Back to home

Privacy Policy

Last updated: 25 October 2026

Who is responsible for your data

The controller of your personal data is Capritora SRL, 488 chaussée de Louvain, 1380 Ohain, Belgium (company number 0786.931.405).

For any question about your data or to exercise your rights, write to us at hello@mysteryscript.com.

Given the nature and volume of our processing, we are not required to appoint a data protection officer. The address above is your single point of contact for these matters.

The data we process

We process only the data necessary for the service to work:

  • Account: your email address and your password (stored in encrypted form, never in clear text).
  • Analysis subject: the first name, date of birth, writing hand and, if you provide them, the occupation and situation of the person analysed.
  • Handwriting photos: the images you send us for the analysis.
  • Portraits and sections: the analyses generated and their status.
  • Payment: the information needed for the transaction, handled by our payment provider; we keep technical and accounting identifiers, never your card number or the details of your payment account.
  • Campaign measurement: when you arrive through a partner link, a visit marker and a reduced (hashed) IP address, for measurement purposes.
  • Audience measurement without cookies: on every page viewed, our server derives the country from your IP address and the type of device (computer, mobile phone or tablet) from your browser, and adds one to the counter for that country and device for the day. To count unique visitors, it calculates a daily identifier: an unreadable code (a one-way hash) produced from your IP address and your browser with a secret that changes every day, which can neither reveal your IP address nor recognise you from one day to the next. We do not keep your IP address, and nothing is stored in your browser for this measurement.
  • Country: the country derived from your IP address when you create your account and when you start an analysis, for our statistics by country. It is derived using the IP to Country Lite database by DB-IP (https://db-ip.com), licensed under the Creative Commons Attribution 4.0 International License.
  • Device type: computer, mobile phone or tablet, derived from your browser when you create your account, start an analysis or proceed to payment, for our statistics by device.
  • Audience and advertising measurement. On every visit, Google tags load. Before you make a choice, and if you refuse, they set no cookie and only send Google cookieless signals, which Google uses to estimate visits and conversions without identifying you: the page visited (including the advertising click identifier if you arrived from one of our advertisements), technical information about your browser, your IP address, the steps of your visit and, when you create an account or buy a portrait, the fact of that sign-up or purchase with its amount, order number and price offer, never your email address. If you accept cookies: the pages you visit, your device and browser, an approximate location derived from your IP address, the campaign that brought you to us, an internal account number (never your name or email address) so that your visits on several devices are counted once, the steps of your visit (photo sent, questionnaire completed, free portrait viewed, payment started), and, when you create an account or buy a portrait, the fact of that sign-up or purchase (with its amount, order number, price offer and whether it is your first purchase) and your email address, sent to Google in hashed form so that it can link the purchase to an advertisement you saw.
  • Messages you send us: when you write to hello@mysteryscript.com, your email (address, name, subject, text and attachments) and our replies.
  • Technical operating data: error and security logs, technical responses from the analysis models.

We do not collect data you do not voluntarily entrust to us, and we buy no data from third parties.

Why we process it, and on what basis

Each processing activity rests on a specific legal basis:

  • Providing the service ordered (creating your account, producing and giving you access to your portrait, handling payment): performance of the contract between us.
  • Keeping the accounting records related to your purchases: legal obligation.
  • Ensuring security, preventing fraud, fixing errors and improving quality: our legitimate interest, never overriding your rights.
  • Measuring the effectiveness of our campaigns and crediting a partner: your consent, collected through the banner provided for this purpose.
  • Measuring the audience of the site and the effectiveness of our advertising with Google Analytics and Google Ads: the cookieless signals sent before your choice or after a refusal rest on our legitimate interest in measuring our advertising; cookies, the matching of sign-ups and purchases with our advertisements, measurement across devices and advertising personalisation rest on your consent, collected through the cookie banner and withdrawable at any time.
  • Measuring the audience of the site by country and knowing where our sign-ups and analysis requests come from: our legitimate interest. This measurement sets no cookie and does not follow you from one day to the next.

Analysis by artificial intelligence

Your portrait is produced automatically by artificial intelligence systems, from the form of your handwriting. We analyse the form of the gesture (slant, size, line direction, spacing), never the content of the text you wrote.

This portrait is introspective entertainment. It has no medical, psychological, professional or predictive value, produces no legal effect and forms the basis of no decision concerning you. It is produced at your request, about yourself.

By design, the service never infers and never asserts sensitive data: neither health, nor sexual orientation, nor gender identity, nor religion, nor origin, nor political opinions.

If you believe a portrait is inappropriate, write to us: a person can review it.

Handwriting is not biometric data

We analyse the form of your handwriting for entertainment purposes. We seek neither to identify nor to authenticate you by your handwriting, and we build no biometric template. For this reason, your handwriting is treated as ordinary personal data, and not as biometric data subject to a special regime.

Who accesses your data

Your data is never sold. It is shared only with the technical providers strictly necessary for the service, who act on our instructions and are bound by a data protection agreement:

  • Data hosting, within the European Union.
  • Payment provider, to process your purchase securely.
  • Artificial intelligence provider, to produce your portrait; we transmit only what is necessary to analyse the form, never the content of the text for interpretation.
  • Email delivery provider, for messages related to your account and purchases.
  • Email receiving provider (Cloudflare), which receives the emails sent to hello@mysteryscript.com and passes them on to us.
  • Technical monitoring tool, configured not to receive the content of your personal data.
  • Domain name provider.
  • Google (Google Ireland Limited), for audience measurement (Google Analytics), advertising measurement (Google Ads) and, if you accept cookies, advertising personalisation: Google may show our advertisements to people who visited the site, and may recognise you across devices if you are signed in to your Google account (Google signals). Google may transfer this data to the United States, under the EU-US Data Privacy Framework.

