Privacy Policy

This Privacy Policy explains how Moxie LLC ("we", "us") collects, uses, and protects information when you take the DISC assessment or use any My DISC Score website or application (the "Service").

By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

We collect only what we need to run the Service:

• Account information. Email address, display name, and (if you sign in with Google) basic Google profile fields.
• Assessment responses & results. Your answers, the scores computed from them, and any name, email, or phone you provide to tag a result.
• Organization & team data. If you join an organization or team, your membership, role, and invitation status.
• Contact & support messages. Anything you send via the contact form.
• Technical data. Standard server and device metadata such as IP address, browser type, timestamps, and error logs — used for security and reliability.

We do not intentionally collect special-category personal data (health, biometric, political, etc.). Please do not enter such information in free-text fields.

• To deliver the assessment and generate your results and PDF reports.
• To operate teams, organizations, invitations, and join codes.
• To send transactional emails (sign-in, password reset, invitations, completed-assessment notifications).
• To respond to support requests.
• To protect the Service against abuse, fraud, and security incidents.
• To improve the product through aggregate, de-identified usage analysis.

We do not sell your personal information, and we do not use your assessment responses to train third-party AI models.

If you take the assessment through an invitation or join code from an organization or team, the owners and admins of that organization or team can view your completed result (name, email, DISC scores, and traits). This is the point of those features. If you do not want your employer to see your result, take the assessment without using their code or invitation.

We rely on the following service providers to run the platform:

• Supabase — database and authentication.
• Resend — sending emails such as your results link.
• Google — optional sign-in via Google OAuth.
• Cloudflare — DNS, edge delivery, and DDoS protection.
• Stripe — payment processing for report purchases. Stripe handles your card details directly; we receive only your email, the amount, and whether the payment succeeded.
• Meta — optional advertising measurement tracks page views, leads, checkout starts, and confirmed purchases after you opt in. A server-side purchase backup may share advertising browser/click IDs, browser type, purchase amount/currency, and an opaque event ID. We do not send Meta your name, email, phone number, assessment answers, or private report links. Change your choice using Privacy choices on any page; browser Global Privacy Control and Do Not Track signals are honored.

Each subprocessor is bound by its own data-protection terms. If this list changes, we will update this page.

We keep your account and assessment data for as long as your account is active. You can request deletion of your account and results at any time via the contact form. We will delete or anonymize personal data within 30 days of a valid request, unless we are required to retain it for legal, accounting, or security reasons.

Backups are rotated automatically and may persist for a short window after deletion before being permanently overwritten.

Depending on where you live (e.g. EEA, UK, California), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for optional processing.

To exercise any of these rights, contact us through the contact form. We respond within 30 days.

We protect data in transit with TLS, store it in managed Postgres with row-level security policies that scope data access to its owner or organization, hash passwords with industry-standard algorithms, and screen passwords against the Have I Been Pwned breach database to block known-compromised credentials. See the Security page for more detail.

Our infrastructure is operated by providers that may process data outside your country of residence. Where required, transfers are protected by standard contractual clauses or equivalent safeguards.

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, please contact us so we can delete it.

We may update this Privacy Policy from time to time. Material changes will be highlighted at the top of this page and, where appropriate, communicated by email.

Privacy questions, data requests, or complaints: please use the contact form. We aim to respond within five business days.