1Who we are
Capjanny (“we”, “us”, “our”) provides the DISC personality assessment service available at disc.capjanny.com and through the DISCApp mobile application for Android and iOS.
For the purposes of the EU and UK General Data Protection Regulation, Capjanny is the data controller for the personal information described in this policy. Under the Philippine Data Privacy Act of 2012, we act as the personal information controller.
2What this covers
This policy applies to:
- The website at disc.capjanny.com, including the public certificate verification page.
- The DISCApp mobile application (Android package
com.discapp) distributed through Google Play and the Apple App Store. - The application programming interface that supports them.
It does not cover third-party websites or services we link to. When you follow a link away from our service, the destination’s own privacy policy governs what happens to your information.
3Information we collect
Information you give us
| Data | When | Required? |
|---|---|---|
| Email address | Creating an account | Required |
| Password | Creating an account with email | Required unless you sign in with Google or Apple |
| Name | Profile, and printed on certificates | Optional |
| Phone number | Profile | Optional |
| Date of birth, gender | Profile | Optional |
| Company, job title | Profile | Optional |
| Profile photo | Profile | Optional |
We never store your password itself. Passwords are hashed with bcrypt, a one-way function, so we cannot read or recover them.
Assessment information
This is the core of the service and the most personal information we hold about you.
- Your answers to each assessment question, and the question they belong to.
- Your DISC results — your Dominance, Influence, Steadiness and Conscientiousness scores, your primary and secondary type, an overall intensity value, and a confidence indicator.
- Assessment metadata — when you started and finished, how far you progressed, and its status.
- The IP address and browser or device identifier recorded at the time you take an assessment, which we use to detect abuse and duplicate submissions.
We treat your assessment results as sensitive. A DISC profile describes your behavioural tendencies, and we recognise that it is personal in a way that a name or an email address is not. We do not sell it, we do not use it to build advertising profiles, and we do not disclose it to employers or third parties unless you choose to share a certificate yourself.
Certificates
- The certificate number, the generated certificate document, and its verification token and expiry date.
- How many times a certificate has been viewed or downloaded, and when it was last viewed.
Preferences
- Your chosen theme and language.
- Whether you have enabled notifications, email notifications and push notifications.
- Whether you have subscribed to our newsletter, and your data-sharing preference.
Technical and security information
- Authentication tokens — session and refresh tokens, email verification tokens and password reset tokens.
- Sign-in records — the date, time and IP address of your most recent sign-in.
- Security and audit logs — a record of significant actions taken on an account, including what changed, the IP address and the device or browser identifier. We keep these to investigate abuse, fraud and security incidents.
Information collected automatically by Google
The mobile application includes the Google Mobile Ads (AdMob) software development kit. See Advertising below for what that collects.
What we do not collect
- We do not collect payment card details. The service does not process payments.
- We do not collect precise location, contacts, photos, files, calendar entries, call logs or SMS messages.
- We do not record audio or video, and we do not use your camera or microphone.
- We do not collect health data, biometric identifiers, or government identification numbers.
4How we use information
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Create and maintain your account | Email, password hash, profile details | Performance of a contract |
| Deliver the assessment and calculate your results | Your answers, assessment metadata | Performance of a contract |
| Issue and verify certificates | Name, results, certificate records | Performance of a contract |
| Track your progress across repeat assessments | Historical results | Performance of a contract |
| Send service messages (verification, password reset) | Email address | Performance of a contract |
| Send newsletters and product updates | Email address, preferences | Consent, which you may withdraw at any time |
| Protect against fraud, abuse and unauthorised access | IP address, device identifier, audit logs | Legitimate interests in keeping the service secure |
| Understand aggregate usage and improve the service | Aggregated, non-identifying statistics | Legitimate interests in improving the service |
| Display advertising in the mobile application | Advertising identifier, device data (see below) | Consent where required, otherwise legitimate interests |
| Comply with legal obligations | As required | Legal obligation |
We do not use your assessment answers or DISC results to target advertising, and we do not make decisions producing legal or similarly significant effects about you by automated means.
