Effective November 1, 2026
Data Privacy and Security Policy
How we collect, use, share, protect and delete personal data for our online assessment, results, Primal Question Profile and coach referral program.
1.Introduction and scope
This Data Privacy and Security Policy explains how Five Dates, LLC (the “Company”, “we”, “us” or “our”) collects, uses, shares, protects and deletes personal data in connection with the Seven Primal Questions assessment, its results, paid annual licenses (which include the Primal Question Profile), and our coach referral program. Sections 11 and 12 add details for people in the European Economic Area (EEA), the United Kingdom and California.
It applies to everyone who uses the assessment website, including people who take the assessment, people who buy an individual annual license, certified coaches who refer clients, organizations that license the assessment for their people and the administrators they designate, and members of our team who edit Primal Question Profile content.
Our assessment runs on a web platform operated for us by a third-party platform provider. The platform is a single multi-tenant web application: it hosts assessments for several businesses (“tenants”), and data is kept separate by tenant. It runs on our hosting provider, backed by one relational database and a sign-in service from our database and sign-in provider. The database stores assessment answers, results, names and email addresses; payment details are stored and handled by our payment processor, Stripe, not by us.
Where this policy describes what “we” do with data, that includes the platform provider acting on our behalf and under our instructions. This policy describes the system as built and what is live today for our assessment. Anything not yet live is labeled Planned.
Our assessment and services are intended for people 13 or older, and people aged 13 to 17 may use them only with a parent’s or legal guardian’s consent (see Section 2, Age requirement).
2.Age requirement
Our assessment and services are intended for people 13 or older. We do not knowingly collect personal data from anyone under 13. If we learn that we have collected personal data from someone under 13, we will delete it. People aged 13 to 17 may use our assessment and services only with the consent of a parent or legal guardian. Individuals under 18 may take the assessment and may buy the Primal Question Profile with the consent of a parent or legal guardian. When an organization licenses the assessment for its people, the organization is responsible for any participants under 18, including obtaining any parental consent required. For people in the EEA and the UK, see also Section 11 (Children).
3.What data we store and why
All data lives in one database provided by our database and sign-in provider, organized by tenant. Personal data sits mainly in five areas: assessment records, progress events, licenses and payments, coaches, and sign-in accounts. Other areas hold limited personal data (such as copies sent to email marketing and editor names) or none at all. The table below lists every area of the database.
Private browser code
Each assessment also has a random private code (token). It lets the browser that took the assessment see its own result before the person signs in. It is never shown to anyone else.
Why we use it
- Answers and results: to calculate and show your result, save your progress, and build your Primal Question Profile.
- Your details: to show and save your result, personalize your Profile, and send you relevant emails.
- Licenses and payments: to give people covered by an active individual or organizational annual license access to the Primal Question Profile and other paid content, to process renewals, and for tax and accounting.
- Coach details: to run the coach referral program.
- Editor details: to record who changed our Primal Question Profile content.
- Technical and usage data: to run the site securely, block floods of requests and bots, and improve the public pages.
- De-identified and aggregate data: we may remove names, email addresses and other identifying details from answers and results, and combine them with other people’s data. We may use this de-identified or aggregate data to improve the assessment and for other purposes. We do not try to re-identify it.
| Data area | What it holds | Personal data |
|---|---|---|
| Assessment records | One record per assessment taken: answers, result, and a link to an account if there is one | First name, email, work role, answers. IP address and browser fields exist but are empty: we never collect them |
| Progress events | Step-by-step progress (started, question answered, details captured, result shown) | Answers per question; the “details captured” event repeats the name and email typed in |
| Licenses and payments | License purchases, annual renewals and their status | Stripe checkout and payment reference numbers, amount, status. No card data |
| Sign-in accounts | People who saved a result, bought a license, or edit Primal Question Profile content | Email; password, stored only in hashed form |
| Coaches | Certified coaches and their referral codes | Name, email, phone, business name |
| Editor roles | Who can edit our Primal Question Profile content (owner or editor role) | A link to a sign-in account only |
| Email marketing sync copies | Copies of what we send to our email marketing provider (only for people who take the assessment on their own), kept for retries and the sync log | Email, first name, result, work role |
| Primal Question Profile content and edit history | Our Primal Question Profile content and every saved edit | Editor name on each edit |
| Configuration | Branding, assessments, questions, answer options, scoring, result types and versions, results copy | None |
| Built for later use | An audit log, integration settings and an accounts area (Planned use) | None yet |
4.How the system is organized
Your browser connects to the platform over encrypted connections (HTTPS). The platform’s pages and server code run on our hosting provider. Secret keys and credentials are kept only on our servers, never in your browser.
