Skip to main content

Privacy Policy

Privacy Policy for metaFox.online
Effective date: 24.10.2026

Your privacy matters to us. This Privacy Policy explains in clear and simple terms how we process your personal data when you use our web app.

This Privacy Policy also applies to our website metafox-assessment.com, where we present the metaFox Assessment Suite. It is served by the same application as metaFox.online.

Who is responsible?

metaFox GmbH
Carl-Spitzweg-Str. 61, 90768 Fürth, Germany

Register: Amtsgericht Fürth, HRB 19366
Managing Directors: Maximilian Friedle, Tobias Weghorn

Why do we process your data?

We use your data to provide the following services:

  • Provision and operation of our web app
    This includes standard features such as account management and features for successful online coaching as presented on our website: https://metaFox.online
  • Sending transactional emails
    We send important emails such as confirmations, password resets, and notifications about your account activity.
  • Billing and subscriptions (where applicable)
    We process the data needed to offer paid plans, manage subscriptions, and handle payments.
  • Usage analytics
    We track general usage patterns to improve usability, detect technical issues, and ensure smooth operations. Optional product analytics are provided through PostHog as described below and only run when you consent.

Cookies and consent

We use essential cookies and similar technologies to keep you signed in and remember your language preference. A further first-party cookie (mf_attribution, 30 days) remembers which campaign link or referring website first brought you here — only the UTM labels of the link, the referring domain and the landing page, no personal data — so that we can attribute sign-ups to our marketing channels (Art. 6(1)(f) GDPR – legitimate interest); if you sign up, these labels are stored with your account. Optional product analytics (PostHog) and the browser-side Meta Pixel on our marketing pages are only activated after you accept in the cookie banner or enable analytics in your account privacy settings. The server-side Meta Conversions API runs on our servers — independent of any cookie — for the two specific conversion events described below (sign-up and paid subscription activation), on the legal basis of our legitimate interest. Likewise, a small set of server-side PostHog events (a client invited, a client joining a shared session, a trial or subscription starting, a subscription being canceled or a trial expiring, and, in the Assessment Center, a consultant changing the observer settings, finishing an assessment or opening or downloading the rating history) is recorded on our servers independent of cookies, keyed by your internal account id only — never your email — on the legal basis of our legitimate interest in understanding activation and churn. Vercel Web Analytics and Vercel Speed Insights are cookie-less and do not require consent. Sentry error monitoring runs without cookies on the basis of our legitimate interest, with text, input fields, and media masked by default (see "Sentry" below).

Tools and services we use

  • Supabase
    We use Supabase for secure processing and storage of all user and usage data. Data is encrypted in transit (TLS) and at rest (AES-256).
    Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992
    Website: https://www.supabase.com (opens in a new tab)
    Privacy Policy: https://www.supabase.com/privacy (opens in a new tab)
    Note: Our Supabase project uses the eu-central-1 region (AWS Europe, Frankfurt, Germany), so your data is processed and stored within the EU.

  • Upstash (Redis)
    We use Upstash as a fast shared cache for abuse protection: counters that cap requests per hour (rate limits for our public forms and image delivery) and counters that detect an unusual number of sign-ups within one hour. The rate limits use your IP address as the key, and the entry expires automatically after one minute to one hour, depending on the form. The sign-up counters hold numbers only and no personal data. Session or login data is not stored there.
    Provider: Upstash, Inc., a Delaware corporation, USA (Upstash publishes no postal address; legal notice goes to support@upstash.com)
    Website: https://upstash.com (opens in a new tab)
    Privacy Policy: https://upstash.com/trust/privacy.pdf (opens in a new tab)
    Data Processing Addendum: https://upstash.com/static/trust/dpa.pdf (opens in a new tab)
    Note: Our Upstash database uses the eu-central-1 region (AWS Europe, Frankfurt, Germany), so your data is processed and stored within the EU.