5Certificate verification
Every certificate carries a unique number and a QR code that resolves to a public verification page. This exists so that a third party — an employer, a coach, a client — can confirm a certificate is genuine.
Two things follow from that, and you should understand both.
- Anyone holding a certificate number can see limited details. The verification page displays the certificate number, the holder’s name as printed, the DISC type and scores, and the issue and expiry dates. Only share your certificate with people you intend to have that information.
- We log verification attempts. When someone verifies a certificate we record the IP address, the browser or device identifier, the type of action, and the time. We do this to detect abuse of the verification endpoint and to show certificate holders how often their certificate has been viewed. If you verify someone else’s certificate, this information is collected about you even though you may not have an account.
If you no longer want a certificate to be verifiable, contact us and we will revoke it. A revoked certificate immediately fails verification.
6Advertising
The DISCApp mobile application displays advertising supplied by Google AdMob. Advertising helps keep the assessment free to use.
To serve ads, Google may collect and process:
- Your device’s advertising identifier (the Android Advertising ID, or the Identifier for Advertisers on iOS).
- Device and network information such as device model, operating system version, language, and coarse location derived from your IP address.
- Information about the ads you are shown and whether you interact with them.
Google acts as an independent controller for this processing. Its handling of that data is governed by the Google Privacy Policy, and you can review how Google uses data from partner apps at policies.google.com/technologies/partner-sites.
Your choices about advertising
- On Android: open Settings → Google → Ads to delete or reset your advertising ID, or to opt out of ad personalisation.
- On iOS: open Settings → Privacy & Security → Tracking to control whether apps may request to track you. We will only request the tracking permission where required, and you may decline.
- Where the law requires consent for personalised advertising, we ask for it before serving personalised ads, and you may change your answer at any time.
Opting out of personalised advertising does not remove ads; it means the ads you see will be less relevant to you.
We also keep our own records of which ad placements were shown and how they performed. These records may reference your account identifier, the assessment in progress, a session identifier and a broad user grouping. We use them only to measure how well placements perform.
8How long we keep information
We keep personal information for as long as your account is open, because the service is built around comparing your results over time.
| Information | Retention |
|---|---|
| Account and profile | Until you delete your account, then as described below |
| Assessment answers and results | Until you delete your account and request erasure |
| Certificates and verification records | Until the certificate expires or is revoked, plus up to 12 months |
| Security and audit logs | Up to 24 months |
| Authentication tokens | Until they expire or you sign out |
| Ad performance records | Up to 24 months |
Where we are required to keep information for longer to meet a legal obligation, we keep only what that obligation requires.
9Deleting your account and data
You can delete your account at any time, and you can ask us to erase the data attached to it.
How to request deletion
Email support@capjanny.com from the address on your account, or use the form at disc.capjanny.com/data-deletion. We acknowledge requests within 7 days and act on them within 30 days.
Once we process the request your account is deactivated immediately. You can no longer sign in, and no further certificates are issued against it.
Deactivation is not the same as erasure, and we want to be plain about that. When you delete your account, we mark it deleted and deactivate it, but your assessment answers, results and certificate records are retained. We keep them briefly so that an accidental deletion can be reversed and so that a certificate already shared with an employer does not silently break.
If you want everything erased, ask us and we will do it. Email support@capjanny.com from the address on your account with the subject Erase my data. We will permanently delete your account, profile, assessment answers, results and certificates within 30 days and confirm when it is done. Aggregated statistics that cannot identify you, and records we must keep by law, may remain.
Verifying it is really you
If you write from an address other than the one on your account, we will ask you to verify that you control the account before we act, so that we do not delete someone else’s data.
10Your rights and choices
Whatever country you are in, you can:
- See your information — your profile, assessment history and certificates are visible in your account.
- Correct it — edit your profile at any time, or ask us to fix something you cannot edit.
- Get a copy — ask us for an export of your data in a machine-readable format.
- Delete it — see section 9.
- Opt out of marketing — turn off newsletters in your preferences, or use the unsubscribe link in any marketing email. Service messages, such as password resets, cannot be turned off while your account is open.
- Control notifications — enable or disable push and email notifications in your preferences or your device settings.
- Complain — contact us first, and escalate to your data protection authority if you are not satisfied.
