Privacy Policy and AI Analysis Terms

Revision of 29 October 2026.

1. Who we are

The controller of your personal data is:

  • Name: Individualuri Metsarme Aleksei Shipilov
  • Legal form: Individual Entrepreneur
  • Identification number: 106431898
  • Registered: 24 July 2024, LEPL National Agency of Public Registry
  • Address: Ponichala settlement 3, building 5, hall 2, floor 4, Krtsanisi district, Tbilisi, Georgia

Contact for privacy matters: info@16assoc.com

This policy applies to all users of the 16 Associations service.

2. What we collect

  • email address;
  • nickname, if you provide one;
  • Telegram username, if you sign in through Telegram;
  • test content: the test subject, the association words on every level of the pyramid, the final word, and your note;
  • answers to a test taken without an account (on the "try it" page): the subject and the words, stored without any link to you — no cookie, no IP address. If you then sign up or sign in in the same browser, the test moves to your account;
  • AI analyses generated at your request;
  • payment records: amounts, dates, statuses. We never receive or store card details; payments are handled by the payment provider;
  • technical records: timestamps of your actions and server request logs.

3. Why we process it

  • to give you access to your account and keep your test results;
  • to generate AI analyses when you ask for them;
  • to let you recover access to your account;
  • to process payments for paid analyses;
  • to see how the test is taken without an account, from anonymous records of tests on the "try it" page;
  • to keep the service working and secure;
  • to understand where visitors come from and how the service is used (Google Analytics, see section 9).

We do not use your data for advertising, we do not profile you for marketing, and we do not sell it. We share it only as described in sections 4 and 9 and where the law requires.

4. AI analysis: what leaves the service

An analysis runs only when you start it and only after you tick the consent box.

What we send:

  • the test subject;
  • the association words from every level of the pyramid;
  • the final word;
  • your note, if you wrote one;
  • the language code for the response.

What we do not send:

  • your email address;
  • your name, nickname or Telegram username;
  • your user or test identifiers;
  • the date you took the test;
  • the content of any other test;
  • any payment information.

Who receives it. Anthropic PBC, United States of America, through its application programming interface.

Training. Under Anthropic's Commercial Terms of Service (Section B, "Customer Content", effective 17 June 2025), data sent through the API is not used to train their models: "Anthropic may not train models on Customer Content from Services." The one exception is material that Anthropic's automated systems flag as violating their usage policy; such material may be analysed and used to train their internal safety models. We do not send Anthropic any quality feedback on responses and we take part in no programme that would allow training on the data we send.

Terms: https://www.anthropic.com/legal/commercial-terms

5. Special category data

Association test results can reveal information about your mental state. Under Article 9 of the GDPR this is a special category of personal data. We therefore ask for your explicit consent before any analysis, separately from the consent you gave when registering, and we tell you exactly what will be sent.

You can withdraw consent at any time by writing to the contact address in section 1. Withdrawal does not undo analyses already generated, but it stops any further transfer.

6. Where your data is stored

The service runs on servers in Italy, in the European Union (hosting provider Aruba S.p.A.). Your account data and test content are stored there.

Two things leave the European Union. Generating an analysis transfers the data listed in section 4 to Anthropic in the United States. Google in the United States receives the visit statistics from the public pages and the server events described in section 9.

If you are in the European Economic Area or the United Kingdom, the transfer for an analysis is a transfer to a third country. We rely on your explicit, informed consent for it. You can refuse, and you can withdraw consent later; refusing means analyses are not available to you.

7. How long we keep it

Account data and test content are kept until you delete your account. Analyses are kept until you delete them. Payment records are kept for as long as accounting law requires. Tests taken without an account and never moved to an account are deleted 12 months after the last answer.

8. Your rights

You have the right to access your data, to correct it, to erase it, to restrict or object to processing, to data portability, and to withdraw consent. In the service you can delete an individual test, an individual analysis, or your whole account.

To exercise any of these rights, write to the contact address in section 1. If you believe we handle your data unlawfully, you may complain to a data protection authority in your country.

9. Cookies

We use strictly necessary cookies to keep you signed in. Without them you cannot use your account.

On the public pages — the home page, the method description and this policy — we use Google Analytics (Google LLC, United States) to count visits: which pages are opened, where visitors come from, and their country, device and browser. Google Analytics sets its own cookies (_ga and _ga_*) for this. We do not send Google your account, your tests or your analyses: the counter does not run on the sign-in pages, inside your account, in the Telegram app or on shared test pages. You can block it with a content blocker or with Google's opt-out add-on: https://tools.google.com/dlpage/gaoptout

Our server also tells Google Analytics when an account is created, when its first test is finished, when an analysis is started, when the purchase page is opened, when a payment is started and when analyses are bought (with the amount and currency). When you sign up on the website, the visitor identifier from the Google Analytics cookie is stored with your account, so these events can be linked to how you found the site; otherwise a random identifier is used. These events carry only this identifier, not your email, name, Telegram account or test content. We use all of this only to understand where visitors come from and how the service is used.

We do not use advertising cookies.

10. Security

We apply technical and organisational measures to protect your data against unauthorised access, loss and disclosure. Passwords are stored as irreversible hashes. Traffic between your browser and the service is encrypted.

11. What the analysis is not

An AI analysis is not medical or psychological care, it is not a diagnosis, and it does not replace a qualified professional. Treat it as material for self-reflection.

12. Changes

We may update this policy. The current version is always available at the address where you are reading it, and the revision date appears at the top.