Legal

Privacy Policy

What SMP Assess collects, why, who handles it and where, and how to get it deleted. Readable, specific, and checked against how the product actually works.

My Plaza Pty Ltd, ABN 58 110 054 245

The short version

A plain-English summary. The numbered sections below are the full policy.

  • Respondent data belongs to the organisation

    When an employer or team lead sends you an assessment, they decide how your results are used. We process them only on their instructions.

    Section 2
  • We never sell data

    We do not sell, rent or trade personal information, and there are no advertising trackers on SMP Assess.

    Section 6
  • No AI training on your data

    AI features send only what a feature needs to OpenAI, whose API terms do not allow training on it. Every generation is logged for the workspace.

    Section 5
  • Delete it yourself

    Workspace owners can delete a workspace and everything in it from Settings. Respondents can ask the organisation, or us, to remove their data.

    Section 9
  • Named providers, stated locations

    Every service that touches personal data is listed here, with what it receives and where it runs.

    Section 7
  • People decide, not software

    Scores describe tendencies. We make no decisions about anyone, and require organisations to keep a person in charge of every decision.

    Section 10

1.Who we are and what this policy covers

In shortThis policy covers SMP Assess, run by My Plaza Pty Ltd in Australia. Free tests on SeeMyPersonality have their own policy.

SMP Assess is run by My Plaza Pty Ltd (ABN 58 110 054 245), Suite 1, Ground Floor, Enterprise 1, Innovation Campus UOW, Squires Way, North Wollongong NSW 2500, Australia ("we", "us"). We also run SeeMyPersonality and Quiz Maker.

This policy covers smpassess.com, the SMP Assess dashboard, assessment and invitation links, shared report pages, and the emails we send for the platform. It explains what personal information we handle, why, who we share it with, and the choices and rights you have. It forms part of our Terms of Service.

Free personality tests taken on www.seemypersonality.com are covered by the SeeMyPersonality Privacy Policy instead.

We handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, the EU and UK General Data Protection Regulation where they apply, and US state privacy laws including the California Consumer Privacy Act.

2.Our two roles: controller and processor

In shortFor customer accounts we decide how data is used. For respondents, the organisation that invited them does, and we act for it.

We play a different role depending on whose information it is.

Whose informationOur roleWho decides how it is used
Customers and team members: people who sign up for or use a WorkspaceControllerUs, as described in this policy
Respondents: people who take an assessment a Workspace sends or sharesProcessor (service provider)The organisation that owns the Workspace
Website visitors and people who contact usControllerUs, as described in this policy

If an organisation sent you an assessment

That organisation is responsible for your data. It chose the assessment, sees your results, and decides what they are used for and how long they are kept. Please contact it first with questions or requests about your data. If you cannot reach it, email support@seemypersonality.com and we will pass your request on and help where we can.

When we act as a processor, we use Respondent Data only to provide SMP Assess to the organisation, under our Terms of Service and any data processing agreement we have signed with it. We do not use it for our own marketing, and we never sell it.

3.What we collect

In shortAccount details from customers, answers and scores from respondents, and basic technical data from everyone.

Customers and team members

InformationWhenWhy
Name, work email, password (stored hashed), company nameSign-up, team invitationCreating and securing your account
Workspace settings, branding, logo, assessments you build, job descriptionsUsing the dashboardProviding the product
Billing name, address, country, tax details; card details are held only by StripeCheckoutPayment, invoices and tax
Messages you send us, with the page and plan they came fromContact form, support panel, emailAnswering you
AI prompts and outputsUsing AI featuresGenerating content, and the Workspace's AI audit log

Respondents (collected on behalf of the organisation)

InformationWhenWhy
Name, email address, and phone number if the organisation adds itThe organisation invites you, or you start from a shared linkSending the invitation and identifying your results
Your consent to the organisation's noticeBefore you startRecording that you agreed to take part
Answers, completion times, trait scores and generated reportsTaking the assessmentScoring and producing the reports the organisation sees
Whether invitation and reminder emails were delivered and openedAfter an email is sentLetting the organisation know an invitation arrived
Feedback, notes and ratings the organisation records about youThe organisation's own review processSupporting its interview and decision process

Everyone who visits

InformationWhy
IP address, browser, device and approximate location from request headersSecurity, abuse prevention, and routing requests
A random visitor ID, pages viewed, clicks, referrer and campaign tagsUnderstanding how the product is used and improving it
Experiment assignmentsTesting improvements fairly and consistently

We do not ask for sensitive information such as health, racial or ethnic origin, religion or sexuality, and organisations must not collect it through custom questions. Personality scores describe general tendencies and are not health information.

