Privacy Policy

This privacy policy describes how Solivalis collects, uses, and protects the personal data of site users. It complies with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the amended French Data Protection Act (Loi Informatique et Libertés).

1. Data Controller

Given the size of the structure, no Data Protection Officer (DPO) has been appointed, which is not mandatory in this context.

2. Data Collected and Purposes

Solivalis applies the principle of data minimization: only information strictly necessary for the service is collected. The test itself runs entirely in your browser: your answers to the 92 questions never leave it, only the resulting scores are stored, and only if you have an account. The purchase of the in-depth Profile automatically creates a user account using the provided email address, allowing you to review your report and exercise your data rights.

Data	Purpose	Legal Basis	Nature
Responses to the 92 test questions	Score calculation and display of the report	Performance of the requested service	Processed in your browser only. They are never sent to our servers and disappear when you close the tab
Resulting scores (11 OCEAN and RIASEC percentages)	Viewing your report from your account, tracking how your profile changes over time	Contract performance	Stored only if you have an account
First name, last name, email address	Creating and managing your account, processing your order, sending the emails tied to the service (confirmation, reminders)	Contract performance	The email address alone is enough to create a free account; first and last name are requested at the payment step
Payment data (card number, etc.)	Payment for the paid version (€6.90)	Contract performance	Processed only by our payment provider Stripe, never stored by Solivalis
Gift option: first name and email address of the buyer and of the recipient, accompanying message	Sending the gift, tracking its activation, handling any refund	Contract performance	Entered by the buyer when ordering
Contact form: name, email address, subject and message	Answering your request	Legitimate interest (replying to someone who writes to us)	Sent by email to our contact inbox, never stored in the site
IP address, browser	Technical security of the site (anti-abuse, attack detection)	Legitimate interest	Retained for a maximum of 12 months in server logs

Solivalis does not engage in advertising profiling, does not resell any data, and does not use any third-party audience analysis tools. Your scores are never shared with any third party, employer, recruiter or training organisation: the report is meant for you alone. As part of the Gift option, the buyer’s email address is never disclosed to the recipient, nor the recipient’s to the buyer.

3. Retention Period

• Account and associated scores: your account and your scores are retained as long as you log in at least once every twelve (12) months. Without a login for twelve consecutive months, your account and all associated scores are permanently and irreversibly deleted. A reminder email is sent thirty (30) days before this deletion: it contains a link to the site, where simply logging in again is enough to start another twelve months (and the “Lost your password?” option is there if you need it). If you retake the test, the scores of your last five (5) tests are retained, to track how your profile changes over time.
• Answers to the test questions: never stored on our servers, whether you have an account or not. They stay in your browser for the session and disappear when you close the tab.
• Gifts (“Gift” option): retained until the recipient activates the gift, or until the six (6) month claim period expires for unclaimed gifts, which are then deleted. Once activated, the record follows the recipient’s account and its twelve-month rule.
• Messages sent through the contact form: they are not stored in the site, they arrive in our email inbox. They are kept there for as long as it takes to handle your request, then deleted during periodic reviews of the inbox.
• Accounting data related to a purchase (invoices): 10 years, in accordance with French accounting and tax obligations (Article L.123-22 of the Commercial Code). This data is retained as is, even if the user account is deleted, so as to respond to a potential audit by the tax authorities. It is deleted automatically once that period has elapsed.
• Technical logs (server logs): 12 months maximum.
• Internal log of automated tasks: 24 months. It records how the daily jobs went (reminders, deletions) and, if an email fails to send, the address concerned, so that the incident can be fixed.

4. Hosting and Technical Providers

To operate Solivalis, the publisher relies on third-party technical providers, each applying its own privacy policy and security guarantees:

• Infomaniak Network SA (Switzerland) — hosting and storage of all site data. Switzerland benefits from an adequacy decision by the European Commission, which recognizes that this country offers a level of data protection equivalent to that of the European Union. No transfer to a non-adequate third country is made.
• Stripe Payments Europe Ltd (Ireland) — secure payment processing. Your banking data is collected and stored directly by Stripe, without ever transiting or being stored on our servers.
• Brevo (France, EU) — sending transactional emails (account creation, order confirmation, deletion reminders). Only the recipient’s email address and the message content are transmitted.
• Matomo, self-hosted — anonymous audience measurement (see Article 8). The tool runs on our own hosting, with the same host as the site: no traffic data is sent to a third-party service.

These providers intervene only within the limits strictly necessary for the provision of the service. The list may change: this policy will then be updated, and you can delete your account if those changes do not suit you.

5. Security

The publisher implements technical and organizational measures to protect data:

• Encrypted connection (HTTPS / TLS) across the entire site
• Passwords stored in hashed form (never in plain text)
• Data access restricted to the site administrator only

As no system is infallible, in the event of a data breach posing a risk to your rights, the publisher undertakes to inform you as soon as possible, in accordance with Article 34 of the GDPR.

6. Your Rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights regarding your data:

• Right of access: obtain a copy of the data concerning you
• Right to rectification: correct inaccurate data
• Right to erasure (“right to be forgotten”): request the deletion of your data
• Right to restriction of processing: request that processing be suspended
• Right to data portability: receive your data in a structured, readable format
• Right to object: object to processing for legitimate reasons
• Right to withdraw your consent at any time, without affecting the lawfulness of prior processing

You can exercise your right to erasure directly from your personal space, under “My account” → “Delete my account”. Deletion is immediate and irreversible. For other rights, or if you prefer to contact us, write to contact@solivalis.com specifying the subject of your request. A response will be provided within a maximum of one month.

If, after contacting us, you believe that your rights are not being respected, you can file a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL): www.cnil.fr.

7. Cookies

Solivalis only uses strictly necessary cookies for the site’s operation: login session, language preference, and technical cookies from our payment provider. They are exempt from prior consent under Article 82 of the French Data Protection Act. No advertising cookies, third-party audience measurement cookies, or social media cookies are placed on your browser: this is why you do not see a cookie consent banner, it is only required for non-essential cookies.

8. Audience measurement

This website uses Matomo, a privacy-friendly analytics tool that we host ourselves, with our own hosting provider: no traffic data leaves that environment.

This setup follows the recommendations of the French data protection authority (CNIL) and qualifies for its consent exemption: your IP address is anonymized, no tracking cookies are placed, the data is never combined with other processing or shared with third parties, and it is kept for no longer than twenty-five (25) months. It is entirely anonymous: since no data that could identify you is collected, there is nothing to access, correct or delete in connection with it.

9. Policy Modifications

This policy may be updated to reflect technical, legal, or service changes. The applicable version is the one online at the time of your use of the site. In the event of substantial modification, users with an account will be informed by email.

Last updated: August 4, 2026