Outside services fall into two groups:
- Loaded in your browser: our analytics provider (public pages only), the bot check, and the checkout page of our payment processor, Stripe (card details).
- Called by our server: our email marketing provider (email, name, result; only for people who take the assessment on their own), Stripe (payment updates), our rate-limiting/caching provider (rate-limit counters) and our transactional email provider (all email).
The assessment, your results area and your Primal Question Profile run in your browser; the Profile PDF is saved on your own device; we do not store any complete PDFs.
How email is sent
Each business on the platform sends email under its own name and its own authenticated sending domain, through our transactional email provider. Replies to our emails come to our own inbox.
5.Who can access what
The public cannot read or write our database directly. Requests go through our server, which checks who is asking before it reads or saves anything.
Database access rules are switched on for every table. They limit each business’s members and editors to that business’s own data, and access to personal data is limited to authorized staff and to the platform provider acting for us.
Your account
You need an account with a password to buy and use your Primal Question Profile. You sign in with your email address and password. Results under the same verified email address are attached to your account. Attaching a result to your account does not share it with an organization.
Organizational licenses
When an organization licenses the assessment for its people, the administrators it designates can see the individual results of the participants who take the assessment under that license. Participants are told this before they take the assessment. Administrators see only their own organization’s participants. Results taken outside an organization’s license are never visible to that organization’s administrators. The organization is responsible for how it uses those results under our Terms of Use, which welcome workplace use for team development, coaching, communication and self-awareness but do not allow results to be the basis for hiring, firing, promotion, compensation or discipline decisions or for screening candidates. Participants under an organization’s license are never added to or contacted through our email marketing provider. The organization is responsible for any participants under 18, including obtaining any parental consent required.
| Who | How they get in | What they can see or do |
|---|---|---|
| Anyone on the public site | No sign-in | Take the assessment and see their own result. All reads and writes go through our server, never straight to the database |
| A person who took the assessment | Their browser’s private code, or signing in to their account with email address and password | Their own results and results area. Paid content and the Primal Question Profile only while covered by an active annual license (their own or their organization’s) |
| Coaches | Sign-in on the coach dashboard | People who took the assessment through their referral link (first name, email, result, date). Full results only if that person chose to share them |
| Organization administrators | Sign-in, as an administrator designated by an organization that holds a license | Individual results of the participants who took the assessment under their organization’s license. No access to other organizations’ participants or to results taken outside their organization’s license |
| Profile editors (our team) | Sign-in, plus an owner or editor role for our business | Edit and publish our Primal Question Profile content in the Profile editor. No access to other businesses |
| Platform administrators (platform provider) | Restricted administrator sign-in | Admin pages: the email marketing sync log and the coach list |
| Our server code | Protected server credentials, never sent to a browser | Full database access, used only after the code has checked who is asking |
6.Security controls
These controls are live today.
| Area | Control |
|---|---|
| Encryption | All connections use HTTPS. Stored data is encrypted at rest by our database and hosting providers. |
| Access control | Database access rules on every table. Each business sees only its own data, and access to personal data is limited to authorized staff. |
| Sign-in | Accounts use an email address and password through our database and sign-in provider; passwords are stored only in hashed form, never in plain text. A bot check runs on every sign-in. |
| Keys and credentials | Kept only in protected server settings, never in browsers or in our code. |
| Abuse protection | Rate limits, request size limits and bot checks protect forms and sign-in from automated abuse. |
| Payments | Card details are handled by our payment processor, Stripe. Payment notifications are verified, and refunds and disputes remove access to paid content. |
| Analytics privacy | Analytics are off on private pages and mask all typed text everywhere else. |
7.Backups and recovery
We back up all data, including sign-in accounts, every day with our database provider (kept 7 days) and every night to separate, encrypted off-site storage (kept 30 days).
| Layer | What it gives us | Status |
|---|---|---|
| Daily backups | Restore the whole database to any of the last 7 days | Live |
| Nightly off-site backup | Every night, an encrypted copy of all app data and sign-in accounts is stored off-site, separate from our database provider, and kept 30 days | Live |
| Point-in-time recovery | Restore to a recent point in time | Not enabled; Planned |
| Profile content history | Every edit to Primal Question Profile content is kept and can be restored from the Profile editor | Live |
| Code and deployments | Code is kept with our code repository provider, and past deployments can be restored | Live |
| Copies held by partners | Our email marketing provider keeps our contacts and tags; our payment processor, Stripe, keeps every payment record | Live |
8.Outside services and subprocessors
Ten outside companies process personal data for the platform. Each has a data protection agreement in place, except where marked below. Beyond names and email addresses, two providers hold assessment results and work roles on an ongoing basis: our database and sign-in provider (everything) and our email marketing provider (result and work role).
