Last updated: October 10, 2026
MindLabTest is the trading name of the digital testing and reporting service operated by Dotcase. This privacy policy describes how we collect, use and disclose personal data when you visit or use mindlabtest.com or unlock a digital report.
DotcaseSole proprietorshipSchwalbenweg 1831582 Nienburg/WeserGermanyContactController
The controller under the GDPR is Dotcase, trading as MindLabTest, Schwalbenweg 18, 31582 Nienburg/Weser, Germany. Website: https://mindlabtest.com. You can also use our contact form.
Legal bases
We process personal data in accordance with the GDPR and applicable national data protection rules. Consent is based on Article 6(1)(a), contract performance on Article 6(1)(b), legal obligations on Article 6(1)(c), and legitimate interests on Article 6(1)(f) GDPR.
Categories of personal data
Depending on your use, we process your name, email, Google account identifier, username, profile picture, optional profile details and settings; test answers, progress, completion time, results and saved reports; report unlocks, purchase confirmations and transaction status; contact enquiries, friend requests, Challenge invitations and private messages; IP address, browser/device information and technical access logs. We do not receive your Google password. Historical purchases were processed by Stripe; transaction records may be retained as legally required. We do not receive or store card details.
For email sign-in we also store a salted password hash, hashed verification/reset tokens and temporary request-limit counters. We never store plaintext passwords. Verification and reset tokens expire after 30 minutes; expired tokens and counters are removed during subsequent authentication requests.
Purposes
We process data to provide and evaluate tests, unlock digital reports and certificates, manage and authenticate accounts, and provide the friendship, Challenge and messaging features you use (Article 6(1)(b) GDPR). Historical purchase records may be processed to meet legal accounting and consumer-rights obligations (Article 6(1)(c) GDPR). With your consent we use analytics to understand and improve site usage (Article 6(1)(a) GDPR). We handle contact enquiries for contract performance or our legitimate interest in responding, depending on the enquiry. IT security, abuse prevention and establishing or defending legal claims rely on legitimate interests where your interests do not override them. Legal obligations are fulfilled under Article 6(1)(c).
Consent and publication
Optional email notifications and publication of your result on the leaderboard depend on your choices. Published entries contain the authorised name, profile image, selected country and estimated test score. You can withdraw publication from your report. Completion time breaks score ties but is not published. You can withdraw consent at any time for the future; this does not affect the lawfulness of earlier processing.
Retention
We retain personal data only as long as necessary for its purposes or required by law. Account data and personal reports remain until account deletion, subject to legal obligations. Private messages are encrypted at rest and kept only briefly: they are removed automatically a short time after being read, and in any case within 30 days. You can delete a conversation at any time. Unclaimed guest tests are removed during request-triggered cleanup after 30 days; completed tests remain only as non-personal statistical counters. Correspondence is retained for handling and applicable retention periods. Technical logs and backups depend on the hosting configuration. Where tax records arise, statutory periods under sections 147 AO and 257 HGB apply, including eight years for accounting vouchers and six years for business correspondence.
Visit statistics (own counter, no cookies)
To learn how many visitors open MindLabTest and where they come from, we count only daily totals on our own server (Hostinger, EU; api.angebotavcisi.de): the number of visits (an entry into the website is counted, not every page change and not reloading a page), where the visit comes from (for example Google, YouTube or direct; derived from the referrer address or a campaign parameter in the link) and the device type (phone/tablet/computer). No cookies are set and no information is stored on or read from your device that would require consent under section 25(1) TDDDG; IP addresses or other details that identify you are not stored, and no visit can be attributed to a person. The legal basis is Article 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement).
Recipients and hosting
Hostinger provides hosting, database and business email services within the EU. Stripe processed historical purchases; current IQ tests and reports require no payment. Google provides the sign-in you choose and, subject to your consent, Google Analytics for usage statistics. Private messages and invitations are shown to their recipients; authorised leaderboard entries are public. Authorities and courts receive data when legally required. We conclude data processing agreements with our processors under Article 28 GDPR. The Hostinger and Google privacy notices are linked below. Transfers outside the EEA (for example to Stripe or Google in the USA) require a valid basis, such as an adequacy decision, the EU-U.S. Data Privacy Framework, or standard contractual clauses under Article 46 GDPR; details of applicable safeguards are available on request.
Your rights
Subject to the GDPR, you have rights of access (Article 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), withdrawal of consent (7(3)) and complaint to a supervisory authority (77). Erasure is subject to statutory retention obligations. The competent authority is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, telephone +49 511 120-4500, email poststelle@lfd.niedersachsen.de, https://www.lfd.niedersachsen.de.
Minors and external websites
Our test and account services are intended for people aged 13 or over, and the current IQ services require no purchases. If you are a parent or guardian and discover that your child has provided personal data, contact us through our contact form. Our website may link to external websites. We are not responsible for their privacy practices; please read their privacy notices.
Security and changes
We use technical and organisational measures to protect data against manipulation, loss, destruction and unauthorised access. No internet transmission is completely secure. Keep your login credentials confidential. We may update this policy to reflect legal or service changes. The current version is available on our website; significant changes will be communicated appropriately.