Privacy Notice
Controller identity
Uzair Waseem operates Irish Theory Test Coach. Operator type: Sole trader. Public operator location: Dublin, Ireland. A suitable business service address and legal review remain required before paid launch.
Scope and data sources
This notice covers learners, purchasers, instructor-code users, support contacts, administrators, and website visitors. Data comes from you, your browser or device, Stripe payment events, instructor or referral-code activity, and records created while operating the service.
Data collected
- Identity and contact: email address used for checkout, passwordless login, access restoration, support, export, deletion, or code redemption.
- Authentication and security: hashed login-token and session values, expiry and revocation records, device/browser metadata, request correlation IDs, and hashed IP-derived rate-limit identifiers. Raw passwords are not used.
- Commercial records: plan, amount, currency, purchase and entitlement dates, Stripe references, payment/refund/dispute status, instructor/referral attribution, and accepted policy versions. Stripe, not this app, handles full card details.
- Learning records: question attempts, selected answers, correctness, category, flags, missed questions, mode history, mock results, daily target, streak, and sync operation IDs.
- Optional analytics: consent-controlled first-party events such as landing views, preview engagement, mode use, paywall and checkout steps, restore flow, and mock completion, linked to a random browser ID.
- Communications and operations: question reports, support cases, privacy/deletion requests, admin audit records, AI explanation cache entries, and content-review decisions.
Purposes and lawful bases
| Purpose | Typical data | Lawful basis |
|---|---|---|
| Provide preview, paid access, accounts, progress, mocks, and support | Email, entitlement, sessions, progress, support messages | Performance of a contract or steps requested before entering a contract |
| Process payments, refunds, disputes, codes, and accounting | Purchase and Stripe references, plan, amount, entitlement, policy versions | Contract and compliance with legal obligations |
| Protect accounts, content, payments, and infrastructure | Session/security metadata, hashed rate-limit identifiers, audit and error records | Legitimate interests in security, fraud prevention, and service integrity; legal obligations where applicable |
| Answer rights, correction, accessibility, and support requests | Contact details, request content, account and purchase references | Legal obligation, contract, and legitimate interests in resolving requests |
| Optional product analytics and attribution | Random browser ID, events, broad device class, limited campaign fields | Consent. No optional analytics ID or event is created before consent |
| User-requested AI explanation | Question, choices, selected answer, category | Contract or action requested by the learner; cached to control cost |
The configured summary is: Performance of a contract for purchases, account access and delivery of the service; compliance with legal obligations for payment and accounting records; legitimate interests for security, fraud prevention and essential service analytics; consent where specifically requested.
Optional analytics choices
Optional analytics are disabled until you choose to allow them. Rejecting or later withdrawing consent clears analytics IDs, queues, attribution, and deduplication records from this browser without deleting study progress or essential account storage.
Processors
- Vercel: Hosting, serverless functions, deployment logs, and static asset delivery. Data: IP-derived request metadata, technical logs, website content. Location: Configured through Vercel project settings.
- Neon: Postgres database for accounts, entitlements, progress, support, analytics, and audit records. Data: email, progress, entitlements, support records, analytics events. Location: Configured through Neon project settings.
- Stripe: Checkout, payment processing, refunds, disputes, and payment event webhooks. Data: checkout email, payment status, Stripe identifiers. Location: Stripe infrastructure.
Processors act under their own contracts and privacy terms. Their certifications or assurance reports do not make this product independently certified.
Storage locations
- Vercel deployment regions
- Neon Postgres hosting region
- Stripe payment infrastructure
Retention
| Login Tokens | 30 days after expiry |
|---|---|
| Sessions | 180 days after expiry; revoked sessions 90 days |
| Anonymous Analytics | 180 days |
| Webhook Payload Metadata | 365 days before payload redaction job may apply |
| Purchases And Entitlements | Generally six years after the relevant accounting period, subject to Irish tax, legal, dispute, and chargeback requirements. |
| Support Cases | While open and generally 24 months after closure, unless a dispute, legal duty, or security investigation requires longer. |
| Audit Logs | Generally 24 months for security, abuse investigation, and operational accountability, subject to an active investigation. |
| Account Deletion Requests | Generally 24 months after resolution as evidence that the request was handled. |
| Local Storage | Stored on the learner device until cleared by the learner/browser or replaced by server sync. |
Retention can be extended where reasonably needed for an active legal claim, chargeback, dispute, fraud or security investigation, or binding legal requirement. Records are deleted, anonymised, or redacted when the applicable period ends.
Sharing and disclosures
Data is shared only with configured processors, professional advisers where necessary, a purchaser of the business under appropriate safeguards, or public authorities where disclosure is legally required. Personal data is not sold and is not used for third-party advertising.
Automated recommendations
The app can recommend a study mode or category from attempts, misses, flags, and mock results. These recommendations do not produce legal or similarly significant effects and can be ignored. Estimated priority is not official exam frequency.
User rights
Depending on the circumstances, you may request access, portability, correction, deletion, restriction, object to processing based on legitimate interests, or withdraw analytics consent. See the Data Rights page for working routes and limits.
Complaint route
Contact uzairwaseem29@gmail.com first. If the matter is not resolved, you may raise a concern with the Irish Data Protection Commission through its online complaint form.
Account deletion and export
Authenticated users can download a JSON export from the Account page. A deletion request creates a tracked support workflow so identity, scope, operational records, and records that must lawfully be retained can be reviewed. It is not an unverified instant deletion.
Cookies and local storage
The app uses a secure HttpOnly session cookie for login and browser storage for progress, offline queues, preferences, and cached preview assets. Optional analytics storage requires consent. Details and durations are in the Cookie & Storage Notice.
Security
Controls include HTTPS, security headers, HttpOnly cookies, server-side authorization, rate limits, input validation, webhook signature checks, audit records, and restricted premium delivery. No internet service can promise absolute security. See the Security page.
International transfers
Where personal data is transferred outside the EEA, the transfer relies on an applicable adequacy decision or appropriate safeguards such as the European Commission Standard Contractual Clauses, as applicable to the processor.
Under-18 learners
The service does not intentionally request age or special-category data. Learners under 18 should involve a parent or guardian when making a purchase or submitting a rights request where appropriate.
Changes to this notice
Material changes receive a new policy version and effective date. Where a change requires a new consent, the service will ask again rather than treating continued use as consent.
Contact
Privacy email: uzairwaseem29@gmail.com.