All of them process data in the United States.
| Provider | Role and data received | Data agreement |
|---|---|---|
| Platform provider | Builds and operates the platform for us. Access to all data described here | Service relationship |
| Database and sign-in provider | Database and sign-in. Everything listed in Section 3 | Published data processing addendum |
| Hosting provider | Hosts the website and server code. Every web request passes through it (IP address, browser, pages visited) | Published data processing agreement |
| Payment processor (Stripe) | Payments for annual licenses and their renewals, on Stripe’s own checkout page, through our own Stripe account. Stripe charges for the first year and each renewal and tells us when a payment succeeds, is refunded or is disputed; a refund or dispute removes access. Buyer email, card details and payment records; we keep only reference numbers, amount and status | Published data processing agreement |
| Email marketing provider | Our email marketing (our own account). Email, first name, result, second-highest question, work role, and tags (completed, retook, purchased, coach sign-up). Live site only; never participants under an organization’s license | Data processing agreement in place |
| Transactional email provider | All email: account emails, confirmations, alerts and coach invitations. Recipient name and email, and the message itself | Published data processing addendum |
| Backup storage provider | Off-site storage for our encrypted backups | Published cloud data processing addendum |
| Code repository provider | Hosts our code and runs automated backup jobs | Published data protection agreement |
| Analytics provider | Session recording and heatmaps on public pages: clicks, scrolls and page views, typed text masked. Off on private pages | Data processing agreement in place; covers session recording |
| Rate-limiting/caching provider | Rate limiting (blocks floods of requests). Short-lived counters keyed by IP address | Published data processing addendum |
| Bot-check provider | Bot check on forms (lead capture, saves and sign-in). Browser signals during the check | Published data processing addendum |
9.Data retention and deletion
We keep personal data only as long as it serves you or a legal need, and delete it on request within 30 days.
| Data | Kept for | Then |
|---|---|---|
| Results covered by an individual license | While the license is active, then 3 years after the license ends or after last activity, whichever is later | Deleted with their progress events |
| Results covered by an organizational license | While the organization’s license is active, then 12 months after it ends, unless the order form sets a different period | Deleted with their progress events |
| Results with an email or account, never covered by a license | 3 years after last activity | Deleted with their progress events |
| Anonymous results (no email, no account) | 12 months | Deleted |
| Progress events | 24 months | Deleted; counts kept without names or emails |
| Email marketing sync copies | 90 days after the provider confirms | Deleted |
| License purchases and renewals | 7 years (tax and accounting) | Deleted; our payment processor, Stripe, keeps its own records |
| Coach records | While the coach is active | Deleted 12 months after they leave |
| Primal Question Profile content and edit history | Indefinitely (no personal data beyond editor names) | Kept |
| Backups | 7 days (daily) and 30 days (off-site) | Roll off on their own, so a deletion leaves every backup within 30 days |
How we handle your request
You can ask for your data, or its deletion, by emailing us at hello@primalquestion.com (or our platform provider). Response times for people in the EEA, the UK and California are set out in Sections 11 and 12. We then:
- Verify. Confirm the request comes from the email address on the result.
- Export. Send your results, answers and license and payment records as a file within 30 days.
- Delete. Within 30 days, delete your results, progress events, email marketing sync copies and sign-in account. We keep license and payment records for tax, without your answers.
- Email marketing. Remove you as a contact from our own email marketing account (the account is ours, so we do this step ourselves).
- Record. Log the request and the date it was completed.
10.Planned items
These items are not live today. We list them so it is clear what is and is not in place.
| Item | Status |
|---|---|
| Point-in-time recovery | Planned |
| Automated deletion | Planned; deletion is done manually today |
| Audit log, integration settings and accounts areas | Built for later use; hold no data yet |
11.People in the EEA and the UK (GDPR)
This section applies if you are in the European Economic Area (EEA) or the United Kingdom. It adds to the rest of this policy and explains how we meet the EU General Data Protection Regulation (GDPR) and, for the UK, the UK GDPR and the Data Protection Act 2018.
Who is responsible for your data
Five Dates, LLC is the controller of the personal data of people who take the assessment on their own, buy an individual annual license, or join our coach referral program. When an organization licenses the assessment for its people, the organization is the controller of its participants’ personal data, and we act as its processor where applicable: we process that data only on the organization’s instructions and under our Data Processing Addendum, available on request. We do not use that data for our own marketing, and participants are never added to or contacted through our email marketing provider. Participants should send requests about that data to their organization; if they send them to us, we will pass them on and help the organization respond. The outside services in Section 8 act as our processors (subprocessors).
