Privacy statement

What we do with your data, why, who receives it and what you can control yourself.

Last updated: 6 November 2026

In short

You take the free test without an e-mail address.
We keep every test, free or paid, on our server: your answers, how long you took for each question, your scores and a few details about your device. We do not keep your name or your IP address with it.
We do this for your result, to improve the test and the norms, for research and to recognise tests that were filled in automatically. For that we keep your answers and timings without a fixed end date.
If you want to see your result again later, you can leave your e-mail address. We then e-mail you one link to your result and nothing else.
Only for the paid personal report do we send data to OpenAI, which writes the text: your scores, part of your answers to the test statements and what you tell us about yourself. Never your name or e-mail address.
If you buy the personal report, we keep your e-mail address, your answers and your report with your purchase, on a server in the EU.
You pay through Stripe. We never see your card or bank details.
Your answers, scores and pattern never go to advertisers. We use no cookies for advertising or to track you, and we never sell your data.

Who is responsible

DepthFive is offered by Sphereness, Hermenstraat 12, 5712 CV Someren, registered with the Dutch Chamber of Commerce (KvK) under number 17215839. We are the controller of your data: we decide why and how it is used.

Questions about privacy? E-mail support@depthfive.com. All our details are on the contact page.

Which data we use, and why

For each part of the website you can read which data we use, why, and on which legal basis under the privacy law (the GDPR).

The free test and your result

You answer the questions of the short test and, if you like, fill in your age and gender. Our server uses them to calculate your scores and compares them with the full reference group and, with age and gender, with people like you. The server sends your result back. It then stays in your browser until you close the tab. What we keep of your test on our server is described below.

Legal basis: providing the service you ask for (Article 6(1)(b) GDPR). Age and gender are optional. Without them we only compare with the full reference group.

What we keep of every test

For every test you start, free or paid, we keep a test attempt on our server. It holds:

your answers, and for each question: how long the question was on screen, how long you took to answer, whether and how often you changed your answer, whether you went back to the question, how long the page was in the background, and whether you used the mouse, your finger or the keyboard;
when you started, which question you reached (also if you stop early) and when you finished;
your scores, and your age and gender if you filled them in;
the language of the website, the type of device (phone, tablet or computer) and the type of browser (for example Chrome or Safari). We do not keep the full browser string;
where you came from: of the website with the link, only the domain and the page, without the rest of the address, and the campaign tags in the link (utm), if there were any;
a code we derive from your IP address. We do not keep your IP address itself. The code changes every day and we delete it after 30 days.

Why: to calculate your result, to improve the test and the norms, for research, and to recognise when a test was filled in automatically, for example by a program.

Filled in automatically: when you finish, our server looks at signals such as very fast answers, long runs of the same answer, answers that contradict each other and a hidden field that people do not see. An attempt with such signals gets a mark and does not count towards the norms. We never use that mark to block anyone or to make a decision about anyone. You always get your result as usual.

We keep your answers and timings without a fixed end date, for research. They are not linked to your name or e-mail address, unless you bought something or left your e-mail address after your result. How long we keep the rest is listed under how long we keep data.

Legal basis: for your result, providing the service you ask for (Article 6(1)(b) GDPR). For improving the test and the norms, for research and for recognising tests filled in automatically: our legitimate interest (Article 6(1)(f) GDPR). You may object to this, see your rights.

Keeping your result with your e-mail address

After your result you can, if you like, fill in your e-mail address. We keep it with your test attempt and e-mail you one link to your saved result. We e-mail you nothing else for it: no newsletter and no advertising. Anyone with the link can see your result, so keep the e-mail to yourself. If you request the link again, we make a new link and the old one stops working. Our database only holds the link in a form that cannot be read.

If you then buy the personal report, we fill in this e-mail address for you on the payment page.

Legal basis: providing the service you ask for (Article 6(1)(b) GDPR).

Buying the personal report

If you choose the personal report, we ask for your e-mail address. As soon as you go to checkout, we store an order with your e-mail address, your language, your answers to the free test, your age and gender (if you filled them in) and a reference to your free test attempt. That way you can continue where you left off after paying. After payment we move your answers, age and gender to your purchase and remove them from the order. After payment we also store the amount, the payment status and the references Stripe gives us for the payment.

The payment itself happens on the Stripe payment page. Stripe processes your payment details, such as your card number or bank account. We never see them.