4.How we use information, and our legal bases

In shortTo run the product, bill for it, keep it secure, improve it, and meet our legal obligations.

PurposeLegal basis (GDPR)
Creating accounts, delivering assessments, scoring, reports, supportPerformance of our contract with the customer. For Respondent Data, the organisation's chosen basis.
Billing, invoicing and tax recordsContract and legal obligation
Security, fraud and spam prevention, rate limitingLegitimate interests in keeping the service safe
Product analytics and experiments to improve SMP AssessLegitimate interests, using pseudonymous identifiers
Service emails: invitations, reminders, receipts, security alertsContract
Occasional product news to customers, with an unsubscribe link in every emailLegitimate interests, or consent where the law requires it
Responding to lawful requests and enforcing our termsLegal obligation and legitimate interests

We use de-identified, aggregated statistics, such as score distributions across many assessments, to improve our instruments and norms. These never identify a person or organisation.

5.AI features

In shortOpenAI processes only what a feature needs, may not train on it, and every generation is logged.

Some features use OpenAI's models, for example to draft an assessment from a job description, suggest interview questions, or write report summaries, feedback and new-hire guides. For each request we send only what that feature needs, which can include a job description, your prompt, trait scores and bands, and for some features, such as the new-hire guide, the respondent's name.

  • OpenAI's API terms do not allow it to use this data to train its models.
  • Every generation is recorded in the Workspace's AI audit log (input, output, model and user), which owners and admins can review and export.
  • AI output is a draft for a person to review. It never makes a decision about anyone.

6.Who we share information with

In shortOnly the providers that run the service, the organisation you are assessed for, and authorities where the law requires it.

We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, and SMP Assess loads no advertising or third-party analytics scripts.

We share information only with:

  • The organisation that owns a Workspace, which sees its own Respondents' results;
  • People a customer chooses to share with, through report and interview-kit share links (these expire after 7 days by default) or public report pages;
  • Our service providers, listed below, under contracts that limit their use of the data to providing their service to us;
  • Authorities or other parties where the law requires it, or to protect people's safety or our rights; and
  • A buyer or successor if our business is sold, under the same protections.
ProviderWhat it doesInformation it handlesWhere
SupabaseDatabase and sign-inAll account and assessment data, encrypted at restIndia (Mumbai)
VercelHosting and request routingRequest data, including IP addressGlobal edge network; functions run in India (Mumbai)
StripePaymentsBilling details and payment methodUnited States and global
SendGrid (Twilio)Email deliveryRecipient name, email address, delivery and open eventsUnited States
OpenAIAI featuresFeature inputs as described aboveUnited States
CloudflareStorage for logos and images, email routingUploaded branding images, emails sent to our support addressGlobal network
Hetzner (our own servers)Product analytics storePseudonymous usage eventsGermany

7.Where information is stored, and international transfers

In shortOur main database is in India. Some providers run in the United States, Germany and elsewhere, with safeguards in place.

We are based in Australia. Our primary database is hosted in India (Mumbai), and our providers process information in the United States, Germany and other countries where they operate, as listed above. This means information may be processed outside the country where you live.

Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum, or another lawful mechanism. Where we disclose information outside Australia, we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles. Customers can ask for a data processing agreement at support@seemypersonality.com.

8.Cookies

In shortA small set of first-party cookies for sign-in, your workspace, analytics and experiments. No advertising cookies.

CookiePurposeLasts
sb-* (Supabase)Keeps you signed inYour session
smp-org-idRemembers which Workspace you are using7 days
smp_vidRandom visitor ID for product analytics, carried over when you arrive from seemypersonality.comUp to 2 years
smp_exp and smp_*_expKeeps you in the same version while we test an improvementUp to 180 days
smp_signup_src, smp_first_touchRecords which page or campaign brought you to sign upUp to 30 days
smp_claimCarries a team you started on SeeMyPersonality into SMP AssessShort-lived

All of these are set by us. We use Vercel Speed Insights to measure page performance, which sets no cookies. You can block or delete cookies in your browser settings. Sign-in will not work without the necessary cookies.

