This is an archived version (1.3) of our privacy policy, kept for people who shared research answers under it. Read the current policy.
Your answers are yours
Version 1.3 · Effective October 18, 2026
The short version: the test runs in your browser, and your answers never leave your device unless you choose to share them. If you choose to help our research, we receive your answers without your name, email or account, use them only in aggregate, and never sell them.
1. Who we are
Ninefold is run by Golden Echo LLC. We are the controller of any personal data described here. Contact: privacy@nine-fold.com.
2. Taking the test
The test runs entirely in your browser. Your answers and result are not sent to us or anyone else unless you choose to share them for research (section 3). If you close the page without sharing, they're gone. We don't require an account.
3. Sharing for research (optional)
After your result, you may choose to share, for research:
- Your answers: which statements you were shown, the order you saw them in, which you chose, how long each answer took, and the test's calculations along the way;
- Your result (including the portrait you picked) and your “Does this fit?” rating;
- Technical details: the time you shared, the version of the test you took, and automatic checks that flag rushed or patterned answers so they can be excluded from statistics;
- Optional details, each of which you may skip: gender, age band, country, relationship status, how often you attend church, and your role there.
We don't collect your name, email address or account, and we don't store your IP address with research data. Each shared response gets a random response code, which we show you once so that you can ask us to delete it (section 7). Sharing requires you to confirm you are 18 or older and to agree to this policy. If you answer the church questions, sharing also requires a separate checkbox giving explicit consent to processing those answers.
Sharing is entirely voluntary. Not sharing makes no difference to your result or to your use of the site.
4. Why we use it, and on what legal basis
- To calibrate and improve the test's accuracy (for example, how well each statement tells types apart).
- To publish statistics about the types, in aggregate only. We never publish a figure about a group of fewer than 100 people.
Our legal basis is your consent (GDPR Article 6(1)(a)). Questions about church involvement can reveal religious belief, which the law treats as a special category of data; we ask them only with your explicit consent (Article 9(2)(a)), and they are always optional. You can withdraw consent at any time (section 7); withdrawal doesn't affect processing that already happened.
5. What we never do
- We never sell or rent research data, and we don't “share” it for cross-context behavioral advertising.
- We don't use it for advertising, profiling individuals, or any decision about you. We make no automated decisions about you.
- We don't support using Enneagram results for hiring or selection.
- If we ever work with academic researchers, they receive aggregated data only, under a written agreement.
- If Ninefold is ever transferred to a new owner, this policy continues to apply to data shared under it.
6. Who processes data for us, where, and for how long
- Hosting: our website is hosted by Netlify, Inc. (United States), which serves pages through a global network and keeps standard server logs (such as IP address, browser type, pages requested and time) for security and operations.
- Database: research responses are stored with our database provider, Supabase, Inc., on Amazon Web Services in the United States (Ohio). Supabase processes them only on our instructions.
- Logs: our host's server logs are kept for a short period set by the host. Our database provider likewise keeps short-lived request logs that include the IP address a response was sent from. We don't copy these into research data or use them to identify anyone.
- Where your data goes: Ninefold is run from the United States, and research responses are stored there. If you share from outside the US, you're sending your answers directly to us in the US, where data-protection law may differ from yours. We protect your data as this policy describes wherever you are.
- Retention: we keep research responses for up to 10 years, while they're needed for research, and then delete them. Published aggregate statistics may be kept indefinitely, since they describe groups, not people.
- Security: data is encrypted in transit and at rest; the public website can add research responses but cannot read them; access is limited to people who need it.
7. Your rights
Depending on where you live (for example in the EU, the UK or certain US states), you may have the right to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to its use, and withdraw consent. We honor these requests wherever you live.
Because research data isn't linked to your identity, we can only find a specific response if you give us its response code. We don't keep anything that would let us find it without the code, so if you've lost it, we can't locate or delete it. To exercise any right, email privacy@nine-fold.com with your code, and we'll respond within 30 days. We use your email only to handle your request and delete it afterwards. Deleted responses are removed from our database right away, and from any backups when those expire.
If we decline your request, you may appeal by replying with “Appeal” in the subject line; we'll respond within 45 days. If you're still unsatisfied, you may contact your state attorney general. In the EU, you can complain to the data-protection authority where you live; in the UK, to the Information Commissioner's Office (ico.org.uk).
8. Children
Ninefold isn't intended for children under 13. Research sharing is for adults 18 and older only, and we don't knowingly collect data from children. If we learn that a response came from someone under 18, we delete it.
9. Cookies and analytics
We don't currently use cookies, tracking pixels or third-party analytics. If that changes, we'll update this policy first and ask for consent where required. Because we don't track you across sites or sell or share data for advertising, browser signals such as Do Not Track and Global Privacy Control don't change anything on Ninefold; if that ever changes, we'll honor them.
10. Changes
If we change this policy, we'll post the new version here with a new version number and effective date, and keep earlier versions online: 1.2, 1.1. Each research response records the version it was shared under, and it stays governed by that version. If we make a material change to how we use research data, we'll ask for new consent and won't apply the change to responses shared earlier.
Use of the site is also covered by our Terms of use.