  • Cloudflare Turnstile (bot protection)
    Our contact form and workshop registration form use Cloudflare Turnstile to tell people from automated spam bots, without a puzzle in most cases. When the form loads, Turnstile runs a short check in your browser and processes technical data for it, such as your IP address, browser and device characteristics and how the page is used. Turnstile sets no tracking cookies and the data is not used for advertising. The result is a one-time token that our server checks with Cloudflare when you submit the form; submissions without a valid token are refused. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in keeping our forms free of spam and in not sending unwanted emails to people whose addresses bots enter.
    Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA
    Website: https://www.cloudflare.com/products/turnstile/ (opens in a new tab)
    Privacy Policy: https://www.cloudflare.com/privacypolicy/ (opens in a new tab) · Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/ (opens in a new tab)
    Note: Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR); in addition, the EU Standard Contractual Clauses in Cloudflare's Data Processing Addendum apply.

  • Sendpulse
    We use SendPulse to send system-generated (transactional) emails (for example account confirmations and password resets) when our mail provider is configured for production. Separately, when you sign up as a coach, we enroll you by default in a SendPulse address book used for optional product-tip / onboarding sequences. You can withdraw product-updates enrollment at any time in Settings → Privacy (which removes you from the address book). Invited clients are not enrolled. Marketing/newsletter campaigns are not sent from the app product address book.
    Provider: SendPulse Inc., 101 Spear Street, 1st Floor, San Francisco, CA 94105, USA
    Website: https://sendpulse.com (opens in a new tab)
    Privacy Policy: https://sendpulse.com/privacy-policy (opens in a new tab)
    Note: EU Standard Contractual Clauses apply to ensure GDPR-compliant data transfers.

  • GoHighLevel (CRM)
    We use GoHighLevel as a customer CRM for eligible self-serve coaches (for example plan tier tags and support context). Your contact may be created when you verify your account. New coaches are enrolled by default for product-updates and marketing/newsletter; those preferences are stored in our database and mirrored as consent tags on the CRM contact. You can change or withdraw these preferences anytime in Settings → Privacy. Invited clients are not enrolled. People who take Values Discovery as a self-test and say they work with clients or coach employees are added as a contact once their email address is confirmed (see "Values Discovery as a self-test"), also without a newsletter.
    Provider: HighLevel Inc. / LeadConnector
    Website: https://www.gohighlevel.com (opens in a new tab)
    Legal basis: Art. 6(1)(b) GDPR for account/CRM processing necessary to provide the service; Art. 6(1)(a) GDPR for product-updates and marketing emails (default enrollment for new coaches; you may withdraw at any time in Settings → Privacy).

  • Stripe (payments)
    When you purchase or manage a paid subscription, payment data is processed by Stripe (Stripe, Inc., USA). We do not store full payment card numbers on our own servers; card data is handled by Stripe.
    Privacy: https://stripe.com/privacy (opens in a new tab)
    Note: Transfers to Stripe in the USA and related safeguards are described in Stripe’s privacy policy and data processing terms (including EU Standard Contractual Clauses where applicable).

