Privacy Policy

SubKiller is operated by Chris Liddiard, a sole trader based in the United Kingdom. For the purposes of UK GDPR, the data controller is Chris Liddiard, contactable at privacy@subkiller.co.uk.

"SubKiller", "we", "us" and "our" all refer to the same thing in this policy: the service that runs at subkiller.co.uk.

We collect the bare minimum needed to run the service. There are no accounts, no profiles and no mailing lists. The data we do handle falls into four categories:

• Test answers and assessment data. When you take a test (IQ, personality, CV audit, etc.) we collect the answers you give in order to generate your report. This is held only for as long as needed to deliver your report and is not linked to your name or identity unless you choose to provide one.
• Payment data. When you pay £2, the payment is processed by Stripe. We never see or store your card details. We receive a transaction reference from Stripe so we can match a successful payment to a report.
• Email address (only if you choose to give one). If you opt to have your report emailed to you, we collect your email address solely for that purpose. We do not add you to any mailing list. We do not send marketing. We do not share it.
• Analytics data (only with your consent). If you accept cookies, Google Analytics records anonymised information about your visit: the pages you viewed, the country you came from (IP-anonymised, never your full IP address), the type of device and browser, and basic referral information. If you decline cookies, none of this is collected.

We do not collect: your name (unless you submit it as part of a test), your address, your phone number, your IP address (in full), biometric data, or any special category data under UK GDPR Article 9.

We use the data we collect to:

• Generate your assessment report.
• Process your one-off payment.
• Send your report to your email address, if you asked for that.
• Understand which pages and tools people use, so we can improve the service (this is the analytics data, and only happens with consent).
• Comply with our legal and regulatory obligations (e.g. tax records).

We do not use your data for profiling, automated decision-making with legal effects, or marketing.

Under UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are:

• Performance of a contract. When you pay for a report, we need to process your test answers and payment data in order to deliver what you paid for.
• Consent. Analytics cookies are set only after your explicit consent. You can withdraw this consent at any time using the "Cookie settings" link in the bottom-left corner of every page.
• Legitimate interests. For security, fraud prevention and minor service improvements, we may rely on legitimate interests, balanced against your rights.
• Legal obligation. We keep certain payment and tax records as required by UK law.

We use a small number of trusted third-party services to run SubKiller. Each of them processes your data only for the specific purpose set out below, and each is bound by appropriate data processing agreements.

• Stripe — payment processing. Stripe receives your card details directly (we do not see or store them) and processes the £2 charge. Stripe privacy policy.
• Anthropic — AI processing. Your test answers are sent to Anthropic's Claude API to generate the personalised report. Anthropic does not train its models on this data and processes it under their commercial terms. Anthropic privacy policy.
• Google Analytics (GA4) — visitor analytics, only with consent. Google receives anonymised event data about your visit. Google privacy policy.
• Meta Pixel — ad measurement, only with consent. If you accept cookies, the Meta Pixel records anonymised events (page views, purchases) to help us measure the effectiveness of any Facebook or Instagram advertising. We do not use it to retarget you personally. Meta receives no personally identifiable information from us. Meta privacy policy.
• Netlify — website hosting. Netlify hosts the SubKiller site and necessarily processes basic request data (IP address, browser) in order to serve pages. Netlify privacy policy.

We do not sell your data. We do not share it with advertisers, data brokers, or any third party not listed above.

Some of the third-party services above (Stripe, Anthropic, Google, Netlify) are based in the United States or have global infrastructure. This means your data may be transferred outside the United Kingdom and the European Economic Area.

Where this happens, transfers are protected by appropriate safeguards — typically the UK International Data Transfer Addendum attached to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where applicable. Each provider listed above publishes its own information about how it handles cross-border transfers.

• Test answers and reports: retained for up to 30 days after generation, then permanently deleted.
• Email addresses: retained only for as long as needed to deliver your report (typically minutes), then deleted.
• Payment records: retained for 6 years to comply with HMRC record-keeping requirements under UK tax law.
• Analytics data: retained for 14 months in Google Analytics, then automatically deleted.

We use two categories of cookies — analytics cookies set by Google Analytics and measurement cookies set by the Meta Pixel — and only after you accept them via our cookie banner. If you decline, no cookies are set.

We do not use advertising cookies for retargeting, data broker sharing, or any third-party cookies for marketing purposes beyond the ad measurement described above.

You can change your cookie choice at any time using the "Cookie settings" link in the bottom-left corner of every page. You can also clear cookies through your browser settings.

Under UK GDPR you have the following rights in respect of your personal data:

• Right of access — to ask what data we hold about you.
• Right to rectification — to ask us to correct inaccurate data.
• Right to erasure ("right to be forgotten") — to ask us to delete data we hold about you.
• Right to restrict processing — to ask us to limit what we do with your data.
• Right to data portability — to receive your data in a machine-readable format.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, email privacy@subkiller.co.uk. We respond within one calendar month, in line with UK GDPR.

If you are unhappy with how we handle your data, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

SubKiller is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided data to SubKiller, please contact us and we will delete it.

We take reasonable technical and organisational measures to protect your data, including HTTPS encryption in transit, secure payment processing through Stripe (PCI-DSS compliant), and restricted access to any systems holding personal data.

No method of transmission or storage on the internet is 100% secure, but we use industry-standard practices and regularly review our security posture.

We may update this privacy policy from time to time, for example if we add new tools or change how the service works. The "Last updated" date at the top of this page will always reflect the most recent version. For material changes, we will notify users via the cookie banner or a prominent notice on the homepage.

For any privacy-related questions, complaints, or to exercise your rights, email privacy@subkiller.co.uk.

We aim to respond within 7 days, and always within the one-month limit set by UK GDPR.