Privacy

What we use and why

• Account and learning: email, sign-in details, answers, scores, progress and preferences provide your course and study suggestions. Legal basis: contract. An email is required for an account; your test date is optional.
• Weekly emails: email and progress provide study reminders. Legal basis: consent.
• Support and security: messages, question reports and technical logs help us answer requests, correct errors and prevent misuse. Legal basis: our legitimate interests in support and a reliable, secure course.
• Course improvement: existing account and learning records provide course-use totals. Legal basis: our legitimate interest in understanding and improving course use.
• Purchases, when available: email, account and order references go to Stripe; payment confirmations provide course access. Legal basis: contract.
• Financial records: payment, refund and accepted agreement records meet accounting and legal obligations. Legal basis: legal obligation.

Weekly emails

Off by default. Withdraw consent anytime in My account or through an email's unsubscribe link. Withdrawal does not affect earlier lawful use. Essential sign-in, security and account-deletion notices are separate.

Who handles your information

• Supabase: accounts, learning, preferences, reminders and purchase records.
• Cloudflare: hosting, security, question reports and encrypted backups.
• Resend: account emails, study reminders and report notifications.
• GitHub: temporary processing to create encrypted account backups.
• Google Gmail: support messages.
• Stripe, Link and Onelink: future checkout, payments and refunds. They collect payment and security data directly and act independently for some purposes. We receive order details and payment status, not full card details. See Stripe's privacy notice.

The course owner administers these services. Providers also process network addresses and service logs.

Outside the UK

Our main account database is in London. Some processing occurs overseas, including Supabase's Singapore contracting entity and Resend's US email storage.

Transfers use applicable UK adequacy arrangements or contractual safeguards, including UK additions to standard contractual clauses. Covered US recipients may use the UK Extension to the EU-US Data Privacy Framework. Contact us for details or copies of applicable safeguards.

Cookies and browser storage

We use these for sign-in, access, security, display preferences and progress. We do not add advertising cookies or analytics trackers.

Local progress, preferences and unsent feedback stay on your device until cleared or reset. Signed-in progress also saves to your account. Clearing site data may sign you out or remove unsent work; it does not delete your account. Blocking storage may prevent sign-in or saved progress.

How long we keep information

• Accounts and learning: deleted after 12 months without signing in or actively using the course, once paid access ends. We give at least 30 days' email notice. Sign-in or active use restarts the period; automated activity does not. Failed warnings, unresolved purchases or legal holds can delay deletion. For existing preview accounts, the period began on 22 September 2026.
• Reminder delivery records: 90 days. Preferences and consent records stay with your account.
• Support and reports: 12 months after resolution, longer for unresolved disputes or legal obligations.
• Financial records: six years after the end of the last company financial year they concern, longer if legally required.
• Backups: independent copies expire after 30 days; Supabase keeps seven daily copies. Deleted data remains restricted until backups expire. Minimal deletion records prevent restoration until affected copies expire.

Your choices and rights

Use My account to change your test date, reset progress or delete your account. Deletion removes active account, learning and reminder records. Separate reports, messages, required financial records, backups and copies on other devices follow the retention periods above or need separate removal.

You can request access, correction, deletion, restricted use or a portable copy of your information, where applicable.

You can object to processing based on legitimate interests, including course-use totals.

Contact us to exercise your rights. No form is required. We normally respond within one calendar month and may check your identity. We explain any permitted extension or refusal.

Complaints

Email us or write to our registered office. We acknowledge complaints within 30 days, investigate, keep you informed and explain the outcome without unnecessary delay. You can also complain to the ICO.