  • PostHog
    We use PostHog for product analytics: we process information such as in-app events (for example which screens or flows you use), approximate usage context, and technical data like browser and device type, so we can improve the product, debug issues, and understand usage. We do not use PostHog session replay (no screen-like recordings of your interactions).
    Provider: PostHog Inc.
    Website: https://posthog.com (opens in a new tab)
    Privacy policy: https://posthog.com/privacy (opens in a new tab)
    Processor terms and DPA information: https://posthog.com/dpa (opens in a new tab) · https://posthog.com/terms (opens in a new tab)
    Legal basis: This processing is optional and only takes place if you accept analytics cookies in our cookie banner or turn analytics on in your account privacy settings (Art. 6(1)(a) GDPR – consent). You may withdraw consent at any time with effect for the future (for example via the same settings or cookie controls). Exception — server-side account events (Art. 6(1)(f) GDPR – legitimate interest): independent of the browser and of any cookie, our servers record a limited set of account lifecycle events in PostHog — when a coach adds a client, when that client opens a shared session, and when a trial or subscription starts, converts, is canceled or expires, and, in the Assessment Center, when a candidate report is created, drafted, approved or downloaded (counts, durations and settings only, never text, names or ratings) (from packages/api and the Stripe webhook in packages/payments); in the Assessment Center, when a consultant changes the observer settings (assessment_observer_controls_changed), finishes an assessment, which locks observer edits (assessment_observer_edit_auto_locked), or opens or downloads the rating history (assessment_rating_history_viewed, assessment_rating_history_exported). The assessment events carry only the setting, its old and new value, the phase and counts, never scores, notes, names or candidate data. These events carry your internal account id (never your email or name), the plan and billing interval, whether a coupon was used and, for cancellations, the reason you chose in the billing portal. When you are signed in with analytics consent, the browser links the same account id to the PostHog person, together with your plan, coaching role, account creation date and whether the account is an internal team account.
    Region / hosting: Event data is sent to PostHog Cloud EU only, via the EU ingestion endpoint (https://eu.i.posthog.com).
    Retention: Retention and further details follow our PostHog project settings and PostHog’s documentation.

  • Vercel (hosting, performance, and web analytics)
    We host and operate the web app on Vercel. Vercel processes technical data needed to deliver the application (for example HTTP requests and related metadata).
    Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA
    Website: https://vercel.com (opens in a new tab)
    Privacy Policy: https://vercel.com/legal/privacy-policy (opens in a new tab)
    Note: Our Vercel project runs in the EU (Frankfurt, fra1) region, so the application is hosted and its serverless functions execute within the EU.
    We also use Vercel Speed Insights for anonymous Web Vitals (page load performance, device types, approximate geographic region) and Vercel Web Analytics for aggregated, cookie-less page-view counts and route popularity. Both products are designed to operate without persistent identifiers and do not track individual users across sessions: visitor counts are derived from anonymized, salted hashes of request metadata that are rotated daily. Collection is limited to aggregated traffic and performance metrics.

  • Sentry (error monitoring)
    We use Sentry for error monitoring and sampled performance traces so we can detect and fix bugs and performance regressions. Sentry processes technical data such as error stack traces, HTTP request and response metadata (for failed server responses in the 5xx range on the client), browser and device information, and performance trace data. We do not record session replays or other screen-like recordings of your interactions with the app.
    Provider: Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
    Website: https://sentry.io (opens in a new tab)
    Privacy Policy: https://sentry.io/privacy/ (opens in a new tab)
    DPA: https://sentry.io/legal/dpa/ (opens in a new tab)
    Redaction. We filter Sentry events on both the client and the server through a redactor (apps/web/lib/sentry-redact.ts, registered as beforeSend in the client, server, and edge SDKs) that strips share tokens from URLs and authorization headers before transmission.
    Sampling. Performance traces are sampled at 10% in production (higher in development). Error events are sent when they occur.
    Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a stable, secure, and bug-free service. You may object at any time (see "Your rights under the GDPR").
    Region / hosting: Data is sent to Sentry's EU data region (Germany) and ingested via ingest.de.sentry.io, so your error and performance data is processed within the EU.

