Your data, your control

Last updated: 29 August 2026

1. About this Privacy Policy

EvalOtter provides online, self-guided assessments, scoring, reports and related digital services.

This Privacy Policy explains how EvalOtter, trading as EvalOtter ("EvalOtter", "we", "us" or "our"), collects, uses, stores, discloses and protects personal information when you use EvalOtter websites, applications, assessments and related services.

Our intention is to apply strong privacy protections to users worldwide. Depending on where you live, additional rights may apply under local privacy and data-protection laws.

Nothing in this Privacy Policy limits any privacy right that cannot lawfully be limited under the laws applicable to you.

Privacy contact: privacy@evalotter.com

Registered address: TODO: add registered business address

2. Who controls your information

Unless otherwise stated, EvalOtter is the controller, business, organisation or equivalent entity responsible for determining how personal information collected through EvalOtter is processed.

Some service providers may process information on our behalf, while others may act as independent controllers for particular activities.

3. Who may use EvalOtter

EvalOtter is intended for adults.

You must be 18 years of age or older to create an account, purchase an assessment, upload images or otherwise use services requiring an account.

We do not knowingly collect personal information from children.

If we discover that personal information has been collected from a child contrary to applicable law, we will take reasonable steps to delete it.

A parent or guardian who believes a child has supplied personal information to EvalOtter should contact us at privacy@evalotter.com.

4. Information we collect

Depending on how you use EvalOtter, we may collect the following categories of information.

Account information

This may include:

• name;
• email address;
• account identifier;
• login and authentication information;
• account preferences;
• country or region;
• age confirmation; and
• communications with us.

We do not intentionally store your account password in readable form.

Assessment information

When you complete an assessment, we may collect:

• answers and selections;
• assessment completion information;
• numerical scores;
• categories, rankings or classifications;
• generated assessment results;
• written interpretations;
• assessment history; and
• information that you voluntarily provide as part of an assessment.

Some assessment information may reveal or permit inferences concerning personal characteristics, abilities, preferences, behaviour, cognition, emotions or psychological characteristics.

Depending on your jurisdiction and the nature of a particular assessment, this information may receive additional protection as sensitive, health-related or otherwise specially protected information.

We apply this Privacy Policy to assessment information regardless of whether local law formally categorises it as sensitive information.

5. Palmistry photographs

If you choose to use the Palmistry assessment, you may upload photographs of your own palms or hands.

Palmistry photographs are processed solely to provide the Palmistry feature and related report.

EvalOtter does not intend to use palm photographs to:

• identify you;
• verify your identity;
• authenticate access to your account;
• match you against another person;
• create a biometric identity database;
• conduct law-enforcement identification;
• build fingerprint identification records; or
• determine whether a palm belongs to a previously identified person.

We do not claim that Palmistry is scientifically validated.

Palmistry is provided solely for entertainment and self-reflection.

Where required by law, we will request specific consent before processing palm or similar sensitive imagery.

You must only upload images of your own hands unless EvalOtter expressly provides another lawful process for third-party images.

You must not upload palm photographs of a child.

6. Biometric information

A photograph is not necessarily biometric information merely because it depicts a body part.

However, some jurisdictions regulate measurements, templates, geometry or other information extracted from human physical characteristics.

EvalOtter's Palmistry feature is not designed for biometric identification or authentication.

Where technical processing could legally constitute processing of biometric or similarly protected information, we will apply additional consent, retention, disclosure and deletion protections required by applicable law.

We do not sell biometric identifiers or biometric templates.

7. Payment information

Payments are processed through Stripe.

EvalOtter does not normally receive or store your complete payment-card number.

We may receive transaction information such as:

• payment status;
• transaction identifier;
• amount;
• currency;
• date;
• billing country;
• limited card information such as card type or last digits; and
• refund or dispute information.

Stripe processes payment information under its own terms and privacy practices and may act as either a service provider/processor or an independent controller depending upon the processing involved.

8. Technical information

When you use EvalOtter, we and our infrastructure providers may automatically receive technical information including:

• IP address;
• browser type;
• operating system;
• device information;
• session identifiers;
• login records;
• request logs;
• timestamps;
• security information;
• referring URLs;
• pages or features accessed; and
• cookie or similar identifiers.

