:

  • Service providers: payment processors and payment orchestration providers, hosting providers, analytics and advertising partners (such as Google, Meta and Mixpanel), error monitoring, and customer support tools, under data processing agreements.
  • Law enforcement: when required by law or to protect our legal rights.
  • Business transfers: in the event of a merger, acquisition, or asset sale, subject to continued privacy protections.

Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. Payment and consent records are kept for as long as required by law and payment-scheme rules. After account deletion, we may retain certain data for up to 90 days for backup and legal compliance purposes, after which it is permanently deleted.

Your Rights

Depending on your location, you may have the right to access, correct, or delete your data, to object to or restrict processing, to request data portability, and to withdraw consent at any time. To exercise these rights, contact us at [email protected]. We will respond within 30 days.

Cookies

We use cookies and similar technologies to run the test, remember your progress, measure usage and attribute advertising. You can control cookies through your browser settings.

Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and access controls. No method of transmission is 100% secure.

International Transfers

Your data may be processed outside your country of residence. Where we transfer data internationally, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for EU data).

Children’s Privacy

The Service is not directed to individuals under 18 years of age, and we do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

California Privacy Rights

If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know, delete and correct your personal information. To exercise these rights, contact [email protected].

Changes to This Notice

We may update this Privacy Notice periodically. We will notify you of material changes by email or via a prominent notice on the Service.

Contact

For privacy questions or complaints, contact us at: [email protected]