Privacy Notice

• Account and authentication data, including display name, email address, account ID, sign-in events and password-reset or email-confirmation activity. We do not see your password.
• Study data, including session choices, selected answers, scores, timing settings, progress, revision schedules, bookmarks and study preferences.
• Purchase and access data, including plan duration, GBP base price, amount and currency paid, tax amount, declared country of residence, billing country, selected standard or Managed Payments route, access dates, checkout-consent evidence, purchase-confirmation status and Stripe transaction, customer and payment references.
• Support and content-quality data, including messages, question reports, issue type, linked question and session references, reporting account, timestamps and resolution records.
• Limited technical diagnostics, such as the page route and error context, when the hosting environment's operational error reporting is available.

• Contract: to create and secure your account, provide the trial or paid service, save your work, process access and respond to service requests.
• Legitimate interests: to operate and improve a secure question bank, investigate errors and misuse, support learners and understand aggregate platform performance. We consider the impact on users before relying on this basis.
• Legal obligation: to keep records needed for accounting, tax, consumer protection, fraud prevention and responding to lawful requests.
• Consent: only where we ask for a separate optional choice. The current site does not use consent for essential account or service processing.

• The current site sends account-service messages such as account confirmation and password reset. Stripe/Link may also send transaction receipts or other payment communications according to the route used at checkout.
• There is no newsletter sign-up or marketing-email system in the current learner website. We will not treat an account email as marketing consent.
• The current site does not load advertising, behavioural analytics or social-media tracking tools.
• The current learner service does not send your answers, reports or account data to a generative-AI assistant or model.

Some providers may process information outside the UK. Where UK data-protection law requires a transfer safeguard, we expect the relevant provider or contract to use an adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. Contact us if you would like information about the safeguard relevant to a particular provider.

• Account and study records are generally kept while your account remains open and for a limited period afterwards where needed to restore, secure or close the service.
• Contract, payment and accounting records may be kept for up to six years after the relevant transaction or relationship where needed for legal, tax or dispute records.
• Support and question-report records are kept for as long as reasonably needed to resolve the issue, maintain a correction trail and deal with related claims.
• Security logs, backups and operational diagnostics are kept for limited provider or incident-response periods and are then deleted or overwritten.

We use access controls, authenticated database policies, server-side payment verification and restricted administrator functions designed to protect information. No online service can guarantee absolute security. Please use a unique password and tell us promptly if you suspect unauthorised access.

Supabase uses essential local browser storage to keep signed-in sessions working. The active site does not use advertising or analytics cookies. Read the Cookie Notice for the current storage audit and browser controls.

We will update the effective date and version when this notice changes. If a change is material to how existing account information is used, we will provide an appropriate additional notice through the service or by email.