9.How long we keep information, and deleting it

In shortFor as long as the Workspace exists. Owners can delete everything themselves, and backups clear within 90 days.

InformationHow long
Account, Workspace and assessment data, including Respondent DataUntil the organisation deletes it or deletes the Workspace
AI audit logFor the life of the Workspace
Support messagesFor the life of the Workspace, or up to 2 years for people without one
Invoices and payment recordsAs long as tax law requires, generally 5 to 7 years, held by Stripe
Pseudonymous usage eventsAs long as they are useful for analytics, and never used to identify a person outside the product
BackupsDeleted data clears from backups within 90 days

Deleting a Workspace. The Workspace owner can open Settings, choose the Workspace tab, and select Delete workspace at the bottom of the page. This immediately and permanently deletes the Workspace, its assessments, Respondents, scores, reports and AI logs, cancels any subscription, and deletes team logins that belong to no other Workspace. If you cannot sign in, email support@seemypersonality.com from the owner's address and we will do it within 30 days.

Deleting a Respondent's data. Organisations can ask us to delete an individual Respondent's data at support@seemypersonality.com. Respondents should ask the organisation that invited them, or contact us if they cannot reach it.

10.Automated decision-making

In shortWe do not make decisions about people. Scores and AI output inform a person, who decides.

SMP Assess scores answers using published personality research and produces descriptive reports. It does not decide whether anyone is hired, promoted, rejected or dismissed, and it does not produce a pass or fail result. Our Terms of Service require organisations to keep a suitably qualified person in charge of every decision, and not to use results as the only basis for one.

If you believe a decision about you relied solely on automated processing, you can ask the organisation that made it for human review, to express your view and to contest the decision.

11.Security

In shortEncryption in transit and at rest, strict access controls, and logging of sensitive actions.

  • All traffic uses HTTPS with TLS encryption, and the database is encrypted at rest.
  • Access controls, including row-level security policies in the database, keep each Workspace's data separate.
  • Passwords are stored as salted hashes, never in plain text. Payment card details never touch our servers.
  • Assessment scoring runs on our servers, not in the browser.
  • Invitation links use random tokens, and we store only a hash of each one. Public report pages can be password protected.
  • Workspaces keep an audit log of key actions, and our contact forms have spam and abuse protection.

No system is perfectly secure. If we become aware of a breach that is likely to cause serious harm, we will notify affected customers, and the regulators and people we are required to notify, without undue delay. To report a security issue, email support@seemypersonality.com.

12.Your rights

In shortYou can access, correct, delete or export your information, and object to how it is used.

Depending on where you live, you may have the right to:

  • access the personal information we hold about you and get a copy in a portable format;
  • correct information that is inaccurate or incomplete;
  • delete your information;
  • object to, or ask us to restrict, processing based on legitimate interests;
  • withdraw consent where we rely on it, including unsubscribing from product emails at any time; and
  • know what categories of information we collect and share, and not be treated differently for exercising these rights (California and other US states). We do not sell or share personal information as those laws define it.

Email support@seemypersonality.com to make a request. We will verify your identity using the email address on your account and respond within 30 days. Respondents should direct requests to the organisation that invited them, and we will help that organisation respond.

Complaints. Please contact us first so we can try to fix it. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au), the UK Information Commissioner's Office (ico.org.uk), or your local data protection authority.

13.Children

In shortSMP Assess is for organisations. Account holders must be 18 or older and respondents 16 or older.

SMP Assess is not directed at children. Account holders must be at least 18, and organisations must not invite anyone under 16 to take an assessment. If you believe we hold information about a child under 16, email support@seemypersonality.com and we will delete it.

14.Changes to this policy and how to contact us

In shortWe date every change and email customers before significant ones.

We update this policy when our product, providers or the law change. The date at the top shows the latest version. If we make a significant change, we will email Workspace owners before it takes effect.

For any privacy question or request, email support@seemypersonality.com, use our contact page, or write to My Plaza Pty Ltd, Suite 1, Ground Floor, Enterprise 1, Innovation Campus UOW, Squires Way, North Wollongong NSW 2500, Australia.

Privacy questions or requests

Email support@seemypersonality.com or use our contact page. We respond within 30 days, and usually much sooner.

See also our Terms of Service.