We use this information for service operation, security, fraud prevention, performance and, where permitted, analytics.

9. Cookies and similar technologies

EvalOtter may use cookies, local storage and similar technologies.

Essential technologies

These may be required for:

• authentication;
• account security;
• remembering session state;
• load balancing;
• fraud prevention;
• payment processing; and
• providing services requested by you.

Where permitted by law, essential technologies may operate without optional consent because they are necessary to provide the requested service.

Analytics and optional technologies

Where analytics, advertising or other non-essential technologies require consent under applicable law, they will not be activated until the required consent has been obtained.

Where available, you may withdraw or modify cookie consent through our cookie-preference controls.

We do not intentionally permit advertising trackers to collect assessment answers, private assessment reports or Palmistry photographs.

10. How we use personal information

We may process personal information to:

• create and administer accounts;
• authenticate users;
• provide assessments;
• calculate assessment scores;
• generate reports;
• provide AI-assisted interpretations;
• process purchases;
• provide purchased digital content;
• deliver third-party components included in a purchased bundle;
• provide customer support;
• maintain user assessment history;
• enable voluntary public sharing;
• prevent fraud and abuse;
• investigate security incidents;
• maintain and improve the service;
• comply with legal obligations;
• enforce our Terms;
• resolve payment disputes;
• protect users, EvalOtter and third parties; and
• establish, exercise or defend legal claims.

We will not materially expand the use of sensitive assessment information or palm images for an incompatible new purpose without providing any notice or consent required by applicable law.

11. Legal bases for processing

Where laws such as the EU GDPR or UK GDPR require us to identify a legal basis, our processing may rely on one or more of the following:

Contract

Processing necessary to create your account, provide assessments, generate purchased reports and supply services you request.

Consent

Processing based on your affirmative consent where consent is required, including certain sensitive-data, Palmistry, cookie or marketing activities.

You may withdraw consent prospectively at any time where processing is based on consent.

Legitimate interests

Processing necessary for legitimate interests such as:

• service security;
• fraud prevention;
• service improvement;
• maintaining platform functionality;
• preventing misuse;
• protecting legal rights; and
• understanding general service performance,

provided those interests are not overridden by applicable rights.

Legal obligations

Processing required for taxation, accounting, consumer law, regulatory compliance, legal proceedings and lawful government requests.

Legal claims and other permitted grounds

Sensitive information may also be processed where another lawful exception or legal basis applies.

12. AI processing

Certain EvalOtter features use artificial intelligence.

Where AI interpretation is enabled, assessment information may be provided to our AI service provider for the purpose of generating a written interpretation.

Our current primary AI provider is:

Anthropic, PBC — AI inference and report interpretation.

Depending on the feature, information sent to the AI service may include:

• assessment type;
• assessment responses where required;
• computed scores;
• categories or classifications;
• instructions required to generate the report; and
• other information needed for that particular analysis.

We seek to minimise direct account identifiers supplied to AI providers where they are not necessary.

We do not provide payment-card information to Anthropic for report generation.

AI-generated content can contain mistakes, unexpected conclusions or inaccurate statements.

AI output does not alter your underlying assessment score unless the particular assessment expressly states otherwise.

13. Service providers and recipients

We use third parties to operate EvalOtter.

Current material providers include:

Supabase

Used for database infrastructure, authentication, backend functionality and private file storage.

Privacy information: Supabase's published privacy documentation.

Stripe

Used for payment processing, fraud prevention, transaction administration and refunds.

Privacy information: Stripe's published privacy documentation.

Anthropic

Used for AI processing and generation of certain written interpretations.

Privacy information: Anthropic's published privacy and commercial data-processing documentation.

We may also disclose information to professional advisers, insurers, auditors, regulators, courts, law enforcement or other parties where legally necessary.

If we appoint additional material providers, we may update this Privacy Policy or our service-provider list.

14. Third-party fulfilment

Some EvalOtter bundles may include a product or service supplied separately by another provider, including products marketed under the Perfect Love name.

