Privacy Policy

1. Data We Collect

• Contact form / WhatsApp: name, email, phone, the year group, subject and type of support you select, and your message. To protect the form from abuse we also record your IP address and the page you sent it from.
• Payment: payment details are processed through Stripe; card numbers are never stored on our servers. What reaches us is the package bought, the amount and currency, Stripe's reference for the payment, and the name, email and phone you give at checkout.
• IA and EE graders: uploaded report files are processed temporarily for analysis and deleted once the result is produced; the IP address is kept only to enforce the daily usage limit.
• Student account: if you open one, your email address, your password and, if you choose to give it, your name. Section 2 has the details.
• Site usage data: analytics such as browser type, pages visited and session duration. Google Analytics runs only if you accept it in the cookie notice (section 7).

2. Your Student Account

An account is optional; you need one only for the student dashboard. You do not need one to buy lessons, to contact us or to use the graders. To open one you give us your email address, a password and, if you wish, your name. The password passes through our server to Supabase's sign-in service, which keeps only a scrambled (hashed) form of it; we never store or log it. When the account is opened, a student profile is created with your email address and name.

Your account is a TestPrep account, not one for this site alone. Our exam-preparation sites share one sign-in system and one database, so the same email address and password also work on our other sites.

Signing in

The sign-in service records when you confirmed your email address and when you last signed in. For as long as you stay signed in, it also keeps a record of that session with your IP address and a description of your browser and device (its "user agent"). Signing out ends every session on your account, not only the one on the device in front of you.

What the dashboard shows

Your name (or your email address if you gave no name), any group course you enrolled on through this site and any purchase you made here with the same email address (package, date, status and amount), your IB mock exam results, your study streak, your badges and your invitation card. There are no IB mock exams on this site yet, and the site itself does not award streaks, badges or points. If you use the same account on another TestPrep site, the streak and badges you earn there appear here too.

The leaderboard

There is no leaderboard on this site, so no student here sees another student's name or points. Some of our other sites do have one: if you use your account there and earn points, students signed in on those sites can see your first name and the initial of your surname, with your points and the number of questions you have answered.

Invitation links

The dashboard gives you a link to share with friends. New codes are random, so they cannot be guessed. Codes made earlier, from the first letters of a name and four digits, still work, and they are much easier to guess. The check that looks a code up allows only a limited number of tries from one address, which slows guessing down but does not stop it. Anyone who opens your link sees your first name, and nothing more, on the sign-up page.

When someone signs up through your link, we record that they joined through you. Your dashboard then shows how many people have joined through your link and how many of them have bought something since, never who they are. If only one friend has joined, though, the counts tell you whether that friend has bought something. Equally, if you signed up through a friend's link, their counts change when you buy something. The record works on our other sites too: on some of them, a friend who joined through you gets a one-off discount, and once they have bought something you get one as well, and invitations can earn badges and points there.

Emails

We email you only about your account: a link to confirm your address when you sign up, and, when you ask for one, a single-use link to set your password that expires after one hour. If the confirmation email fails to send, your address is passed to our team so that someone can help you sign in. The warning we send before deleting an unused account is described in section 8.

Checks against automated sign-ups

The sign-up form looks for signs of a bot: a hidden field that people never see, a form filled in within two seconds, and the shape of the name and email address. A sign-up that fails the check is dropped and no account is created, but our server log notes the reason and a partly hidden form of the email address, so that we can find and help a real person the check caught by mistake. If someone tries to sign up with an email address that already has an account, the form tells them so, which means that whether an address has an account can be found out this way.

Security

Accounts sit in an access-controlled database: a signed-in student can read and change only records that belong to them (such as the practice tests and question-bank answers from our other sites), and on their profile can change only their name, display name, photo and phone number. Authorised members of our team can see accounts through a shared admin panel.

3. Purposes of Processing

• Providing and maintaining the services offered.
• Responding to requests and enquiries.
• Carrying out payment transactions securely.
• Running your student account: signing you in, showing your dashboard and sending account emails.
• Running invitation links and counting the sign-ups they bring.
• Deleting accounts that go unused, and keeping a record of each deletion.
• Preventing abuse of the forms and of the invitation-code check.
• Meeting our legal obligations.
• Improving site performance and content.

4. Legal Basis for Processing

We process personal data on the following legal bases under the GDPR and the UK GDPR: performance of a contract (delivering the services you request, and the student account and its emails, which you ask for when you sign up); compliance with legal obligations (for example, retaining payment records); our legitimate interests (running invitation links, deleting accounts nobody uses, and protecting the forms and the Site from abuse); and your consent (optional analytics). You can object to processing based on legitimate interests, and withdraw consent, at any time.