  • LiveKit (video calls)
    We use LiveKit Cloud for video calls inside metaFox.online. During a call, LiveKit transmits the audio and video streams and the in-call chat messages between participants. To do so, LiveKit processes technical connection data (e.g. IP address, browser and device information, connection quality), your display name in the call, a pseudonymous participant ID (your internal account ID, or a randomly generated ID for guests), and usage metrics such as the start, duration, and number of participants of a call. Audio, video, and chat are processed only for transmission and are not stored by LiveKit; we do not store the chat. Calls are not recorded by default (see "Recording video calls" below). Background blur and noise suppression are computed locally in your browser; the noise-suppression filter downloads its model from LiveKit, and your audio is never sent anywhere for it. Media is encrypted in transit (DTLS-SRTP), other data via TLS. LiveKit acts as our processor under its Data Processing Addendum (DPA).
    Provider: LiveKit Incorporated, 369 Sutter St, San Francisco, CA, USA
    Website: https://livekit.com (opens in a new tab)
    Privacy Policy: https://livekit.com/legal/privacy-policy (opens in a new tab)
    DPA: https://livekit.com/legal/data-processing-addendum (opens in a new tab) · Sub-processors: https://livekit.com/legal/sub-processors (opens in a new tab)
    Legal basis: Art. 6(1)(b) GDPR — the processing is necessary to provide the video call you start or join.
    Retention: Per the DPA, LiveKit deletes transmitted content after delivery. Technical log data is kept for up to 30 days by default, usage and connection metrics for up to 12 months.
    Region / hosting — EU (Frankfurt): Our LiveKit project is set to the European Union (Frankfurt) data region, so the connection data, usage metrics and technical logs described above are stored and processed in the EU. Audio, video and chat are routed through the LiveKit server closest to each participant; for participants in the EU this is a server in the EU (Germany or France). If a participant joins from outside the EU, their stream enters LiveKit's network at a server near them and may pass through servers outside the EU on its way to the other participants; such content is only transmitted, never stored. LiveKit Incorporated is a US company. For any remaining access from the US (for example technical support), the transfer relies on LiveKit's certification under the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR) and, in addition, on the EU Standard Contractual Clauses included in the DPA. Your coaching data — boards, notes, and client records — is not processed by LiveKit at all; it is stored in the EU (see "Supabase"). Recording video calls (optional): Calls are never recorded automatically. Coaches can request a recording of a call (video or audio only). It starts only once every participant has agreed; anyone who joins later is asked for consent before joining. If anyone declines, nothing is recorded. If the coach does not use the feature, nothing is recorded. For a recording, LiveKit combines audio and video into one file and writes it directly to our storage in the EU (see "Supabase"). Only the coach and the clients assigned to the session can access the recording, guests cannot. The coach can delete it at any time; it is deleted automatically after 90 days at the latest.
    Legal basis for recordings: Art. 6(1)(a) GDPR — the consent you give in the call. The coach is responsible for the content of the coaching session.

  • Mistral AI (AI-assisted wording)
    For two optional features we use the French AI provider Mistral AI to help with wording: suggestions in Values Discovery (names for value groups, value categories) and the AI-assisted candidate report of the Assessment Center, where a consultant words a feedback report from their own notes with the help of AI. We send only the text needed for the task: for the report, the consultant's notes, their interview answers and the observers' notes, with names replaced by placeholders (candidate, consultant and observers), emails, phone numbers and links removed; no scores, account IDs or email addresses. From the observers' notes the AI asks the consultant follow-up questions; they only go into the report if the consultant confirms them. The AI makes no decisions about anyone, gives and changes no ratings, and nothing reaches a candidate before the consultant has reviewed and approved it. For the Assessment Center, the consultant (or their client organisation) is the controller and we act as their processor; Mistral AI is our sub-processor. Requests and responses of the report feature are stored in pseudonymised form for traceability; their text is deleted after 180 days.
    Provider: Mistral AI SAS, 15 rue des Halles, 75001 Paris, France
    Website: https://mistral.ai (opens in a new tab)
    Privacy policy: https://legal.mistral.ai/terms/privacy-policy (opens in a new tab)
    DPA: https://legal.mistral.ai/terms/data-processing-addendum (opens in a new tab) · Sub-processors: https://trust.mistral.ai/subprocessors (opens in a new tab)
    Legal basis: Art. 6(1)(b) GDPR for features you choose to use; for the Assessment Center, Art. 28 GDPR processing on behalf of the consultant.
    Retention and training: According to its privacy policy, Mistral AI keeps inputs and outputs for 30 days after the response to monitor abuse; Mistral AI is itself the controller for this abuse monitoring. Under Mistral AI's terms, inputs and outputs are not used to train its models if the customer has opted out of training.
    Region / hosting: According to Mistral AI, data is hosted in the EU by default. For requests sent through the general endpoint we use, Mistral AI does not commit to a specific processing location; depending on the feature, data may be transferred temporarily to sub-processors outside the EU. Mistral AI covers such transfers with the EU Standard Contractual Clauses (Art. 46 GDPR). Both features can be used without AI.

