Privacy Policy

WhatsMyArc (whatsmyarc.com) is operated by 4xxi Software Ltd. (“we”, “us”, “our”). For the purposes of UK data protection law, we are the data controller.

Contact: [email protected]

WhatsMyArc is a narrative identity exploration tool. Users complete a structured interview about their life story, and our system analyses the responses using constructs from narrative psychology research to generate a personalised report. The analysis is performed by artificial intelligence (Large Language Models).

Important: WhatsMyArc is not a psychological, therapeutic, clinical, or diagnostic tool. It does not provide professional advice of any kind. It is an entertainment and self-exploration product. For more detail on what WhatsMyArc is and is not, see our Science page and Terms of Service.

Account data. When you sign in, we receive your name and email address from the authentication provider. This is used for account management and to associate your assessment results with your account.

Interview answers. When you complete a narrative assessment, we store the free-text answers you provide to the interview questions. These answers are the primary input for the analysis.

Analysis results. We store the analysis output: construct scores, your narrative type classification, and the generated report. This allows you to revisit your results.

Server logs. Our hosting provider automatically collects standard server log data (IP address, browser type, pages visited, timestamps). This data is used for security, performance monitoring, and error diagnosis. Server logs are retained for up to one year.

Analytics. We use Umami, a privacy-friendly analytics service. Umami does not use cookies, does not collect personal data, and does not track individual users across sessions. Analytics data is aggregated and anonymous.

Strictly necessary cookies. We use only cookies that are essential for the website to function (session management, authentication tokens). We do not use marketing, advertising, analytics, or third-party tracking cookies. For a full list of cookies and their purposes, see our Cookie Policy.

Voluntary correspondence. If you contact us by email, we process the personal data you provide for the purpose of responding to your enquiry.

We process personal data on the following lawful bases under UK GDPR:

• Contract performance (Article 6(1)(b)): processing your interview answers to generate your narrative analysis and report.
• Legitimate interests (Article 6(1)(f)): server logs for website security and performance; anonymous analytics for service improvement.
• Consent (Article 6(1)(a)): if you voluntarily contact us, your correspondence is processed on the basis of your consent.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Your interview answers are sent to third-party AI providers for analysis. We currently use:

• OpenAI (US-based) — Large Language Models for narrative coding and report generation.
• Anthropic (US-based, accessed via OpenRouter) — Large Language Models for narrative coding and report generation.

The data sent to AI providers includes your interview answers and the system prompts that guide the analysis. Your name and email address are not sent to AI providers.

We do not use your data to train AI models. Our agreements with AI providers specify that data submitted via API is not used for model training.

We may change AI providers in the future. This Privacy Policy will be updated to reflect any such changes. The principle remains the same: only interview content (not personal identifiers) is shared with AI providers, and only for the purpose of generating your analysis.

Your account data, interview answers, and analysis results are retained for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us at [email protected].

Server logs are retained for up to one year. Analytics data is aggregated and does not contain personal information.

Your data may be processed outside the United Kingdom or European Economic Area. In particular, AI providers (OpenAI, Anthropic) are based in the United States. Transfers to these providers are made under Standard Contractual Clauses or equivalent safeguards approved under UK GDPR. Where providers are certified under the UK Extension to the EU-US Data Privacy Framework, that certification may also apply.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate personal data.
• Erase your personal data (“right to be forgotten”).
• Restrict processing of your personal data.
• Object to processing based on legitimate interests.
• Data portability where applicable.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

WhatsMyArc is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not use this service.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “last modified” date. Your continued use of the service after any changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests:

Email: [email protected]