This policy explains what personal data Shemoon collects, why we collect it, how long we keep it, and what rights you have over it. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
1. Who we are
Shemoon is a brand identity assessment and coaching service, operating as a registered business name of a sole trader based in Ireland.
For the purposes of GDPR, we are the data controller for the personal data described in this policy.
Contact for all data protection matters: hello@getshemoon.com
If you need our full registered details for a formal data protection request or a complaint to a supervisory authority, email the address above and we will provide them.
We are not required to appoint a Data Protection Officer, as we do not carry out large-scale monitoring or process special categories of data as a core activity.
2. What data we collect, and why
Assessment responses
What: Your answers to the Shemoon assessment questions, and the archetype result calculated from them.
Why: To generate your reading and, where applicable, your report.
Legal basis: Consent (free assessment) or performance of a contract (paid report).
Contact details
What: Your name and email address.
Why: To deliver your result or report, and to contact you about your engagement.
Legal basis: Consent, or performance of a contract where you have purchased a report.
Payment information
What: Transaction records. We do not collect, see, or store your card details — payments are processed directly by Stripe.
Why: To take payment and meet accounting and tax obligations.
Legal basis: Performance of a contract, and legal obligation for retention of financial records.
Feedback and testimonials
What: Responses to feedback surveys, and any quote you explicitly agree we may publish.
Why: To improve the assessment, and — only with your specific written consent — to publish as a testimonial.
Legal basis: Consent. You can withdraw it at any time.
Team engagement data
What: Where an organisation purchases a team reading, the individual results of participating team members.
Why: To produce the team-level analysis.
Legal basis: Consent from each individual participant.
If your organisation purchased a team reading, your individual result belongs to you, not to your employer. The team report shows aggregate patterns and the composition of the team. We do not disclose any individual's specific result to an employer, manager, or colleague without that individual's explicit consent.
3. Who we share data with
We use the following third-party providers to operate the service. Each acts as a data processor on our behalf, under a data processing agreement:
- Jotform — hosts the assessment and collects responses
- Zapier — connects our systems to deliver your report automatically
- PDFMonkey — generates your report document
- Stripe — processes payments (Stripe is a data controller in its own right for payment data)
- Netlify — hosts this website
- Zoho Mail — our business email provider
- Licensed Shemoon facilitators — where you work with a certified coach, they will have access to your report in order to deliver your session
Some of these providers are based outside the European Economic Area. Where data is transferred outside the EEA, it is protected by Standard Contractual Clauses or an equivalent recognised safeguard.
We do not sell your personal data, and we do not share it with advertisers.
4. How long we keep it
- Free assessment responses: up to 12 months, then deleted
- Paid report data: up to 3 years from purchase, so we can re-issue your report if you need it
- Financial and transaction records: 6 years, as required by Irish tax law
- Marketing contact details: until you unsubscribe or ask us to delete them
- Feedback survey responses: up to 24 months
5. Your rights
Under GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct anything inaccurate
- Erasure — ask us to delete your data, where we have no overriding legal obligation to keep it
- Restriction — ask us to pause processing while a concern is resolved
- Portability — receive your data in a machine-readable format
- Object — object to processing carried out on the basis of legitimate interests
- Withdraw consent — at any time, where consent is the legal basis
- Complain — lodge a complaint with a supervisory authority
To exercise any of these, email hello@getshemoon.com. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Irish Data Protection Commission at dataprotection.ie.
6. Cookies
This website does not currently use analytics, advertising, or tracking cookies. Only strictly necessary cookies are used, which do not require consent.
If we introduce analytics or other non-essential cookies in future, we will add a consent banner and update this policy before doing so.
7. Security
We use reputable providers with industry-standard security, access our systems using multi-factor authentication where available, and limit access to personal data to those who need it to deliver the service.
No system is completely secure. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours and inform you where required.
8. Children
Shemoon is intended for working professionals and is not directed at children. We do not knowingly collect data from anyone under 16, which is the digital age of consent in Ireland.
9. What this assessment is not
Shemoon results are provided for educational and entertainment purposes only. The assessment is not a clinical, psychological, or diagnostic instrument, and results should not be used as a substitute for professional psychological, medical, or mental health advice, diagnosis, or treatment. We do not process health data or any special category data as defined by GDPR Article 9.
10. Changes to this policy
We review this policy at least annually. If we make material changes, we will update the date at the top and, where the change significantly affects you, notify you directly.