  • Meta Pixel and Meta Conversions API
    We use Meta technologies in two distinct ways with two distinct legal bases — please read both:

    (a) Browser-side Meta Pixel — on our public marketing pages, consent-based. On our public marketing pages we load the Meta Pixel to measure the effectiveness of our advertising on Meta platforms (Facebook, Instagram). The Pixel covers the conversion events page view, sign-up started, sign-up completed, first session created, and marketing CTA clicked, together with technical data (browser, device, IP address, page URL) and the cookie-based identifiers Meta sets to match users across sessions (e.g. the _fbp cookie).
    Legal basis: Art. 6(1)(a) GDPR — consent. The browser-side Pixel only fires after you accept marketing/analytics cookies in our cookie banner; you can withdraw consent at any time via the cookie banner or your account privacy settings, and withdrawal stops further browser-side processing for the future.

    (b) Server-side Meta Conversions API — on sign-up and on paid-subscription activation, legitimate interest. Independently of the browser-side Pixel, when you complete a sign-up or activate a paid subscription, our server transmits a small server-side conversion event to the Meta Conversions API so that ad-attribution measurement remains accurate even when the browser-side Pixel is blocked (by an ad blocker, by browser tracking protection, or because you have not given consent for browser-side tracking). The events sent are CompleteRegistration (on sign-up, from packages/auth/auth.ts) and Purchase (on Stripe-confirmed paid subscription activation, from packages/payments/provider/stripe/index.ts). The data we transmit is limited to the SHA-256 hash of your email address (used by Meta for matching, never the plaintext email), the request IP address, the request user-agent, and a randomly generated event ID.
    Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in measuring the effectiveness of our advertising for sign-ups and paid conversions. We have weighed this interest against your interests, taking into account that we transmit only hashed identifiers (Meta cannot reverse a SHA-256 hash to your plaintext email), that the events are limited to two pre-defined milestones rather than continuous tracking, and that you can object to this processing at any time (see "Your rights under the GDPR" — write to the contact below).
    Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (joint controller with us for the events transmitted under (a) and (b); independent controller for further processing on the Meta platforms)
    Website: https://www.facebook.com (opens in a new tab)
    Privacy Policy: https://www.facebook.com/privacy/policy/ (opens in a new tab)
    Joint-controller addendum: https://www.facebook.com/legal/controller_addendum (opens in a new tab)
    Region / hosting: Data is transferred to Meta in the USA; transfers are governed by EU Standard Contractual Clauses and Meta's supplementary measures.

  • Fly.io (real-time server)
    For features that several people see at the same time (for example shared whiteboards and live views in the Assessment Center), we run a real-time server at Fly.io. It transmits changes between the open browsers and processes technical connection data such as the IP address. Whiteboard content passes through this server during a session and is stored in our database at Supabase. For the Assessment Center it carries status signals only, no scores, notes or names.
    Provider: Fly.io, Inc., 2261 Market Street #4990, San Francisco, CA 94114, USA
    Website: https://fly.io (opens in a new tab)
    Privacy policy: https://fly.io/legal/privacy-policy/ (opens in a new tab)
    DPA: https://fly.io/documents/ (opens in a new tab) · Sub-processors: https://fly.io/legal/sub-processors/ (opens in a new tab)
    Legal basis: Art. 6(1)(b) GDPR; the transmission is necessary for real-time collaboration.
    Region / hosting: Our real-time server runs in the Frankfurt (fra) region. Fly.io is a US company; for any access from the USA, the transfer relies on Fly.io's certification under the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR).

