whatsmyiq.org (“we” or “us”) runs this website and its IQ tests. We are responsible for the personal data described in this policy.
This policy covers whatsmyiq.org and everything on it: the tests, result pages, reports, certificates, the verification page and the emails we send. For any privacy question or request, write to [email protected].
You can take every test without creating an account. What we collect depends on what you do.
When you take a test
- your answers, the time spent on each question and your score
- your progress through the test: when you start and finish, when you view your result, and whether you take the email or certificate step
When you give us your email address
- your email address, which form you used, and the time and IP address of the request, as a record of what you asked for
- the tests you completed and their results, linked to that email address
When you create a certificate
- the name you want printed. It is encrypted with a key that exists only in your private certificate link, so it cannot be read from our database without that link.
- the certificate number, the test, the score, the classification, the percentile and the dates
When you browse the site
Our own analytics uses a first-party cookie called wmiq_v, which holds a random identifier. With it, we measure:
- your visits, the pages you view, the time you spend on each page and how far you scroll
- how you found us: the referring page and any campaign parameters in the link
- your approximate country, derived from your network address
- your device type and browser
- your test progress, as described above
Our server also keeps request logs with your IP address, the page requested and the time. We use them to keep the Service secure.
When you write to us
We keep your email address and your message so we can answer you.
We only use personal data where we have a legal basis for it. Here is what we do and on which basis.
| What we do | Legal basis |
|---|---|
| Run tests, show results, create reports and certificates, and send the emails you request | Contract. We need the data to provide what you asked for. |
| Keep the Service secure, prevent abuse, protect test integrity and check email addresses | Legitimate interest |
| Measure how the site is used and improve tests and pages | Legitimate interest. You can object at any time with the opt-out link in section 4. |
| Calibrate question difficulty and norms from pseudonymised answers | Legitimate interest |
| Send our newsletter and announcements about new tests to people who used the Service | Legitimate interest, with a one-click opt-out in every email |
| Advertising cookies and personalised ads | Consent, given through the consent banner |
| Meet our legal obligations | Legal obligation |
Linking your email to your visits
When you give us your email address, we link it to your wmiq_v identifier and to the tests you completed with it. This lets us send announcements that fit your interests, such as a new test similar to one you took. You can stop this at any time by unsubscribing or by asking us to delete your data.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Cookies are small files your browser stores for a website. These are the ones whatsmyiq.org sets:
| Cookie | What it does | How long |
|---|---|---|
wmiq_v | Analytics. A random identifier that recognises your browser between visits. | Up to 400 days, renewed when you visit |
PHPSESSID | A technical session cookie. It keeps your progress while you take a free test, shows that a result belongs to you and keeps administrators signed in. | Until you close your browser |
wmiq_px | Shows that a Prism session belongs to your browser. | 120 days |
Google sets its own cookies through Google Tag Manager, the consent banner and, if ads are shown, Google advertising. Where consent is required, advertising cookies are only used after you agree in the consent banner. Ahrefs Web Analytics does not use cookies.
You can switch off our own analytics at any time: turn off analytics on this browser. This deletes wmiq_v and sets a cookie called wmiq_optout for 400 days, so we stop measuring your visits (turn it back on). We also respect the Global Privacy Control signal: if your browser sends it, wmiq_v is never set.
You can change your consent choices in the consent banner, and you can block or delete cookies in your browser settings. If you block all cookies, some parts of the Service, such as taking a test, may not work.
We do not sell or rent your personal data. We share it only with providers that help us run the Service, and only what they need for their task:
- OVHcloud hosts the website and its database on a dedicated server in the EU.
- Cloudflare delivers the site and protects it against attacks. Your requests pass through Cloudflare, which processes your IP address and the pages you request.
- Google provides Tag Manager, the consent banner and, if ads are shown, advertising.
- Ahrefs provides cookieless web analytics.
We send email directly from our own mail server. No email service provider handles the messages we send. Replies to our emails and messages to [email protected] are received through Cloudflare Email Routing, which forwards them to our inbox.
We may also disclose data if the law requires it, or where it is needed to protect our rights or the safety of our users.
Our server is located in the EU. Some of our providers, such as Cloudflare and Google, operate worldwide and may process data in other countries, including the United States, where data protection laws may differ from those where you live. Where this happens, these providers rely on recognised safeguards such as the European Commission's Standard Contractual Clauses.
Certificates are designed so that your name stays with you.
- You create a certificate by entering the name to print and your email address. Before the email step, you only see a watermarked preview.
- Your name is stored encrypted. The key is part of your private certificate link, which we send to you by email together with the certificate as a PDF attachment. We do not store the link in our database or analytics, so we cannot read your name.
- Certificates and Prism PDF reports are digitally signed by whatsmyiq.org, so anyone can tell whether a file has been changed.
- Each certificate has a public number. Anyone with that number can check it at whatsmyiq.org/verify, which shows the test, the score, the classification, the percentile and the dates, but never the name.
- You can ask us to withdraw a certificate from verification by writing to [email protected].
If you give us your email address at the result or certificate step, we use it to send the result or certificate you asked for, and the What's My IQ? newsletter about new tests and features, as described in our Terms of Service.
- Every email has a one-click unsubscribe link, and standard unsubscribe headers so your email app can offer an unsubscribe button.
- Unsubscribing stops the newsletter. Emails you request yourself afterwards are still sent.
- We run basic checks on every address: its format, its domain and whether it belongs to a disposable email service.
- Our own mail server delivers every message. Once an email has been delivered, its content, subject line and attachment are deleted from our outbox. We keep a short delivery record (address, type of email and time) for 30 days.
We keep personal data only as long as we need it for the purposes in this policy.
| Data | How long we keep it |
|---|---|
| Analytics data | Up to 25 months. If you gave us your email, the visits linked to it are kept while you stay subscribed and deleted on request |
| Server request logs | Up to 365 days |
| Email address and the tests linked to it | Until you unsubscribe or ask us to delete it. After that, the address is suppressed so we do not email it again. |
| Email content | Deleted from our outbox once delivered. Delivery records are kept for 30 days |
| Certificates and their verification records | Kept so that verification keeps working, unless you ask us to delete them |
| Test answers | Kept in pseudonymised form to calibrate scoring. They are linked to your email only if you gave one, and that link is removed on request |
Cookie lifetimes are listed in the cookie table.
We use appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction. These include encrypted connections, encrypted certificate names, digitally signed documents and restricted access to our systems.
No method of transmission over the Internet or of electronic storage is 100% secure, so we cannot guarantee absolute security.
Depending on where you live, data protection laws such as the EU General Data Protection Regulation (GDPR) give you rights over your personal data. You can ask us to:
- give you access to the personal data we hold about you
- correct data that is inaccurate
- delete your data
- stop using it where we rely on legitimate interest, including for analytics and the newsletter
- send you a copy in a common, machine-readable format (portability)
Where we rely on your consent, such as for advertising cookies, you can withdraw it at any time in the consent banner. You also have the right to complain to a data protection supervisory authority, for example in the country where you live or work.
To make a request, write to [email protected]. As we do not use accounts, please tell us the email address you used or your certificate number, so we can find your data. We may ask you to confirm the request from that address.
The Service is not intended for children under 13, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has given us personal data, please contact us and we will delete it.
We may update this policy from time to time. When we do, we publish the new version on this page and update the date at the top.
Questions about this policy or your data? Write to us at [email protected].