Where third-party fulfilment requires personal information to be transferred to another provider, we will disclose this before or at the time of purchase where required.

Information shared will be limited to what is reasonably necessary to provide the purchased product or service.

The relevant provider may have its own privacy terms where it acts independently from EvalOtter.

15. Public sharing

Assessment results are private by default unless expressly stated otherwise.

If EvalOtter provides public-sharing functionality, sharing is opt-in.

When you enable public sharing, information you select may become accessible to anyone with access to the relevant public page or link.

You may disable public sharing through the available controls.

Search engines and independent third parties may retain copies of information that was previously publicly available and may operate outside EvalOtter's control.

16. Selling or sharing personal information

EvalOtter does not sell assessment responses or Palmistry photographs for monetary consideration.

If activities conducted by EvalOtter are legally characterised as a "sale", "sharing", targeted advertising or similar regulated disclosure in a particular jurisdiction, we will provide any opt-out mechanism required under applicable law.

Where legally required, we will recognise supported opt-out preference signals such as Global Privacy Control.

17. Data retention

We retain personal information only for as long as reasonably required for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Our intended baseline retention schedule is:

Palmistry source photographs

Retained until you delete them from your account or delete your account entirely. EvalOtter does not currently auto-delete palm photographs after analysis.

Assessment responses and reports

Retained while your account remains active unless you delete an assessment earlier.

Following a valid deletion request or account deletion, production copies will generally be deleted or de-identified within 30 days, subject to legal exceptions.

Account information

Retained for the duration of your account and generally deleted or de-identified within 30 days following account deletion, except where continued retention is legally required.

Backups

Deleted data may remain temporarily in encrypted or access-restricted backups and will generally expire through normal backup rotation within 90 days.

We do not normally restore deleted user data from backups except where necessary for disaster recovery, security or legal compliance.

Payment and accounting records

Transaction records may be retained for up to 7 years, or longer where required under applicable tax, accounting, anti-fraud or consumer laws.

Security logs

Security and technical logs may generally be retained for up to 12 months, subject to longer retention where necessary to investigate an incident or protect legal rights.

Legal disputes

Relevant information may be retained for longer where reasonably required to establish, exercise or defend legal claims.

18. Deletion

You may be able to delete:

• individual assessments;
• uploaded images;
• shared results; and
• your entire account.

Deletion from the active application may occur before information expires from backups.

Deletion rights may be limited where we are legally required to retain particular information, including financial records, fraud records, legal-hold information or information necessary to establish or defend legal claims.

Where we cannot delete information following a valid request, we will explain the applicable reason where required by law.

19. International transfers

EvalOtter operates using global internet and cloud infrastructure.

Your information may therefore be processed in countries other than the country in which you live.

These countries may have privacy laws different from those in your home jurisdiction.

Where required, we use appropriate contractual, organisational or legal safeguards for international transfers, which may include:

• adequacy decisions;
• Standard Contractual Clauses;
• the UK International Data Transfer Addendum or equivalent mechanisms;
• contractual processor obligations; or
• another transfer mechanism recognised by applicable law.

20. Security

We use technical and organisational safeguards designed to protect personal information.

Depending on the system, these may include:

• encryption in transit;
• encryption at rest where supported;
• authentication;
• private storage;
• access controls;
• Row Level Security;
• signed or restricted file access;
• administrative access restrictions;
• monitoring and logging;
• backup protections; and
• separation of privileged credentials.

No internet-connected service can guarantee absolute security.

Users are responsible for maintaining the confidentiality of their account credentials.

21. Data breaches

If a security incident results in unauthorised access, disclosure, alteration or loss of personal information, we will investigate and take appropriate remedial action.

Where legally required, we will notify affected individuals and/or relevant regulators within applicable statutory timeframes.

22. Your privacy rights

Privacy rights vary by jurisdiction.