Legal basis: our contract with you (Article 6(1)(b) GDPR) and our legal duty to keep accounting records (Article 6(1)(c) GDPR).

Access to your report

You have no account with us, and we do not use passwords. Right after your payment, the device you paid on gets access to your purchase. On another device you open your purchase with a link we e-mail to you. The link in the e-mail after your purchase and in the e-mail that your report is ready works for 24 hours, a link you request yourself for 15 minutes; each link works once. The device you open it on then keeps access to that purchase only, until 30 days after your last visit. If you use a computer that others use too, such as at work or in a library, tick that box: your access then ends when you close the browser, or 2 hours after your last visit. For that we keep only a code that cannot be read, no IP address and no details about your browser.

Legal basis: our contract with you (Article 6(1)(b) GDPR). For security: our legitimate interest in a secure website (Article 6(1)(f) GDPR).

The remaining questions and your personal report

After your payment you can first answer a few questions about yourself: your goal, your situation and a question of your own, in your own words. You can also fill in or change your age and gender there. These questions are optional. Then you answer the remaining 100 questions. We keep your answers with your purchase, and we also keep this test as a test attempt, as described above.

When you have answered all questions, we send your scores, your Depth Pattern, part of your answers to the test statements (the statement with your answer), your age, your gender and your answers to those questions about yourself to OpenAI, which writes the text of your report. This is the only time data goes to OpenAI. We do not send your name or e-mail address. So please do not write names or other details you would rather not share in your own words. We keep the report with your purchase, so you can read it again later.

Legal basis: our contract with you (Article 6(1)(b) GDPR).

E-mail from us

We only e-mail you in these cases: the link to your saved result if you ask for it, the confirmation of your order with a link to continue, the message that your report is ready, and the links to your purchases if you ask for them again. No newsletters and no advertising. We send these e-mails through Resend.

Legal basis: providing the service you ask for, or our contract with you (Article 6(1)(b) GDPR).

Security and misuse

To prevent misuse and high costs, our server counts per IP address, and for e-mails also per e-mail address, how often someone requests, for example, the links to a purchase, a payment or an e-mail with the link to a result. This happens only in the server’s working memory and is gone within an hour. Our web server also keeps technical log files, including IP addresses. We keep those for 14 days.

Legal basis: our legitimate interest in a secure and affordable website (Article 6(1)(f) GDPR).

When you e-mail us

If you e-mail us, we use your e-mail address and your message to help you. Legal basis: our legitimate interest in answering your question, or our contract with you if your question is about your purchase (Article 6(1)(f) and (b) GDPR).

What we never do with your answers

Your answers, scores and pattern never go to advertisers. We do not sell your data, and this website shows no advertising from others.

Who receives your data

We work with a few companies that process data for us. With each of them we have agreements on security and confidentiality (a data processing agreement). They may not use your data for their own purposes, except Stripe for the purposes listed below.

Hosting: Our website and database run on our own server at OVHcloud in France.
OpenAI: Writes the text of your personal report, only if you bought it. OpenAI does not use data sent through its API to train its models, and keeps it for at most 30 days to detect misuse. OpenAI processes the data in the United States.
Stripe: Processes your payment. Our contract is with Stripe Payments Europe, Limited in Ireland. For some purposes, such as preventing fraud and complying with anti-money-laundering laws, Stripe decides itself how it uses your data. For that, Stripe’s privacy policy applies.
Resend: Sends our e-mails, such as the links to your purchase and the link to your saved result. Resend is a company in the United States.

Apart from that, we only share your data when the law requires it, for example by court order. We never sell your data.

Data outside Europe

OpenAI, Resend and, in part, Stripe process data in the United States. That is only allowed with the safeguards the GDPR requires. We use two:

the EU-US Data Privacy Framework: the European Commission has decided that companies certified under it protect your data adequately. Stripe and Resend are certified;
the standard contractual clauses of the European Commission, which are part of the data processing agreements.

Would you like to know which safeguard applies to each company, or receive a copy? E-mail us.

