Privacy Policy

1. Who we are and what this covers

This policy applies to the screening, assessment-preparation, account, report, and payment features offered at assessment.audhdstuff.com (the “Service”) by AGI Logic LLC, doing business as AuDHD Stuff. AGI Logic LLC is located in Lake County, Ohio.

The Service is a self-reflection and organization tool for adults. It is not a health-care provider, health plan, emergency service, diagnostic service, or substitute for professional care. Unless we expressly enter a different relationship in writing, AuDHD Stuff is not acting as a HIPAA covered entity or business associate.

This general policy should be read with our separate Consumer Health Data Privacy Notice, which gives additional detail about assessment and report information.

2. Information we collect

Information you provide

• Account information: your email address, authentication records, and account identifiers when you request a one-time sign-in link.
• Screening and assessment information: responses, skipped-question status, self-described experiences, goals, developmental context, day-to-day impact, helpful conditions, and edits you choose to save.
• Reports and AI choices: generated reports, source-linked revisions, whether you chose optional AI-assisted wording, and related consent records.
• Purchase and support information: package, price, payment status, entitlement dates, refund status, and messages you send to support. Payment-card details are collected by Stripe rather than AuDHD Stuff.

Information collected automatically

Our hosting, authentication, and security providers may process limited technical information such as IP address, browser and device type, request time, referring page, authentication cookies, and security or error events. Google Analytics also receives limited technical information and public page visits so we can measure aggregate traffic. We configure it without advertising personalization or Google Signals, and we do not send assessment answers, results, reports, account information, payment details, or profile identifiers to Google Analytics.

Guest screening

Free screening answers entered as a guest remain in your browser and are not saved to our application database. If you choose to sign in for checkout, a temporary browser copy keeps your progress available across the email-link handoff. That copy expires after one hour and is removed as soon as the Service restores it. Clearing browser data can erase it. If you later explicitly choose private account saving, the Service identifies exactly what will be saved before doing so.

3. How we use information

• Provide the screening, saved assessment, report, export, and account features you request.
• Authenticate you, keep your account secure, prevent abuse and fraud, and troubleshoot technical failures.
• Process purchases, entitlements, refunds, disputes, and legally required financial records without placing assessment content in payment metadata.
• Create AI-assisted report wording only when you affirmatively choose that feature.
• Honor access, correction, export, consent-withdrawal, and deletion requests.
• Comply with law, enforce our Terms, and protect users, the public, and the Service.

We do not use assessment responses to advertise to you, build advertising profiles, or train our own general-purpose AI model.

For people in the European Economic Area or United Kingdom, our legal bases under applicable data-protection law are: performance of our contract when we provide an account, purchased package, or requested report; your explicit consent for health-related assessment information and optional AI-assisted wording; our legitimate interests in securing, operating, and improving the reliability of the Service where those interests do not override your rights; and compliance with legal obligations for tax, accounting, fraud prevention, and lawful requests. We document both an Article 6 basis and, for health information, an Article 9 condition before processing.

4. When information is disclosed

We disclose information only as needed to provide the Service, follow your direction, protect the Service, or comply with law. Current service providers include:

• Supabase: authentication, account database, access controls, and backups.
• Vercel: application hosting, delivery, and operational security logs.
• Zoho Mail: delivery of sign-in and account email. Zoho receives the recipient address and email content, not assessment answers.
• Stripe: checkout, payment, refund, dispute, and fraud processing. We do not send Stripe assessment answers, scores, screening-section selections, or report text.
• OpenAI: optional AI-assisted wording. If you opt in, we send completed detailed-assessment responses needed to draft the report. We do not send free-screening answers, router answers, your email address, payment details, or internal account IDs.

We may also disclose information to professional advisers or authorities when reasonably necessary to comply with law, respond to valid legal process, investigate fraud or security incidents, or protect legal rights. If ownership of the Service changes, information may transfer as part of the transaction subject to applicable law and continued protection of consumer health data.

We do not sell personal information or consumer health data, and we do not share it for cross-context behavioral advertising or targeted advertising.

5. Optional AI-assisted wording

The complete non-AI report remains available if you do not choose AI-assisted wording. When you opt in, OpenAI processes the selected detailed-assessment content to organize it into clearer language. AI can omit, misunderstand, or misstate information; it does not diagnose, estimate whether you have a condition, invent history, or decide treatment or accommodations.

