Privacy policy
This product keeps a detailed record of what you got right and wrong, and computes a judgement about how prepared you are from it. That is more personal than it sounds, so this page says exactly what is kept, why, for how long, and how to get rid of it. It is written to be read rather than to be defensible.
What we collect
If you never create an account
You can answer a sample session without signing up. We store the session and the answers in it, with no account attached — there is nothing in that record that identifies you, and we do not link it to you later if you sign up afterwards. We do not set an advertising cookie, and we do not fingerprint your browser.
If you create an account
- Your email address and password. The password is hashed by our authentication provider; we never see it. The email address is how you sign in and how we contact you about your account.
- A display name, if you give one. Optional, and only used to address you on your own dashboard.
- Your attempt log. Which question you answered, which options you chose, whether it was correct, how long you took, and when. This is the substance of the product: every score, domain breakdown and readiness figure is computed from it.
- Readiness snapshots. One per completed session, so your progress can be shown over time without recomputing your whole history on every page load.
- Which certifications you are tracking, and a target exam date if you set one.
- Question reports you send us, and what you wrote in them.
If you subscribe
Payments are processed by Stripe. We never see or store your card details. We store your subscription status, its billing period, and Stripe’s identifiers for your customer and subscription — enough to know whether your account has Pro and when it renews, and nothing more.
Analytics
We use PostHog, configured without cookies, to count product events — a session started, a question answered, a readiness band reached. Those events carry an exam code, a domain slug and counts. They deliberately do not carry your email address, your answers, or your readiness score. We send the coarse band rather than the number, because the business question is whether people are getting ready and the band answers it just as well.
Why we are allowed to
- Contract. Your account, your attempt log and your subscription status exist because you asked for a product that keeps track of your practice. Without them there is no product.
- Legitimate interests. Cookieless analytics and question reports, so we can tell whether the product works and fix questions that are wrong. We have weighed this against your interests: the data is coarse, it is not used to target you, and it is not shared.
- Consent. Marketing email, if you tick the box. Never pre-ticked, and withdrawable in one click.
- Legal obligation. Payment and tax records, which we are required to keep.
Who else sees it
We use a small number of processors, and no one else:
- Supabase — database and authentication. Hosted in the EU.
- Vercel — application hosting.
- Stripe — payments. A controller in its own right for the payment itself.
- PostHog — product analytics, cookieless.
We do not sell your data, we do not share it with advertisers, and we do not send it to the certification providers. Nobody at the certification provider you are preparing for can see how you are doing.
Where AI comes into it
Language models are used to draft and review questions, before anybody answers them. Your answers, your scores and your readiness figures are never sent to a model. The readiness engine is ordinary arithmetic over your attempt log — deterministic, and reproducible from the same rows — and you can read exactly what it does on the readiness page.
How long we keep it
- Your account and attempt log: for as long as your account exists. It is the product; a readiness figure computed from three months of practice needs three months of practice.
- Anonymous sample sessions: 90 days, then deleted. There is nothing to keep them for.
- Payment records: as long as Irish tax law requires, currently six years.
- Question reports: kept, but detached from you if you delete your account — the report is a statement about our content, not about you.
Your rights
Under the GDPR you have the right to access your data, to get a portable copy, to correct it, to have it erased, to restrict or object to processing, and to withdraw consent. Three of those are one click each on your account page:
- Export — download everything we hold about you, as JSON.
- Delete — remove your account and the whole attempt log with it, permanently.
- Sign out everywhere — end your session.
For anything else, email support@supportexams.com. We will respond within 30 days. If you are not satisfied, you can complain to the Irish Data Protection Commission at dataprotection.ie.
Cookies
We set two kinds of cookie and no others:
- A session cookie (sx-auth) when you sign in. Strictly necessary — without it you cannot stay signed in. Removed when you sign out.
- A consent record, so we do not ask you about cookies again.
There is no advertising cookie, no tracking pixel and no third-party script that follows you to other sites. The analytics are configured without cookies, which is why there is no banner asking you to accept them.
Children
This is a product for working professionals and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, email us and we will delete it.
Changes
If we change what we collect or why, we will update this page and change the date at the top. If the change is material we will email account holders rather than relying on you to notice.