Privacy Policy

1. Introduction and Data Controller

Welcome to MyIQ ("we", "us", or "our"). We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Icelandic data protection law.

MyIQ operates the website myiq.is and provides an online IQ testing service. MyIQ is based in Iceland, a member of the European Economic Area (EEA), and is the data controller responsible for your personal data as described in this Privacy Policy.

This Privacy Policy explains what data we collect, how we use it, who we share it with, and what rights you have regarding your personal data. Please read it carefully before using our service.

2. Data We Collect

Our service is designed to minimise the personal data we collect. You do not need to create an account to use MyIQ. We collect the following categories of data:

2.1 Session Data

When you start a test, we generate an anonymous session ID and record timestamps (e.g. when the session was created and when each test section was started and completed). This session ID is not linked to any personally identifiable information such as your name or email address.

2.2 Test Responses

We collect your answers to the test questions so that we can calculate your results. These responses are stored against your anonymous session ID.

2.3 Test Results

Once your test is scored, we store the calculated IQ score and individual category scores (pattern recognition, numerical reasoning, verbal reasoning, and spatial reasoning) associated with your session.

2.4 Payment Data

Payment for test results ($2.99) is processed by our payment partner, Paddle, which acts as the Merchant of Record for all transactions. We do not collect, store, or have access to your credit card number, debit card number, or other financial payment instrument details. Paddle may share with us limited transaction information such as a transaction reference, purchase status, and the email address you provide at checkout so that we can fulfil your order. Paddle's handling of your payment data is governed by Paddle's Privacy Policy.

2.5 Technical Data

Like most websites, our servers automatically collect certain technical information when you visit our site. This may include your IP address, browser type and version, operating system, device type, referring URL, pages visited, and the date and time of your visit. This data is collected through standard web server logs and is used to ensure the security and proper functioning of our service.

2.6 Cookies

We use only essential cookies that are strictly necessary for the operation of our service, such as session management cookies. We do not use any tracking, analytics, or advertising cookies. For more details, see Section 9 below.

3. How We Use Your Data

We use the data we collect to:

• Provide the IQ test service, including presenting questions and recording your answers
• Calculate and deliver your test results, including your overall IQ score and category-level scores
• Generate a downloadable PDF certificate of your results
• Process payments for test results through our payment partner, Paddle
• Maintain the security and integrity of our service, including fraud prevention
• Improve and optimise our service based on aggregated, anonymised usage patterns

4. Legal Basis for Processing (GDPR Article 6)

Under the GDPR, we must have a valid legal basis for processing your personal data. We rely on the following legal bases:

4.1 Performance of a Contract (Article 6(1)(b))

Processing your session data, test responses, and test results is necessary to perform the contract between you and us — namely, to provide the IQ test you have taken and to deliver the results you have purchased.

4.2 Legitimate Interests (Article 6(1)(f))

We process certain technical data (such as IP addresses and browser information) on the basis of our legitimate interests in maintaining the security of our service, preventing fraud, and improving the quality of our offerings. We have assessed that these interests do not override your fundamental rights and freedoms.

4.3 Consent (Article 6(1)(a))

Where required, we will obtain your consent before processing your personal data. You have the right to withdraw your consent at any time by contacting us at support@myiq.is. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Data Sharing

We do not sell your personal data to third parties. We do not share your data with advertising networks. We share data only with the following categories of service providers, and only to the extent necessary to operate our service:

5.1 Paddle

Paddle acts as our Merchant of Record and processes all payments on our behalf. When you make a purchase, Paddle collects and processes your payment information directly. We share your session reference with Paddle so that we can link a completed payment to your test results. Paddle's processing of your data is subject to Paddle's Privacy Policy.

5.2 Supabase

We use Supabase as our cloud-hosted database and backend infrastructure provider. Your session data, test responses, and test results are stored on Supabase's servers. Supabase acts as a data processor on our behalf and processes data in accordance with our instructions and their Privacy Policy.

5.3 Legal Requirements

We may disclose your data if required to do so by law, or if we believe in good faith that such disclosure is necessary to comply with a legal obligation, protect our rights, or ensure the safety of our users.

6. Data Retention

We retain your data only for as long as necessary to fulfil the purposes for which it was collected:

• Test session data, responses, and results: Retained for 12 months from the date of your test, after which it is automatically deleted.
• Payment records: Retained for as long as required by applicable tax and accounting laws (typically up to 7 years), in accordance with Icelandic and EU legislation.
• Technical / server logs: Retained for up to 90 days for security and troubleshooting purposes.

You may request the deletion of your data at any time by contacting us at support@myiq.is. We will process your request without undue delay, subject to any legal obligations that require us to retain certain records.

7. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR. You may exercise any of these rights by contacting us at support@myiq.is:

• Right of Access — You have the right to request a copy of the personal data we hold about you.
• Right to Rectification — You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to Erasure ("Right to Be Forgotten") — You have the right to request the deletion of your personal data, subject to certain legal exceptions.
• Right to Restrict Processing — You have the right to request that we limit the way we use your data in certain circumstances.
• Right to Data Portability — You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
• Right to Object — You have the right to object to our processing of your personal data where we rely on legitimate interests as the legal basis.
• Right to Withdraw Consent — Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to the withdrawal.
• Right to Lodge a Complaint — If you believe that we have violated your data protection rights, you have the right to lodge a complaint with the Icelandic Data Protection Authority (Personuvernd): www.personuvernd.is.

We will respond to all legitimate requests within one month. In certain cases, we may need to verify your identity before processing your request. If your request is particularly complex, we may extend the response period by up to two additional months, in which case we will inform you of the extension and the reasons for the delay.

8. International Data Transfers

MyIQ is based in Iceland, which is part of the EEA. However, some of our service providers (such as Supabase and Paddle) may process data outside the EEA, including in the United States.

Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with the GDPR. These safeguards may include the European Commission's Standard Contractual Clauses (SCCs), adequacy decisions, or other legally recognised transfer mechanisms. You may contact us at support@myiq.is to obtain further details about the specific safeguards applied to any international data transfer.

9. Cookies

Cookies are small text files stored on your device when you visit a website. We use only strictly necessary cookies that are essential for the operation of our service:

We do not use any tracking cookies, analytics cookies, or advertising cookies. Because we use only strictly necessary cookies, consent is not required under the ePrivacy Directive.

10. Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete such data as soon as possible. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at support@myiq.is.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data. Your continued use of our service after any changes to this Privacy Policy constitutes your acknowledgement of those changes.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us:

13. Effective Date

This Privacy Policy is effective as of February 7, 2026.