We respond to requests within 30 days. We do not charge for them, and we will not treat you differently for making one.
11If you are in the European Economic Area or the United Kingdom
Under the GDPR and the UK GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased where the grounds in Article 17 apply.
- Restrict processing in the circumstances set out in Article 18.
- Receive your data in a portable format and have it transmitted to another controller.
- Object to processing carried out on the basis of our legitimate interests, including profiling.
- Withdraw consent at any time, without affecting processing carried out before you withdrew it.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.
The legal basis for each purpose is set out in section 4. To exercise any of these rights, email support@capjanny.com.
You also have the right to lodge a complaint with your national supervisory authority. In the United Kingdom this is the Information Commissioner’s Office; in the EEA it is the authority in the country where you live or work.
12If you are a California resident
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, you have the right to know, delete, correct, and to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information.
In the preceding twelve months we have collected these categories of personal information:
| Category | Collected | Disclosed for a business purpose |
|---|---|---|
| Identifiers (email, name, IP address, account ID) | Yes | To our hosting provider |
| Customer records (phone number, employer, job title) | Yes | To our hosting provider |
| Protected classifications (age, gender) | Yes, if you provide them | No |
| Internet activity (app and site interactions, ad interactions) | Yes | To Google for advertising |
| Inferences (your DISC profile) | Yes | No |
| Geolocation | Coarse, derived from IP address only | To Google for advertising |
| Biometric, financial, health, or precise location data | No | No |
We do not sell personal information, and we have not sold personal information in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under 16. Our use of advertising identifiers through AdMob may constitute “sharing” for cross-context behavioural advertising under the CPRA; you can opt out using your device advertising settings as described in section 6, or by emailing us.
You may designate an authorised agent to make a request on your behalf. We will ask for proof of that authorisation.
13If you are in the Philippines
We process personal information in accordance with Republic Act No. 10173, the Data Privacy Act of 2012, and its implementing rules.
As a data subject you have the right to be informed, to object, to access, to rectification, to erasure or blocking, to damages, to data portability, and to file a complaint.
To exercise these rights, email support@capjanny.com. If you are not satisfied with our response, you may lodge a complaint with the National Privacy Commission at privacy.gov.ph.
14How we protect information
- Encryption in transit. All traffic to the website, the API and the administration console is served over HTTPS with a valid TLS certificate.
- Password hashing. Passwords are stored only as bcrypt hashes and are never stored or transmitted in readable form.
- Access control. Administrative access is restricted to authorised staff, protected by separate credentials, role-based permissions and encrypted sessions.
- Rate limiting and lockout. Repeated failed sign-in attempts lock an account temporarily to frustrate guessing attacks.
- Audit logging. Administrative actions are recorded so that access to personal information can be reviewed.
- Token expiry. Sessions, verification links and password reset links expire.
No service can promise perfect security. If a breach affects your personal information and is likely to result in a risk to your rights, we will notify you and the relevant authority within the timeframes the law requires.
15International transfers
Our servers, and the third parties we rely on, may process your information in countries other than the one you live in, including the United States. Those countries may have different data protection laws.
Where we transfer personal data out of the EEA or the United Kingdom, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where they are needed. You can ask us for details of the safeguards that apply.
16Children
The service is not directed to children. You must be at least 16 years old to create an account, or the minimum age of digital consent in your country if that is higher.
We do not knowingly collect personal information from children under 16. If you believe a child has given us their information, email support@capjanny.com and we will delete the account and its data promptly.
17Changes to this policy
We may update this policy as the service changes or the law requires. The “last updated” date at the top of this page always reflects the current version.
If we make a material change — for example, collecting a new category of information or using it for a genuinely new purpose — we will tell you before it takes effect, by email or by a notice in the app, and where the law requires it we will ask for your consent.
18Contact us
For any question about this policy, or to exercise any of your rights, contact us. We aim to respond within 30 days.
- Controller
- Capjanny
- Privacy contact
- support@capjanny.com
- Website
- disc.capjanny.com
- Application
- DISCApp (
com.discapp) - Data deletion
- disc.capjanny.com/data-deletion