Members of our team with administrator access can view your account details, your handwriting photos, your answers to the questionnaire, your portraits, the exchanges with our artificial intelligence provider and the emails you send us, solely to run the service, answer your requests and fix problems. Each consultation is recorded in an access log kept for 365 days.

Some of these providers may process data outside the European Union. In that case, the transfer is framed by appropriate safeguards (adequacy decision or the European Commission's standard contractual clauses), a copy of which you can obtain by writing to us.

How long we keep it

We keep your data only for as long as necessary:

  • Your account and your portraits: as long as your account exists. An account left inactive is purged after 24 months, following a warning sent one month before.
  • The photos of your handwriting: as long as the corresponding subject exists, so that you can order a new angle without having to resend them.
  • Your emails to us and our replies: 24 months after the last message in the conversation, and deleted immediately if you delete the account opened with the same email address.
  • The accounting records related to your purchases: 7 years, as required by law; they do not carry your name but technical identifiers.
  • The technical model responses and the logs: 90 days at most.
  • The campaign measurement marker: 90 days.
  • The payment data kept after account deletion: only technical identifiers allowing, if necessary, accounting reconciliation and the processing of a refund.
  • Your cookie choice: 6 months, after which we ask you again.
  • Google Analytics and Google Ads cookies: 13 months at most; the measurement data held by Google Analytics: 14 months.
  • The daily identifier used to count unique visitors, and its secret: deleted from our database the following day and never included in our backups; our hosting provider's automatic backup copies may contain them for up to 30 days.
  • The visit counters per day and per country, which concern no one in particular: no time limit.
  • The country of your account and of your analyses: as long as your account exists.
  • Our hosting provider keeps its own technical logs, which contain visitors' IP addresses, under its own retention terms.

Your rights

You have the following rights over your data at any time:

  • Access: know what data we hold and obtain a copy of it.
  • Rectification: correct inaccurate data.
  • Erasure: request the deletion of your data.
  • Restriction: request that processing be frozen in certain cases.
  • Portability: receive, in a machine-readable format, the data you provided to us.
  • Objection: object to processing based on our legitimate interest.
  • Withdrawal of consent: at any time, for processing that depends on it, without affecting what has already been done.

You can delete your account yourself from your personal area: your subjects, photos and analyses are then erased. For any other right, simply write to us at hello@mysteryscript.com. We reply within one month. This is free of charge. We may ask you to confirm your identity, so that we never disclose your data to someone else.

If you believe your rights are not respected, you may lodge a complaint with the Data Protection Authority (Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, autoriteprotectiondonnees.be), or with the authority of your country of residence.

Minors

The service is available from the age of 13. Between 13 and 15, the agreement of a parent or holder of parental authority is required; it is collected when the analysis is created. The parent may exercise, on the child's behalf, all the rights described above.

We address minors in clear language. Google does not show personalised advertising to people under 18.

Security

We implement technical and organisational measures to protect your data: password encryption, restricted and protected access to sensitive data, hosting within the European Union, and minimisation of what is transmitted to our providers. The paid content of your portrait never leaves our servers before payment.

Cookies and consent

When you first visit the site, a banner asks for your agreement. Google tags load on every page, but until you click "Accept" ("Accepter" on the French site), and if you click "Reject" ("Refuser"), they set no cookie and only send cookieless signals, without identifying you. Refusing changes nothing about your visit: the site works exactly the same.

The audience measurement by country described above sets no cookie and works whatever your choice.

With your agreement, we use:

  • Google Analytics (cookies _ga and _ga_*): measuring how many people visit the site and which pages they see. 13 months at most.
  • Google Ads (cookies _gcl_*): knowing whether a sign-up or a purchase follows a click on one of our advertisements. 13 months at most.
  • Advertising personalisation (remarketing): Google may show our advertisements to people who visited the site, using lists of visitors (for example, people who viewed their free portrait without buying).
  • A partner visit marker (stored in your browser, ms.click): crediting the partner who sent you to us if you buy. 90 days.

Without your agreement, we keep in your browser only what the site needs to work, including your cookie choice itself (ms.consent, 6 months) and, for the duration of your visit, the purchase you are paying for (so that it is counted once).

You can change your mind at any time with the "Manage cookies" link ("Gérer les cookies" on the French site) at the bottom of every page. If you withdraw your agreement, the Google cookies and the Google Ads data stored in your browser are deleted.

The Google Analytics advertising features we use are remarketing, the link between Google Analytics and Google Ads, and Google signals (which also produces demographic and interest reports). Google combines its own cookies (_ga) with Google advertising identifiers for these purposes, only with your agreement.

To refuse personalised advertising beyond our site: manage the advertisements Google shows you in your Google ad settings (https://adssettings.google.com), or opt out of personalised advertising from many networks at https://optout.networkadvertising.org and https://www.youronlinechoices.eu. You can block Google Analytics on every site with Google's browser add-on (https://tools.google.com/dlpage/gaoptout).

How Google uses the data of sites that use its services: https://business.safety.google/privacy/

Changes

We may update this policy. In the event of a significant change, we will inform you by an appropriate means. The date of the last update appears at the top of this document.