Privacy.

Who controls your data

[TO CONFIRM: registered entity name and address. Under GDPR the controller must be identifiable.] We are the data controller for the personal data described below.

[TO CONFIRM: whether a Data Protection Officer is required. For an operation of this size it is usually not, but the assessment should be recorded.]

What we collect

When you create an account: your email address, a securely hashed password, and optionally your name. We never see or store your password in readable form.

When you use the Question Bank: which questions you answered, whether each was correct, incorrect or left blank, how long you spent, and the subject, topic and difficulty of each. This is what produces your progress page and study plan.

When you buy something: a record that your account owns a product, the provider and an order reference. Card details are handled entirely by our payment provider and never reach us.

Automatically: standard server logs from our hosting provider, including IP address and browser type, kept for security and abuse prevention.

Why we process it, and on what legal basis

• To provide the service you paid for, including logging you in, showing your materials, saving your progress and generating study plans. Legal basis: performance of a contract.
• To keep the service secure and prevent account sharing and abuse. Legal basis: legitimate interests.
• To meet accounting and tax obligations for purchases. Legal basis: legal obligation.
• [TO CONFIRM: marketing emails. If you intend to send any, this needs a separate consent basis and an opt-in at signup. If you do not intend to, say so explicitly here, since that is a genuine selling point.]

Automated study plans and AI

Your progress page includes a study plan generated with help from a third-party AI provider, currently Anthropic.

What is sent: aggregated statistics only. Your accuracy percentages by subject and topic, your counts of correct, incorrect and blank answers, average time per question, and recent session scores.

What is not sent: your name, your email address, your account identifier, or any message you have written. The provider receives numbers, not an identifiable person.

[TO CONFIRM: verify Anthropic's current data retention and training position for API traffic, and confirm a data processing agreement is in place. Also confirm whether processing occurs outside the EEA and, if so, which transfer mechanism applies. This is the clause most likely to need correction.]

These plans are automated suggestions. They do not produce legal or similarly significant effects, and a human decision is not required for them. You can ignore them entirely and the rest of the service works unchanged.

Who else processes your data

We use a small number of providers who process data on our behalf under contract:

• Supabase, database and authentication. Your account and progress are stored here. [TO CONFIRM: hosting region. The project is currently in Ireland, which keeps this data in the EU.]
• Netlify, website hosting and serverless functions.
• Anthropic, AI study plan generation, as described above.
• [TO CONFIRM: payment provider name], who acts as merchant of record and is a separate controller for the payment itself, under their own privacy policy.

We do not sell your data, and we do not share it with advertisers.

How long we keep it

Your account and progress data are kept while your account is open. If you ask us to delete your account we remove your personal data within [TO CONFIRM: 30] days, except records we must keep for tax and accounting purposes, which are retained for [TO CONFIRM: the statutory period in your jurisdiction, commonly 7 or 10 years].

Server logs are kept for [TO CONFIRM: 30 / 90] days.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on legitimate interests. You can also ask for your data in a portable format.

You can delete your own answer history at any time from the progress page, without contacting us.

To exercise any other right, email [TO CONFIRM: privacy contact address]. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to your national data protection authority. [TO CONFIRM: name the supervisory authority for the country of establishment.]

Cookies and similar technologies

We use a small number of strictly necessary items: a session token that keeps you signed in, and local browser storage used to hold your place in a practice session. These are required for the service to function and are not used for tracking or advertising.

[TO CONFIRM: whether any analytics are in use. If you add analytics later, this section needs a consent banner and this paragraph must be rewritten. At present none is installed, which is why no banner is shown.]

Children

The service is intended for people preparing for university entrance and is not directed at children under [TO CONFIRM: 16, or the applicable age of digital consent]. We do not knowingly collect data from them.

Security

Passwords are hashed by our authentication provider and are never visible to us. Access to your materials and progress is enforced at the database level, so another user's account cannot read your data. Connections are encrypted in transit.

No system is perfectly secure. If a breach affects your rights we will notify you and the relevant authority as required by law.

Changes

If we change this policy materially we will notify account holders by email.

Last updated: [TO CONFIRM: date of publication]