Lawful bases for processing
We rely on these lawful bases for each purpose:
| Purpose | Lawful basis |
|---|---|
| Calculating and showing your result, saving your progress and building your Primal Question Profile | Contract: to provide the assessment and results you ask for |
| Your account, sign-in, and access to paid content under your annual license | Contract |
| Payments, renewals, invoices, and tax and accounting records | Contract; legal obligation (tax and accounting) |
| Service emails, such as account emails, receipts and renewal reminders | Contract |
| Marketing emails about our assessment and services | Consent where the law requires it; otherwise legitimate interests. You can opt out at any time |
| Sharing your full results with a coach | Consent: you choose to turn sharing on |
| Running the coach referral program for certified coaches | Contract |
| Security, rate limiting, bot checks and fraud prevention | Legitimate interests: keeping the service and its users safe |
| Analytics on public pages | Consent where the law requires it, such as for cookies or similar technologies; otherwise legitimate interests |
| De-identified and aggregate data to improve the assessment | Legitimate interests |
| Responding to legal requests and keeping required records | Legal obligation |
| Participant data under an organization license | We process it only on the organization’s instructions and do not use it for our marketing; the organization decides its lawful basis |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. Where we rely on consent, you can withdraw it at any time; withdrawing does not affect processing that happened before.
Your rights
Subject to the conditions and exceptions in the law, you have the right to:
- Access: get a copy of your personal data and information about how we use it.
- Rectification: have inaccurate data corrected and incomplete data completed.
- Erasure: have your data deleted.
- Restriction: ask us to limit how we use your data.
- Portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organization.
- Objection: object to processing based on legitimate interests, and object at any time to direct marketing.
- Withdrawal of consent: withdraw consent at any time where we rely on it.
- Automated decisions: not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.
Automated scoring
The assessment scores your answers automatically to produce your result. The result is for self-reflection and personal development only. It does not produce legal or similarly significant effects on you, and our Terms of Use do not allow organizations to use results as the basis for hiring, firing, promotion, compensation or discipline decisions or for screening candidates. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.
How to exercise your rights
Email us at hello@primalquestion.com. We will respond within one month of receiving your request. If a request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you within the first month. We may need to confirm your identity first. We do not charge a fee unless a request is clearly unfounded or excessive.
You also have the right to complain to a data protection supervisory authority, in particular in the EEA country where you live or work, or where you believe an infringement took place. In the UK, the supervisory authority is the Information Commissioner’s Office. We would welcome the chance to address your concern first.
International transfers
We are based in the United States, and we and our outside services process personal data in the United States (Section 8). When personal data is transferred from the EEA or the UK to the United States, we rely on the EU-U.S. Data Privacy Framework and its UK Extension where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum for UK data) or another transfer mechanism the law allows. You can ask for more information about these safeguards by emailing hello@primalquestion.com.
How long we keep data
We keep personal data only as long as we need it for the purposes in this section: to provide the assessment, your results and your license, to run the coach program, to keep records the law requires, and to resolve disputes. Section 9 sets out the retention period for each type of data.
Children
The minimum age for our assessment and services is 13, and people aged 13 to 17 need the consent of a parent or legal guardian. Individuals under 18 may take the assessment and may buy the Primal Question Profile with a parent’s or legal guardian’s consent, and organizations are responsible for their participants under 18, including any parental consent required (Section 2). In the EEA and the UK, the age at which a child can consent to online services may be higher than 13; it is 16 in some EEA countries. Where we rely on consent and a person is under the age of digital consent in their country, we rely on the consent of their parent or legal guardian.
12.California residents (CCPA)
This section applies to California residents. It adds to the rest of this policy and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Terms such as “personal information”, “sell”, “share” and “sensitive personal information” have the meanings given in the CCPA.
