This privacy policy explains what personal data MakingMoves.ai collects, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Data Controller
The controller of your personal data is Making Moves Group B.V. ("MakingMoves.ai", "we", "us"), registered with the Dutch Chamber of Commerce under KVK number 85921785, with its registered office at Industriestraat 61 C, 1976 CT IJmuiden, the Netherlands. For all privacy-related requests, contact info@makingmovescompany.com.
2. Data We Collect
We collect the following categories of personal data:
- Account data: Email address, first name, last name, hashed password, preferred language, career goals selected during onboarding.
- Usage data: Test attempts, question answers, scores, time spent, review progress, personality/career test results.
- AI conversations: Messages you send to the AI coach and the AI's responses, stored so you can revisit past sessions.
- Payment data: Handled by Stripe. We store only your subscription plan, status, Stripe customer ID, and billing period dates. We never receive or store your card number.
- Analytics data: Anonymized page views, referrer, device type, and country. Only collected after you accept cookies.
3. Why We Use Your Data
- To provide the service you signed up for: practice tests, AI coaching, personality assessments, subscription management.
- To personalize your experience, including the AI coach's grounding in your progression and weakness areas.
- To process payments and manage your subscription via Stripe.
- To improve the platform — for example, aggregated quality signals on AI-generated questions.
- To comply with legal obligations (tax records for paid subscriptions).
4. Sub-processors
We rely on the following third parties to run the service. Each has its own privacy commitments.
- Supabase (Database and authentication — EU data centre)
- Stripe (Payment processing — GDPR-compliant, PCI-DSS certified)
- OpenAI (AI coach and question generation. Content sent to OpenAI is not used for their model training under our API terms.)
- Google Analytics (Website analytics — anonymized, consent-gated)
- Resend (Transactional email delivery)
- Vercel (Website hosting)
5. How Long We Keep Data
Account data is kept for as long as your account is active. If you delete your account, your data is erased within 30 days, except records we must retain for tax or legal reasons (up to 7 years for payment records).
6. Your Rights
Under GDPR you have the right to:
- Request a copy of the personal data we hold about you
- Correct data that's inaccurate or incomplete
- Ask us to delete your account and associated data
- Receive your data in a portable, machine-readable format
- Object to processing based on our legitimate interests
- Lodge a complaint with the Autoriteit Persoonsgegevens (Dutch DPA) if you believe we're mishandling your data
To exercise any of these rights, email us at info@makingmovescompany.com.
7. Cookies
We use essential cookies (authentication, subscription state) that don't require consent. Analytics cookies (Google Analytics) only load after you accept via the cookie banner. You can withdraw consent any time by clearing the cookie-consent cookie in your browser.
8. Security
We use Row Level Security in Supabase to isolate user data, TLS for all traffic, and hashed passwords. Stripe handles all card data under PCI-DSS compliance. No system is 100% secure, but we take reasonable measures to protect your data.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be notified via email or an in-app banner before they take effect.