How long we keep data

Your result in your browser: Until you close the tab or window.
Your test attempts: answers, timings and scores: Without a fixed end date, for research. Not linked to your name or e-mail address, unless you bought something or left your e-mail address.
The code of your IP address: 30 days. We do not keep your IP address itself.
Your e-mail address and the link to your saved result: Until two years after your last visit to your saved result. After that we delete your e-mail address and the link stops working. Your answers and scores stay, without the e-mail address, for research.
An order you do not complete: If you start checkout but do not pay, we delete the order with your e-mail address and answers after 30 days.
Your e-mail address, answers and reports: For as long as you may want to open your purchase: we do not delete them on our own. If you ask us to delete your data, we erase your e-mail address, your reports and the access to your purchases within one month. Your test attempts stay for research, without a link to your e-mail address.
Order and payment records: Seven years, because Dutch tax law requires it. Also when you have your data deleted. Your answers are not part of them: they are kept with your purchase.
Links to your purchase and access per device: The link in the e-mail after your purchase and in the e-mail that your report is ready works for 24 hours, a link you request yourself for 15 minutes; each link once. We delete a used or expired link within an hour. A device keeps access until 30 days after your last visit, a shared computer until 2 hours after it or until the browser closes, or until you click "Forget this device".
IP addresses for the limits: At most one hour, only in the server’s working memory.
Web server log files: 14 days.
E-mail to us: Two years after your question has been dealt with.
At OpenAI: At most 30 days.

Cookies and storage in your browser

We only use cookies and browser storage that the website needs to work. These need no consent (Article 11.7a of the Dutch Telecommunications Act). That is why you see no cookie banner here. We use no cookies for statistics, advertising or tracking.

df_access (cookie): Gives this device access to your personal report, after you have just paid or opened the link from our e-mail. Only if you bought a report. It holds no name or e-mail address, only a random code. Works until 30 days after your last visit. If you tick that you use a shared computer, it goes when you close the browser and works at most 2 hours after your last visit. The "Forget this device" button ends it at once.
Session storage (sessionStorage): Keeps your answers, your age and gender, your result, the number of your test attempt, where you came from (see what we keep of every test) and the e-mail address you enter for the personal report during your visit. This stays on your own device only and is gone when you close the tab.
depthfive-locale (localStorage): Remembers which language you chose, so we do not ask again whether you want the website in another language. Only if you choose a language or close that question. Stays until you clear it in your browser.

On the Stripe payment page, Stripe sets its own cookies, for example to prevent fraud. You can read more in Stripe’s cookie policy.

If we later start, for example, counting visitors, we will update this statement first, and ask for your consent where needed.

How we protect your data

Traffic between you and the website is encrypted (https).
You open your report without a password, with a link that works once and only briefly.
Your personal report can only be seen on a device you gave access with such a link, or right after your payment. Personal pages are not shown in search engines.
Our database only holds the links to your saved result and your purchases, and the access per device, in a form that cannot be read.
Only people who need the data for their work can access it.

AI and decisions about you

Our server calculates your scores with fixed formulas, not with AI. The AI only writes the text of your personal report. No decisions follow from it that have legal effects for you or affect you in a similar way (Article 22 GDPR). The same goes for the mark on a test that seems to be filled in automatically: we never use it to block anyone or to make a decision about anyone.

Your rights

About your own data, you can ask us:

which data we hold about you, with a copy (access);
to correct data that is wrong (rectification);
to delete your data, except what the law requires us to keep (erasure);
to temporarily limit the use of your data (restriction);
to give your data in a common file format to you or to someone else (portability);
to stop any use that is based on our legitimate interest (objection).

E-mail your request to support@depthfive.com, preferably from the e-mail address of your purchase or the address your result was sent to. That way we know it is you and which data is yours. We respond within one month.

If you bought nothing and left no e-mail address, we do not know which test attempt is yours. In that case we cannot show or delete it.

If you ask us to delete your data, we erase your e-mail address, your reports, the access to your purchases and the e-mail address with your test attempt. We keep your answers, timings and scores for research, without a link to you. If you object to that use for research, we delete your test attempts too. We keep order and payment records for seven years, because the law requires it.

Making a complaint

Not happy with how we handle your data? Please tell us first, so we can find a solution together. You can always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the supervisory authority in the country where you live.

Age

DepthFive is meant for people aged 16 and over. If you are under 18, you may only buy the personal report with permission from your parent or guardian.

Changes

When the website changes, we update this statement. The date at the top shows when that last happened. If it is a major change and you bought something from us, we will tell you by e-mail.