Subject to applicable law, you may have rights to:

• know whether we process your information;
• access personal information;
• receive a copy of personal information;
• correct inaccurate or incomplete information;
• delete information;
• withdraw consent;
• restrict certain processing;
• object to processing;
• receive portable information in a usable format;
• opt out of certain sales, sharing or targeted advertising;
• opt out of direct marketing;
• challenge or obtain information concerning certain automated decisions;
• lodge a complaint with a privacy regulator; and
• not be discriminated against for exercising privacy rights.

These rights are not absolute and legal exemptions may apply.

23. How to exercise your rights

Requests may be submitted to: privacy@evalotter.com

Please describe the right you wish to exercise.

We may take reasonable steps to verify your identity before completing a request.

Where applicable, an authorised agent may make a request on your behalf, subject to appropriate verification.

We will respond within the timeframe required by applicable law.

We will not charge a fee unless permitted by law, including where a request is manifestly unfounded, excessive or repetitive.

24. European Economic Area

If the EU GDPR applies to you, you may have rights including access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

You may also complain to the data-protection supervisory authority in the EEA country in which you live, work or believe an infringement occurred.

Where required, EvalOtter will appoint an EU representative and publish that representative's details here. EU Representative: not currently appointed — to be determined with counsel based on EU user volume.

25. United Kingdom

Where UK data-protection law applies, you may exercise applicable UK GDPR rights.

You may lodge a complaint with the UK Information Commissioner's Office.

Where legally required, our UK representative details will appear here. UK Representative: not currently appointed — to be determined with counsel based on UK user volume.

26. Australia

Australian users may have rights under the Privacy Act 1988 and Australian Privacy Principles.

Certain EvalOtter information could potentially constitute health information or sensitive information depending upon the nature of the assessment and the purpose for which information is processed.

Nothing in this Privacy Policy limits rights available under Australian privacy, health-record or consumer law.

You may lodge eligible privacy complaints with the Office of the Australian Information Commissioner.

Additional state or territory health-record legislation may apply in some circumstances.

27. California and other United States privacy laws

Residents of California and certain other US states may have additional rights where applicable legislation applies to EvalOtter.

Depending on applicable law, these may include rights to:

• know what personal information is collected;
• access personal information;
• correct information;
• delete information;
• obtain information about categories of recipients;
• opt out of sale or sharing;
• opt out of targeted advertising;
• limit certain uses of sensitive personal information;
• appeal certain privacy-request decisions; and
• receive equal treatment when exercising privacy rights.

EvalOtter does not discriminate against users for exercising legally protected privacy rights.

Where required, relevant opt-out controls will be made available.

28. Canada

Where Canadian privacy legislation applies, we process personal information in accordance with applicable federal or provincial privacy obligations.

You may request access to or correction of personal information and may withdraw consent where processing lawfully depends on consent, subject to legal limitations.

29. Brazil

Where Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD) applies, users may exercise applicable rights concerning confirmation of processing, access, correction, anonymisation, blocking, deletion, portability, consent and information concerning data sharing, subject to the LGPD.

Details of any locally required data-protection contact or representative will be provided where applicable.

30. Other jurisdictions

Users in other countries may have additional statutory privacy rights.

We intend to honour all rights required by laws that legally apply to EvalOtter.

Where local law gives you greater protection than this Privacy Policy, the mandatory requirements of that local law will prevail.

31. Automated processing

EvalOtter uses automated systems to:

• calculate assessment scores;
• classify assessment outcomes;
• analyse inputs;
• generate reports; and
• generate AI-assisted narrative interpretations.

These systems are not intended to make legally binding decisions concerning:

• employment;
• credit;
• insurance;
• education admission;
• housing;
• medical treatment;
• legal status; or
• access to essential services.

EvalOtter assessments should not be used for those purposes.

32. Changes to this Privacy Policy

We may update this Privacy Policy as EvalOtter changes or legal requirements evolve.

The "Last updated" date will identify the current version.

Where required by law, we will provide additional notice before material changes take effect.

33. Contact

Questions, requests and complaints concerning privacy may be sent to:

EvalOtter Privacy

EvalOtter

TODO: add registered business address

Email: privacy@evalotter.com

Website: https://evalotter.com

(Business/registration number: TODO: add ABN/ACN or company registration number; governed with reference to the laws of Victoria, Australia — see Terms of Use.)