Privacy Policy

Who is responsible for your data

The controller of your personal data is Capritora SRL, 488 chaussée de Louvain, 1380 Ohain, Belgium (company number 0786.931.405).

For any question about your data or to exercise your rights, write to us at hello@mysteryscript.com.

Given the nature and volume of our processing, we are not required to appoint a data protection officer. The address above is your single point of contact for these matters.

The data we process

We process only the data necessary for the service to work:

• Account: your email address and your password (stored in encrypted form, never in clear text).
• Analysis subject: the first name, date of birth, writing hand and, if you provide them, the occupation and situation of the person analysed.
• Handwriting photos: the images you send us for the analysis.
• Portraits and sections: the analyses generated and their status.
• Payment: the information needed for the transaction, handled by our payment provider; we keep technical and accounting identifiers, never your card number.
• Campaign measurement: when you arrive through a partner link, a visit marker and a reduced (hashed) IP address, for measurement purposes.
• Technical operating data: error and security logs, technical responses from the analysis models.

We do not collect data you do not voluntarily entrust to us, and we buy no data from third parties.

Why we process it, and on what basis

Each processing activity rests on a specific legal basis:

• Providing the service ordered (creating your account, producing and giving you access to your portrait, handling payment): performance of the contract between us.
• Keeping the accounting records related to your purchases: legal obligation.
• Ensuring security, preventing fraud, fixing errors and improving quality: our legitimate interest, never overriding your rights.
• Measuring the effectiveness of our campaigns and crediting a partner: your consent, collected through the banner provided for this purpose.

Analysis by artificial intelligence

Your portrait is produced automatically by artificial intelligence systems, from the form of your handwriting. We analyse the form of the gesture (slant, size, line direction, spacing), never the content of the text you wrote.

This portrait is introspective entertainment. It has no medical, psychological, professional or predictive value, produces no legal effect and forms the basis of no decision concerning you. It is produced at your request, about yourself.

By design, the service never infers and never asserts sensitive data: neither health, nor sexual orientation, nor gender identity, nor religion, nor origin, nor political opinions.

If you believe a portrait is inappropriate, write to us: a person can review it.

Handwriting is not biometric data

We analyse the form of your handwriting for entertainment purposes. We seek neither to identify nor to authenticate you by your handwriting, and we build no biometric template. For this reason, your handwriting is treated as ordinary personal data, and not as biometric data subject to a special regime.

Who accesses your data

Your data is never sold. It is shared only with the technical providers strictly necessary for the service, who act on our instructions and are bound by a data protection agreement:

• Data hosting, within the European Union.
• Payment provider, to process your purchase securely.
• Artificial intelligence provider, to produce your portrait; we transmit only what is necessary to analyse the form, never the content of the text for interpretation.
• Email delivery provider, for messages related to your account and purchases.
• Technical monitoring tool, configured not to receive the content of your personal data.
• Domain name provider.

Some of these providers may process data outside the European Union. In that case, the transfer is framed by appropriate safeguards (adequacy decision or the European Commission's standard contractual clauses), a copy of which you can obtain by writing to us.

How long we keep it

We keep your data only for as long as necessary:

• Your account and your portraits: as long as your account exists. An account left inactive is purged after 24 months, following a warning sent one month before.
• The photos of your handwriting: as long as the corresponding subject exists, so that you can order a new angle without having to resend them.
• The accounting records related to your purchases: 7 years, as required by law; they do not carry your name but technical identifiers.
• The technical model responses and the logs: 90 days at most.
• The campaign measurement marker: 90 days.
• The payment data kept after account deletion: only technical identifiers allowing, if necessary, accounting reconciliation and the processing of a refund.

Your rights

You have the following rights over your data at any time:

• Access: know what data we hold and obtain a copy of it.
• Rectification: correct inaccurate data.
• Erasure: request the deletion of your data.
• Restriction: request that processing be frozen in certain cases.
• Portability: receive, in a machine-readable format, the data you provided to us.
• Objection: object to processing based on our legitimate interest.
• Withdrawal of consent: at any time, for processing that depends on it, without affecting what has already been done.

You can delete your account yourself from your personal area: your subjects, photos and analyses are then erased. For any other right, simply write to us at hello@mysteryscript.com. We reply within one month. This is free of charge. We may ask you to confirm your identity, so that we never disclose your data to someone else.

If you believe your rights are not respected, you may lodge a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, autoriteprotectiondonnees.be), or with the authority of your country of residence.

Minors

The service is available from the age of 13. Between 13 and 15, the agreement of a parent or holder of parental authority is required; it is collected when the analysis is created. The parent may exercise, on the child's behalf, all the rights described above.

We address minors in clear language and send them no targeted commercial communication.

Security

We implement technical and organisational measures to protect your data: password encryption, restricted and protected access to sensitive data, hosting within the European Union, and minimisation of what is transmitted to our providers. The paid content of your portrait never leaves our servers before payment.

Campaign measurement and consent banner

When you arrive through a partner link, we record that visit to measure our campaigns. We keep this marker on your device only if you consent, through the banner provided for this purpose; without your agreement, it disappears when the page is closed. We use no advertising pixel and no third-party tracking tool.

Changes

We may update this policy. In the event of a significant change, we will inform you by an appropriate means. The date of the last update appears at the top of this document.