Assessment Center: data of consultants, observers and candidates

With the Assessment Center (product name "metaFox Assessment Suite"), consultants run assessment and development centers. They create competency models and tasks and set up one assessment per candidate. Observers and candidates take part through personal links and need no account. The Assessment Center is currently available only to accounts we have switched on.

What data we process

  • Consultants: the account data described above, plus the content they create: competency models with behavior items, tasks with texts and uploaded files (PDF, video), the title and date of an assessment, and their own scores, notes and final scores.
  • Candidates: the name and email address the consultant enters when setting up the assessment, or the existing metaFox account if the consultant selects one; the name and, optionally, the email address entered when the link is first opened; how often the link was opened. In addition, all scores, notes, strengths, areas of development and final scores that observers and the consultant record about the candidate.
  • Observers: the name and, optionally, the email address entered when the link is first opened; a technical identifier per link; their own scores, notes, strengths and areas of development, with timestamps. So that you stay the same person when you open the link again, your browser keeps your personal link in local storage. This is technically required for the feature; no tracking cookie is set.
  • Rating history: every change to a score or note (including strengths and areas of development) is stored as its own version with time, phase, the previous value and an optional reason, so each person's first independent rating stays traceable (DIN 33430). The reason is entered by the person who made the change. Only the consultant sees the history and can download it as CSV. We also log steps of the procedure, such as when a task is completed or when the consultant changes the observer settings, without scores or notes. History and log are deleted together with the assessment.
  • Technical data: IP address and request metadata when the pages are loaded, as described under "Vercel", "Upstash" and "Sentry".

Who has which role

  • For the content of an assessment (data about candidates and observers), the consultant, or the organization they work for, decides on purpose and means. They are the controller under the GDPR. We process this data on their behalf as a processor (Art. 28 GDPR) and do not use it for our own purposes.
  • For consultants' account data, we are the controller, as described in the rest of this policy.
  • We conclude a data processing agreement (DPA) with consultants and organizations on request.

Purposes and legal bases

  • We provide the Assessment Center, store the content and show it to the people involved according to their role. Towards consultants this is performance of a contract (Art. 6(1)(b) GDPR); for candidate and observer data we act on the consultant's instructions (Art. 28 GDPR).
  • The consultant needs their own legal basis for processing candidate and observer data, for example an application or employment relationship or a contract for a development center. The consultant answers questions about it.
  • We ask for a name on the first visit so that scores and notes can be attributed to a person.

Who sees what

  • The consultant sees all content of their assessment, including the scores and notes of all observers.
  • Observers see the materials for candidates and for observers and their own scores and notes. While a task is being scored, they see no one else's scores. What observers additionally see after a task (the consultant's scores, or the consultant's and all observers' scores, other observers shown by a letter instead of their name) is set by the consultant; they never see other people's notes. Whether observers may still change their scores and notes after a task is also set by the consultant. When the assessment is finished, we lock changes until the consultant allows them again.
  • Candidates see only the task content the consultant releases. They do not see scores, notes or observer materials.
  • Anyone who has a link can open the view it belongs to. Links contain a random 64-character key. Please do not forward your link.

No automated decisions

The Assessment Center makes no decisions about people. It shows the scores that people enter and calculates averages from them. The consultant sets the final score per competency. There is no automated decision within the meaning of Art. 22 GDPR and no profiling by us.

AI-assisted candidate report

For the report, the consultant answers a short interview with multiple-choice questions and free text. A language model from Mistral AI drafts a report from this. The consultant can also create the report without AI.

