Privacy Policy
This policy explains what personal data 41Q processes, why, for how long and what rights you have.
Updated 22 August 2026
1. Controller and contact
The controller is Raketforskning AB, Swedish organisation number 556908-7496, VAT number SE556908749601, 4:e Villagatan 10, 653 41 Karlstad, Sweden. The company is represented by managing director Robert Carlesten. Privacy requests: [email protected]. No data protection officer has been appointed.
2. Data processed
When you take the legacy personality test, your selected answers are submitted for calculation and a result code is placed in the result URL. 41Q does not ask you to create an account or provide your name for the test. Anyone who receives a result link may be able to view that result, and legacy result links do not have a fixed technical expiry.
When you visit, technical logs may contain IP address, date and time, requested URL, referrer, device, browser and security signals. If you email us, we process your address and message. Google and Meta technologies may process online identifiers, device information, URLs and events as described in the Cookie Policy.
3. Purposes and legal bases
Test answers are processed to provide the result you request, under Article 6(1)(b) GDPR. Service delivery, security, abuse prevention and limited technical logging rely on our legitimate interest in operating a safe service, Article 6(1)(f). Contact messages are processed to reply and, depending on the request, for contractual steps or legitimate interests.
Where consent is legally required for analytics, advertising or social-media technologies, the intended basis is Article 6(1)(a). Current technical limitation: non-essential tags may load when a page opens, before a visitor has made a valid consent choice. This is disclosed in the Cookie Policy and remains an open compliance exception.
4. Recipients and international transfers
Providers may process data for hosting, CDN/security, email, analytics, advertising and social functions. They can include WP Engine, Cloudflare, Mailgun or another mail provider, Google and Meta. Some processing may occur outside the EEA, particularly in the United States. Where required, transfers are to be covered by an adequacy decision, the EU-US Data Privacy Framework or current EU Standard Contractual Clauses with supplementary safeguards.
Provider policies
5. Retention
- Legacy result links: no fixed technical expiry; share them only with people you trust.
- Server and security logs: target maximum 30 days unless a security incident, legal hold or provider setting requires longer.
- Contact correspondence: normally up to 12 months after the matter closes, unless a contract, legal claim or statutory duty requires longer.
- Provider cookies and events: according to the Cookie Policy and the provider configuration.
6. Your rights
Depending on the law that applies, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw consent for future processing at any time. Email [email protected]. We may request proportionate information to verify the requester. You may complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.
7. Rights outside the EU/EEA
We accept privacy requests regardless of where you live. 41Q does not sell personal data for money. Some US state laws may nevertheless classify disclosures to analytics or advertising providers as “sharing” or targeted advertising. There is currently no fully functional site-wide opt-out or Global Privacy Control mechanism; browser protections and provider opt-outs may limit processing.
8. Results, age and sensitive data
41Q provides an informational self-assessment. It does not make a decision with legal or similarly significant effects and is not a medical, psychological, employment or suitability tool. The service is intended for people aged 16 or over. Do not send health data or confidential test results by email.
9. Security and changes
We use encrypted transport, access restrictions, data minimisation and retention rules. No Internet service is risk-free. Material changes will be published here with a new update date.