5. Third Parties

We use the following third-party service providers to deliver our services. They process data on our instructions:

• Vercel: site hosting and CDN; request data, including IP address, as any web server receives, and our server logs.
• Supabase: the database and the sign-in service; your account, profile and invitation records, the IP address and browser of each signed-in session, payment and enrolment records, and comments.
• Stripe: payment processing (PCI-DSS certified).
• Resend: sending password emails and the warning email that goes out before an unused account is deleted, and passing contact-form enquiries on to our team, along with an alert when a confirmation email could not be sent.
• Upstash Redis: contact-form enquiries and the counters that prevent abuse (IP address).
• MiniMax: assessing the text you upload to the IA and EE graders.
• Google Analytics: measuring how the Site is used, only if you consent.
• WhatsApp: user-initiated communication.

Accounts, comments and payment records are held in a database that TestPrep's other exam-preparation sites also use. We do not sell personal data and we do not share it with anyone for advertising.

6. International Transfers

Some of our processors may store or process data outside the UK and the European Economic Area. Where this happens, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Cookies

Google Analytics is the only thing on the Site that waits for your consent. Until you accept it in the cookie notice, no measurement cookie is written, and Google's consent mode sends at most a cookieless signal that cannot be tied back to you.

The following do not depend on consent, because the service you asked for cannot work without them:

• The sign-in cookie: set only when you sign in, and only on this site. It keeps you signed in from page to page and lasts until you sign out, for up to 400 days.
• The sign-up check cookie: set when you sign up, to check that the confirmation link is opened in the browser you signed up in. It is removed when you open the link in that browser; if you open it in a different one, it stays behind in the first for up to 400 days, doing nothing.
• The return cookie: if you started signing up from a page such as checkout, it is set for one hour to take you back there once you have confirmed your email address.
• Stripe's cookies: used by Stripe only on the checkout page, to prevent fraud.

We keep your cookie choice in your browser's local storage rather than in a cookie, so that we do not ask again on every page. Vercel Web Analytics stores nothing on your device. You can manage or delete cookies through your browser; deleting the sign-in cookie signs you out in that browser.

8. Data Retention

Personal data is kept only for as long as the purpose of processing requires. Contact requests are kept for up to 24 months and payment records for the period required by law. Files uploaded to the IA and EE graders are deleted once analysis is complete.

• Your account (email address, name, password, invitation code, when you confirmed it and last signed in): for as long as you use it; see below for accounts that go unused.
• Sign-in sessions (IP address and browser): until you sign out, or until the account is deleted. Closing the browser or clearing cookies without signing out leaves the record in place.
• Streak, badges, points and invitation records: as long as the account exists, and deleted with it.
• The sign-in cookie: until you sign out, for up to 400 days.
• The invitation-code lookup counter: ten minutes.

Accounts that go unused are deleted

Once a day our system deletes accounts that are more than 90 days old and have not been used for 90 days, together with everything held against them: streak, badges, points, results and invitation records. "Used" means signing in, using the Site or the dashboard while you are signed in, or starting a mock exam, answering a practice question or adding to your streak on any TestPrep site. No account is deleted unless a warning has been sent to its email address at least 14 days beforehand, and if you use the account after that warning, it is kept.

An account is never deleted this way if it holds a purchase, access or credits granted to it, an instalment plan, a certificate or a place in a live lesson, or if it belongs to a member of our team. Payments and group course enrolments made on this site are recorded against the email address given at checkout or enrolment rather than against your account. Our system matches them to your account's email address, so if this site holds a purchase, an unfinished payment attempt or a group course enrolment under the same address, your account is not deleted this way either. Deleting an unused account does not delete the payment record. You can ask us to delete your account at any time.

Each automatic deletion leaves a short record behind: the account's internal number, its email address, when it was opened, when it was last used, and how many mock-exam attempts went with it. It is our check that the clean-up deleted only what it should. No period has been set for keeping it yet, so for now it is not deleted.

9. Your Rights Under the GDPR

Under the GDPR and the UK GDPR you have the right to access, rectify, erase, restrict and port your personal data, as well as to object to processing and to withdraw consent at any time. You can ask us to delete your whole account, except where tax or accounting law requires us to keep a payment record. The dashboard does not yet let you change your name yourself; write to us and we will correct it.

To exercise these rights, please reach us via our contact page; we reply within one month. You also have the right to lodge a complaint with a supervisory authority: in the United Kingdom, the Information Commissioner's Office; in the EEA, the authority of the country where you live or work, or where the problem arose.

10. Contact

This site is operated by TestPrep. For questions about this privacy policy: info@testprepeurope.com

11. Changes to This Policy

When something this policy describes changes, such as a new processor or a different retention period, we update this page. The date at the top is the day the Site was last published and is set automatically, so it can move without the text changing.