  • Purpose: drafting a report for the candidate and asking the consultant follow-up questions.
  • Data sent: the consultant's notes (including strengths and areas of development), their interview answers and the observers' notes, plus the names and descriptions of the competencies and the titles of the tasks. From the observers' notes the language model asks follow-up questions; they only go into the report if the consultant confirms them in the interview. We do not send scores. Everything is sent pseudonymised: we replace the names of the candidate, the consultant and the observers with placeholders and remove email addresses, phone numbers and links before sending. We re-insert the candidate's and the consultant's names on our server only, and never the observers' names. Other names in the notes, for example of role-players, are not detected by this process.
  • Human review: the draft never goes to the candidate automatically. The consultant edits, reviews and approves it; until approval, every PDF version is marked "draft, not approved". A report drafted with AI states that it was drafted with AI assistance and reviewed by the consultant.
  • No AI scoring: the language model assigns no scores or final scores and gives no overall judgement and no recommendation on suitability, hiring or promotion. There is no automated decision within the meaning of Art. 22 GDPR.
  • Legal basis: we process this data on behalf of the consultant (Art. 28 GDPR); Mistral AI is our sub-processor for it (Art. 28(4) GDPR). The consultant relies on their own legal basis (see "Purposes and legal bases").
  • Retention: the report is kept like the other content of the assessment (see "How long we keep the data"). We store requests to the language model and its responses in pseudonymised form for traceability and delete their text after 180 days. Mistral AI keeps inputs and outputs for 30 days after the response to monitor abuse (see "Mistral AI" above).
  • Region: see "Mistral AI" under "Tools and services we use".
  • Change of provider: the application can technically switch to another language-model provider. We update this policy before any switch.

Where the data is kept and who processes it

  • Supabase stores all Assessment Center content, including uploaded files and reports as PDF, in the eu-central-1 region (AWS Europe, Frankfurt).
  • Vercel runs the application in the EU (Frankfurt, fra1) region.
  • Fly.io runs our real-time server in Frankfurt. For the Assessment Center it only sends status signals to the open views: which task is running, what the candidate may see, and that a new score has arrived. Scores, notes and names do not pass through this server.
  • SendPulse sends the invitation email to candidates when the consultant sends it from the app. The email contains the candidate's name and email address and the personal link; replies go to the consultant.
  • Mistral AI drafts the candidate report from pseudonymised text (see above).
  • Sentry receives error data when technical errors occur; we remove link keys from URLs before sending.
  • Details on these providers, their addresses and the safeguards for transfers to the USA are listed above under "Tools and services we use".

How long we keep the data

  • The content of an assessment is kept until the consultant deletes the assessment, the task or the competency model, or deletes their account. We then delete it from the database; it cannot be restored in the app. Deleted content may remain in Supabase's automatic database backups for up to 30 days.
  • When the consultant deletes a task, a report, the assessment or their account, the app also deletes the related files from file storage: the task's uploaded files and the reports' PDF files. When the consultant removes a file from a task, the app deletes that file too.
  • Observer links work until 7 days after the assessment is finished. After that they can no longer be opened; the scores remain stored for the consultant.
  • Candidate links currently do not expire automatically.
  • Apart from the text of the AI requests (see above), there is currently no automatic deletion after a fixed period. As controller, the consultant is responsible for deleting data according to their own retention periods, for example after a selection procedure ends.
  • If a candidate deletes their own metaFox account, the consultant's assessments remain.

Your rights as a candidate or observer

For access, rectification, erasure and your other rights (see "Your rights under the GDPR"), please contact the consultant running the assessment; they are responsible. You can also write to us (tobias@metafox.eu (opens in a new tab)); we forward your request and help the consultant respond.