Our API requests disable provider model-training use. Under the current provider configuration, OpenAI may retain request and response content for abuse monitoring for up to 30 days. The report wording validated by the Service is stored with your private assessment under the retention rules below. Withdrawing consent stops future AI submissions but cannot recall a request already sent.

6. Retention and deletion

• Guest answers: remain in the browser. A checkout sign-in handoff copy expires after one hour and is removed when restored; clearing browser data can remove it sooner.
• Saved assessments and reports: automatically expire 90 days after the last successful save. Saving again restarts that period.
• Backups: a deleted active record may remain in restricted provider backups for up to 7 days before automatic expiry. Backups are not available through the Service.
• OpenAI processing: provider copies may remain for abuse monitoring for up to 30 days as described above.
• Account and consent records: remain while the account is active and are removed through account deletion, except as stated below.
• Payment and content-free audit records: retained for seven years after the transaction, or after a related refund, dispute, or chargeback closes, whichever is later, unless law requires a longer period. Account deletion removes the direct account link from retained records. These records must not contain assessment answers, scores, screening-section selections, or report text.

You can delete an individual saved assessment or delete your account from the account area. Active database copies are removed when deletion succeeds. Account deletion also ends active package access. A documented legal hold may pause deletion of a narrowly identified financial or security record while a claim, audit, or investigation is active. We will not use retained information for unrelated purposes.

7. Your choices and rights

Depending on where you live, you may have rights to know, access, obtain a portable copy of, correct, or delete personal information; confirm whether information is collected, shared, or sold; withdraw consent; appeal a denied request; and receive equal service without unlawful discrimination.

Signed-in users can download a private JSON account archive and use the Service’s deletion controls. You may also contact info@audhdstuff.com. You do not need to create a new account to make a privacy request, although we may ask for information reasonably necessary to verify your identity and protect your records.

We will respond within the period required by applicable law. If we deny a request, our response will explain how to appeal. You may also contact your state attorney general or other privacy regulator.

If EEA or UK data-protection law applies, you may also have rights to restrict or object to processing, receive portable data, withdraw consent at any time, and complain to the supervisory authority where you live or work. Withdrawing consent does not affect processing that was lawful before withdrawal. The Service does not make decisions based solely on automated processing that produce legal or similarly significant effects.

If Canadian privacy law applies, you may request access to and correction of your personal information, withdraw consent subject to legal or contractual limits, and challenge our compliance through the contact below. We remain accountable for information transferred to service providers for processing.

8. Cookies and browser storage

We use cookies and similar storage that are necessary for sign-in, session continuity, security, and the choices you make in the open page. This includes a one-hour, browser-only copy of guest progress when you leave the assessment to complete email sign-in for checkout. It is removed when restored and is not sent to our application database. Google Analytics may set its own measurement cookies when public pages are visited. We do not use advertising cookies on assessment pages. Blocking necessary cookies or storage may prevent account, checkout-continuity, and saved-report features from working.

9. Security and breach response

We use safeguards designed for the sensitivity of the information, including encrypted transport, managed authentication, owner-scoped database access controls, restricted administrative access, separated payment metadata, and controls intended to keep health responses out of ordinary logs. No system can guarantee absolute security.

If a breach affects covered health information or other protected personal information, we will investigate and provide notices to affected people and regulators as required by applicable law, including the FTC Health Breach Notification Rule when it applies.

10. Adults only, location, and policy changes

The Service is intended only for people age 18 or older. We do not knowingly collect personal information from children through the Service. If you believe a child has provided information, contact us so we can investigate and delete it where appropriate.

AGI Logic LLC is established in the United States. Our providers may process information in the United States and other locations where they operate. Privacy laws and government-access rules in those locations may differ from those where you live. Where applicable law requires a transfer mechanism, we rely on provider contractual commitments and recognized safeguards, such as the European Commission’s Standard Contractual Clauses and the applicable UK transfer addendum, or another lawful mechanism. Contact us to request more information about safeguards relevant to your information.

The Service may be accessed internationally, but local laws may limit availability or create rights in addition to those described here. We will honor non-waivable local privacy and consumer-protection rights that apply to you.

We may update this policy as the Service or law changes. We will post the updated date and provide additional notice or obtain consent when required. We will not use consumer health data for a materially new purpose without first providing required disclosure and consent.

11. Contact

Privacy requests and questions: info@audhdstuff.com

Operator and data controller: AGI Logic LLC, doing business as AuDHD Stuff
28716 Gilchrist Drive
Willowick, OH 44095
United States