Privacy Policy

• We collect an email address and your order details. That is essentially it.
• We never see or store your card number. Payments are handled by Paddle, our payment provider.
• We do not sell your personal information and we do not run advertising trackers.
• There are no accounts and no passwords on this site.

Side of You is operated by XU JUNYUAN, an individual seller based in China. For any question about your data, use the contact details at the end of this page.

• Your email address. Entered at checkout and passed to us by Paddle, so we can match a purchase to a test access and reply if you get in touch.
• Your order. The Paddle transaction reference, which test was bought, the amount, the currency, the country the payment came from, and when it was made.
• Your test access. A random access code, its status (available, in progress, completed or revoked) and, once the tests are live, when you started and finished.
• Your answers. When the tests themselves are live, the answers you give are stored so your result can be produced and is still there if you come back.
• Technical records. Routine server logs from our hosting provider, which can include an IP address and browser type. These are kept for security and for fixing faults.
• Messages you send us. If you email support, we keep that correspondence.

We do not collect or store card numbers, security codes or bank details — those go directly to Paddle. We do not ask for a phone number, postal address, government identifiers or a social media password. We do not collect health information, and nothing here is a medical record.

• To deliver the test you paid for and keep your result available to you.
• To confirm that a payment happened, and to stop the same payment being applied twice.
• To handle refunds, payment disputes and support requests.
• To keep the service secure and working — for example, to spot abusive automated traffic.
• To meet legal, tax and accounting obligations.

If you are in the UK or the EU, our legal bases are: performance of a contract (delivering your purchase), legitimate interests (security and fraud prevention), and legal obligation (tax and accounting).

• Paddle — the merchant of record for every purchase. Paddle processes the payment, works out and remits sales tax and VAT, sends the receipt you receive by email, and handles refunds. Paddle is an independent controller of the payment information it collects, and its own privacy policy applies to that.
• Supabase — hosts the database holding the records described above.
• Vercel — serves this website and keeps the server logs.
• Legal requirements — we may disclose information where we are legally required to, or to protect the rights and safety of our users.

We do not sell your personal information and we do not share it with advertisers. Some of these providers process data in the United States.

This site sets one cookie of its own: an essential cookie that holds your test access after a purchase. It is marked httpOnly, which means the page’s own scripts cannot read it, and it expires after 30 days. Without it the site could not recognise that you have already paid when you come back.

When you open the payment window, Paddle sets its own cookies on its domains to run the checkout and to prevent fraud. Those are governed by Paddle’s policies.

There is currently no analytics or advertising cookie on this site. If that changes, this page will say so before it happens, and any non-essential cookie will be opt-in.

• Order and payment records: as long as tax and accounting rules require, and for as long as a payment can be disputed.
• Test access and results: while your access is active, and afterwards if you have asked us to keep them or need help with a result.
• The access cookie: 30 days, or until you clear your browser cookies.
• Support emails: as long as needed to resolve the issue, and afterwards only if there is a reason to keep the record.

Depending on where you live, you may have the right to ask for a copy of your personal information, to correct it, to delete it, or to object to how it is used. California residents also have the right to know what is collected and to opt out of the sale or sharing of personal information — we do neither. We will not treat you differently for exercising any of these rights.

To make a request, email us from the address you used to buy the test, or tell us the transaction reference from your receipt. We may ask a question or two to confirm the request is really yours. If you are in the UK or the EU, you also have the right to complain to your local data protection authority.

Because buying a test does not create an account, the email address used at checkout is the only way we can find your record. If you paid with an address you no longer control, contact us and we will work something out.

This site is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has used the site, contact us and we will delete the record.

The site runs over HTTPS. Database access happens on the server only: the credentials that could read your record are never sent to a browser, and the payment provider’s secret keys are held as environment secrets. No system is perfect, but we keep the amount of data we hold small enough that the list above is the worst case.

If we change how your information is handled, we will update this page and the date at the top. Material changes will be described in plain words rather than quietly edited into the middle of a paragraph.

Email support@sideofyou.com, or see the contact page for what to include.