A system for storing and controlling access to data representing personal behavior, the system comprising an ID retrieval apparatus to receive identifying information revealing the identity of an individual, to submit a request corresponding to the received identifying information to an ID generation apparatus, to receive an anonymized user ID in return, and to output the user ID to the individual; a data engine comprising a data store and an access controller, the store being inaccessible to the ID retrieval apparatus and configured to receive and store personalized behavioral data, access to the stored behavioral data being controlled by the controller, the behavioral data representing behavior of the individual, which data are anonymously personalized with the user ID; the controller controlling access to the data by requiring that access requests from service providers specify the user ID with which the behavioral data are personalized to access the data.