Personal information we collected in the last 12 months
In the last 12 months we collected the categories of personal information below, from the sources shown, and disclosed them for business purposes to the categories of recipients shown. Personal information of participants under an organization’s license is never disclosed to our email marketing provider.
| Category and examples | Sources | Disclosed for a business purpose to |
|---|---|---|
| Identifiers: name, email address, phone number (coaches), account and payment reference numbers, IP address | You; your organization or coach; your device | Platform provider; database and sign-in, hosting, payment (Stripe), transactional email, rate-limiting and bot-check providers; email marketing provider (only people who take the assessment on their own) |
| Customer records: name, email, phone number and payment records (card details are collected by our payment processor, Stripe) | You; Stripe (payment processor) | Stripe (payment processor); platform provider; database provider |
| Commercial information: licenses bought, renewals, refunds and disputes | You; Stripe (payment processor) | Stripe (payment processor); platform provider; database provider; email marketing provider (license purchase tag, individual buyers only) |
| Internet or other network activity: pages visited, clicks, scrolls, progress through the assessment, browser signals | Your device | Hosting, analytics, rate-limiting and bot-check providers; database provider |
| Professional or employment-related information: work role; participation under an employer’s license; coach business name | You; your organization | Database provider; email marketing provider (work role only, for people who take the assessment on their own); your organization’s administrators |
| Inferences: your assessment answers and result | Your answers | Database provider; email marketing provider (result only, for people who take the assessment on their own); your organization’s administrators (organization licenses); your coach if you turn sharing on |
| Sensitive personal information: payment card details, and account log-in (email address with password, stored only in hashed form) | You, directly to our payment processor, Stripe (card details); you (account password) | Stripe (payment processor); database and sign-in provider (hashed passwords) |
Business purposes
We use each category for the purposes in Section 3 (Why we use it): providing the assessment, your results and Primal Question Profile, and your license; processing payments and renewals; running the coach referral program; sending service and marketing emails; keeping the Services secure and preventing fraud and bots; fixing and improving the Services; and meeting legal obligations.
No sale or sharing
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the last 12 months. Our analytics and email marketing providers process data for us as service providers, not for their own advertising.
Sensitive personal information
We use and disclose sensitive personal information only for purposes the CCPA permits, such as processing your payment through Stripe, providing the Services you ask for, and security and fraud prevention. We do not use it to infer characteristics about you.
Your California rights
Subject to exceptions in the law, you have the right to:
- Know and access: the categories and specific pieces of personal information we hold about you, its sources, why we use it, and who we disclose it to.
- Delete: the personal information we collected from you.
- Correct: inaccurate personal information.
- Opt out of sale or sharing: we do not sell or share personal information, but you may still make this request.
- Limit use of sensitive personal information: we already limit it to permitted purposes, but you may still make this request.
- Non-discrimination: we will not deny you the Services, charge you a different price or give you a different level of service because you used these rights.
How to make a request
Email us at hello@primalquestion.com. We will confirm receipt within 10 business days and respond within 45 days. If we need more time, up to another 45 days, we will tell you why. To protect your data, we verify your identity by matching what you give us to what we hold, usually by confirming the request comes from the email address on your account or result. You may use an authorized agent; we may ask for your signed permission and ask you to verify your identity with us directly.
Employee data from organization customers
When an organization customer gives us, or has us collect, personal information about its employees or other participants, we act as its service provider or contractor under the CCPA. We use that information only to provide the Services to the organization under our contract, as the CCPA allows. We do not sell or share it, or combine it with personal information from other sources except as the CCPA permits. We may refer participants’ requests to their organization. Participants are never added to or contacted through our email marketing provider.
Retention
We keep each category for the periods in Section 9. Identifiers, inferences, characteristics and professional information that are part of results are kept with those results. Commercial information and customer records are kept with license and payment records. Network activity is kept as progress events or short-lived counters. Coach records are kept while the coach is active and then deleted.
Shine the Light
California Civil Code Section 1798.83 lets California residents ask for information about personal information we disclosed to third parties for their own direct marketing purposes in the previous calendar year. We do not disclose personal information to third parties for their own direct marketing purposes. Questions can be sent to hello@primalquestion.com.
Do Not Track and Global Privacy Control
There is no common standard for responding to browser Do Not Track signals, so our site does not change how it works when it receives one. We do not track you over time across third-party websites, and we do not allow third parties to do so on our site for advertising. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing for that browser; because we do not sell or share personal information, nothing else changes.
13.Your rights and choices
You can ask us to give you a copy of your data, correct it, or delete it. De-identified or aggregate data is no longer personal data and is not covered by deletion requests. You can unsubscribe from our marketing emails at any time. Signing in, buying a license, and sharing your full results with a coach are all optional. If you are in the EEA or the UK, see Section 11; if you are a California resident, see Section 12.
How to make a request
To make a request or ask a question about this policy, email us at hello@primalquestion.com. We may need to confirm your identity before acting on a request.
Changes to this policy
We may update this policy from time to time. When we do, we will post the updated version with a new effective date. If changes are significant, we will take reasonable steps to let you know.
Effective date
This policy is effective as of November 1, 2026.