Privacy Policy

• Email address — collected at sign-up via Supabase Auth
• Subscription status and plan tier — stored in our database
• Stripe customer ID — stored when you subscribe, used to manage billing
• Learning progress — which modules you have completed, stored in our database
• Quiz attempts and certificates — your quiz answers, scores, and any certificates you earn, stored in our database. Certificates carry a recipient name you choose; a certificate's verification page (including that name) is public only if you make it public
• Sign-up source — which page or prompt you created your account from, stored with your account
• Feedback submissions — message, optional email, and category submitted via the feedback form; sent to our support inbox and not stored in our database
• Anonymised usage analytics — page views and behavioural events (e.g. upgrade button clicks) via Vercel Analytics (no cookies, no PII)
• Analytics cookies — pseudonymous identifiers, session data, and device/browser information via Google Analytics 4, set only with your consent

We do not collect addresses or payment card details. Card data is handled entirely by Stripe. The only name we hold is the certificate recipient name you optionally provide.

• To provide and manage your account
• To process subscription payments via Stripe
• To send transactional emails (account confirmation, password reset) via Supabase
• To understand aggregate usage patterns and improve the platform

We do not sell your data. We do not send marketing emails without your explicit consent.

• Contract performance — processing your email and subscription data to deliver the service you signed up for
• Legitimate interests — anonymised, cookieless analytics via Vercel Analytics to improve the platform
• Consent — Google Analytics 4 and Google Ads conversion-measurement cookies, set only if you accept via the cookie banner

• Supabase — database and authentication, hosted in the EU (Ireland). Privacy policy. Data Processing Agreement in place.
• Stripe — payment processing, operated from the United States. Data is transferred under Standard Contractual Clauses. Privacy policy. Data Processing Agreement in place.
• Vercel — hosting and privacy-friendly analytics (cookieless, no PII), operated from the United States. Data is transferred under Standard Contractual Clauses. Privacy policy. Data Processing Agreement in place.
• Resend — transactional email delivery (feedback form submissions and account emails), operated from the United States. Data is transferred under Standard Contractual Clauses. Privacy policy. Data Processing Agreement in place.
• Google Analytics — analytics (only if you consent), operated by Google LLC from the United States. Data is transferred under Standard Contractual Clauses. Data retention is set to 2 months. IP addresses are anonymised by default. Privacy policy. Data Processing Agreement in place.
• Google Ads — advertising measurement (only if you consent): helps us understand, in aggregate, whether our advertising is effective. Ad personalisation is disabled — your data is never used to build advertising profiles or target you elsewhere. Operated by Google LLC from the United States under Standard Contractual Clauses. Privacy policy.

• Supabase session cookie — strictly necessary for authentication. Does not require consent under UK GDPR.
• Banner dismissal cookie — a functional cookie set only if you dismiss the sign-up banner on learning pages, so it stays hidden. Contains no personal data; expires after 1 year.
• Vercel Analytics — does not use cookies.
• Google Analytics cookies — set only with your consent:
  • _ga — distinguishes unique users; expires after 2 years
  • _ga_SL0LVPV4SH — maintains session state; expires after 2 years
  You can withdraw consent at any time by clearing your browser cookies or contacting us.
• Google Ads cookies — set only with the same consent, used solely to measure the effectiveness of our advertising (e.g. _gcl_au, expires after 3 months). Ad personalisation is always denied regardless of your choice — these cookies are never used to profile you or target ads at you elsewhere.