Loading...
Loading...
AettAettLast updated: 2026-07-31
Data Controller: Merki AS
Product: Ætt at aett.app
Organization number: 937775601
Contact: contact@merki-as.no
Registered address: Hegglandsvegen 175, 5680 TYSNES, Norway
Company website: merki-as.no
Ætt is developed and operated by Merki AS, a Norwegian limited liability company.
Account Information: Email address, display name, profile picture, demographic information (age, sex, country, education level, occupation) that you choose to provide.
Assessment Data: Your responses to psychological assessments and calculated results including subscale scores and percentile rankings.
Social Data: Friend connections, shared insights, and compatibility calculations between friends.
Usage Data: Device information, browser type, and interaction patterns to improve the platform.
Provide Services: Calculate assessment results, enable friend comparisons, and deliver personalized insights.
Platform Statistics: With your consent, contribute to anonymized aggregate statistics (norms) that help contextualize results for all users.
Research: With your consent, allow anonymized data to be used for research purposes.
Security: Protect against fraud and maintain platform security.
Consent (Art. 6(1)(a)): For processing psychological assessment data (special category data under Article 9).
Contract (Art. 6(1)(b)): To provide the services you signed up for.
Legitimate Interest (Art. 6(1)(f)): For security, fraud prevention, and platform improvement.
Aett offers two collaborative features that involve another user contributing data about you (Observer Mirror — perception checks) or alongside you (Witnessed Growth — witnessing a behavioural-change goal). Both require explicit per-event consent from the recipient.
How it works. When another user invites you to respond to a perception check or to witness a growth goal, your acceptance or decline is recorded along with the timestamp of your decision.
Observer Mirror — what is collected and shared. If you accept and submit Observer Mirror responses, those responses (trait ratings you provide about another user) are stored and linked to the requesting user's profile. You are the data subject providing the data; the requesting user is the primary beneficiary. Your responses are stored as third-party data about the person who invited you and are subject to that person's data export and deletion rights, in addition to your own.
Lawful basis. Processing is based on your explicit consent under GDPR Art. 6(1)(a). Your responses are your impressions of the other person's everyday behaviour — opinions about them, not information about your own health or inner state.
Retention. Consent timestamps are retained for the lifetime of the associated record (Observer Mirror or growth goal). When the record is deleted (including as part of account deletion), these timestamps are deleted with it.
Revocation. You may revoke your involvement as a witness on a growth goal at any time from Settings → My Witness Commitments. For Observer Mirror, you can't edit your answers after submitting — the requester may already have viewed them — but you can ask us to delete them at any time by emailing us with the link URL you received. You can decline a perception check request before submitting.
Aett does not maintain “Inner Circle” or “Extended Circle” classifications between users. Each collaborative feature requires its own explicit acceptance.
To diagnose and fix bugs in features like user search and friend-add, we temporarily log certain failure events — for example, when a user searches for someone and no result is returned. The platform operator uses these logs to find and fix bugs in the social-discovery flow.
What is logged: the search term (truncated for email queries so that only the first few characters and the domain are stored, e.g. and…@example.com), the kind of search (name or email), the timestamp, and the ID of the user who ran the search.
Retention: these logs are deleted automatically within 14 days. The platform operator is the only person who can read them; every access is itself logged.
Lawful basis: legitimate interests under GDPR Art. 6(1)(f) — maintaining a functioning service during the alpha-testing period. We do not use this data for any purpose other than fixing the affected feature.
Diagnostic logging can be turned on or off by the platform operator. It is off by default and is only enabled when an active bug is being investigated.
We treat your assessment data as special category data under GDPR Article 9 and protect it to that standard. That covers both your individual answers and everything worked out from them — scores, comparisons, and the insight text written about your patterns.
We treat it this way because it is deeply personal, not because it is medical. Ætt is not a health service and these questionnaires are not diagnostic: they do not screen for, identify, or measure the severity of any condition, and their results cannot support a conclusion about whether you have or may develop one. We apply the stricter standard because the data deserves it.
We process this data with your explicit consent (Art. 9(2)(a)). Consent for assessment processing cannot be withdrawn separately from the service itself: to withdraw it, delete your account, and your data is erased after the 30-day grace period. The optional consents below can be turned off at any time in your settings.
If you withdraw consent for norm contribution, your data will be excluded from future platform statistics calculations.
Friends: You control what you share with friends through privacy settings and explicit sharing actions.
Service Providers: We use Convex (database), Clerk (authentication), and Vercel (hosting). All providers have Data Processing Agreements and comply with GDPR requirements.
No Sale: We never sell your personal data to third parties.
Your assessment data is stored in the European Economic Area. Some of our service providers are based in the United States; for the data that reaches them, we rely on the following safeguards, which differ by provider:
Alongside those contracts we keep your data encrypted in transit and at rest, we keep assessment data away from every provider except Convex, and our contract with Convex requires them to tell us if a government asks them for your data, unless they are legally barred from doing so.
Under GDPR, you have the right to:
To exercise these rights, visit Settings > Privacy & Data or contact Merki AS at contact@merki-as.no.
Active Accounts: Data retained while your account is active.
Account Deletion: 30-day grace period to cancel deletion, then permanent removal.
Aggregate Statistics: When you delete your account, platform statistics are recalculated without your data — your contribution does not remain inside them. Published statistics are always anonymous aggregates that cannot identify anyone (GDPR Recital 26).
Questions or Requests: contact@merki-as.no
Supervisory Authority: You have the right to lodge a complaint with Datatilsynet (Norwegian Data Protection Authority).
Website: datatilsynet.no
Ætt is developed and operated by Merki AS, a Norwegian limited liability company.