Pilot request on metafox-assessment.com

If you request a pilot through the form on metafox-assessment.com, we process your first name, optionally your last name, your email address, optionally your organization, your role, what you use centers for, how many candidates go through your centers per year, and your message, plus the campaign labels from the mf_attribution cookie (see "Cookies and consent"). We send these details by email to our team's inbox and confirm receipt to you by email (sent through our email provider, see "Sendpulse"). We also store them in our CRM GoHighLevel to contact you about your request. In our team chat we also receive a short notification without your name or email address. To prevent abuse, we limit requests per IP address (see "Upstash"). Legal basis: Art. 6(1)(b) GDPR (a request before a possible contract) and Art. 6(1)(a) GDPR (your consent in the form, which you can withdraw at any time with effect for the future). This does not sign you up for newsletters or marketing emails. Retention: If the request does not lead to a pilot or a contract, we delete your details 12 months after the request.

Values Discovery as a self-test

You can take the Values Discovery values test without an account, for example through corevaluestest.com. We process:

  • Your answers: the value cards you pick, the names and meanings you give your values, your ranking, optionally your anti-values, and how much room each value has in your life right now. Your session is tied to the link in your browser; we set no new cookie for it. If you are not signed in and give no name and no email address, these answers are not linked to a person. If you start the test while already signed in to your metaFox.online account, we recognize you from your existing session and link your answers to your account from the start.
  • Name, email address and language, when you ask for your full report at the end. We email you a link (sent through our email provider, see "Sendpulse"). When you open it, we set up a free metaFox.online account without a password, where you can find your report again. It is a client account: we do not add you to newsletters or marketing emails.
  • What you take the test for, if you answer the question at the end ("For myself" or "I work with clients or coach employees").

To stop anyone from creating tests in bulk, we count test starts per IP address; that counter is discarded after one hour and not stored permanently. For wording help and for placing your values in value families we use Mistral AI (see "Mistral AI").

If you work with clients or coach employees: if you said so at the end, the email and the page above your results show how you can use Values Discovery with clients or your team. Once you have confirmed through the link in the email that the address is yours, we store your name, email address, language and this answer in our CRM GoHighLevel (see "GoHighLevel"). Our team gets a short message in the team chat without your name or email address. We do not add you to newsletters or marketing emails.

Legal basis: Art. 6(1)(b) GDPR for the test, your report and your account. Art. 6(1)(f) GDPR for the CRM entry when you say you work with clients or coach employees: our legitimate interest is to show people who might use the test professionally a suitable offer. You can object at any time (tobias@metafox.eu (opens in a new tab)).

Retention: your answers and your report are kept as long as you have your account. When you delete your account, we delete your self-test as well and mark the CRM entry as deleted. We delete the CRM entry itself when you object, and otherwise at the latest 12 months after the test if it does not lead to a coach account.

Legal basis for processing

  • Article 6(1)(b) GDPR – to provide services and manage your account
  • Article 6(1)(f) GDPR – based on our legitimate interests in improving and securing the app, including error monitoring (Sentry, with masking enabled), anonymous performance and traffic measurement (Vercel Speed Insights and Vercel Web Analytics), and server-side ad-attribution measurement for sign-ups and paid conversions via the Meta Conversions API (hashed identifiers only, two pre-defined events only), and server-side account lifecycle events in PostHog (internal account id only, the limited set of events listed under "PostHog")
  • Article 6(1)(a) GDPR – where you provide consent, e.g., for optional product analytics (PostHog), the browser-side Meta Pixel on our marketing pages via the cookie banner or account privacy settings, and product-update or marketing/newsletter emails (default enrollment for new coaches; manage or withdraw in Settings → Privacy)

How long do we store your data?

We store your personal data only as long as necessary for the purposes described or as required by law.
You can delete your account at any time, which also removes your personal data from our servers unless we are legally obligated to retain it.

Your rights under the GDPR

  • Request access to your stored data
  • Have incorrect or outdated data rectified
  • Request deletion or restriction of your data
  • Object to the processing of your data
  • Withdraw consent (effective for the future)
  • Receive your data in a portable format
  • Lodge a complaint with a data protection authority

Questions about privacy?

Email: tobias@metafox.eu