Privacy Notice

1. Who we are

ESATify operates esatify.com and is the data controller for the personal data described in this notice. That means we decide how and why your data is used. You can contact us at support@esatify.com.

2. What we collect and why

• Account data (email address, login credentials, name or display name, username) — to create and secure your account. Legal basis: performance of our contract with you.
• Profile and study preferences (target university and course, predicted grades, planned sections, extra-time setting, email preferences) — to personalise practice and analytics. Legal basis: contract performance and, for optional marketing emails, your consent.
• Practice activity (answers, attempts, timings, session and past paper results, league membership) — to score your work, build your analytics, focus areas and retry list. Legal basis: contract performance.
• Support messages — to answer your questions. Legal basis: legitimate interests in supporting our users.
• Technical data (device identifiers, IP address, browser type, usage and error telemetry) — for security, fraud prevention, debugging and improving the product. Legal basis: legitimate interests.
• Purchase records (whether you hold a Season Pass, order reference, amount) — to unlock paid access and keep our records. Legal basis: contract performance and legal obligation. We never see or store your card details.

3. Who we share data with

• Paddle, our Merchant of Record, for the sale of the Season Pass, payments, invoicing, refunds and tax compliance. Paddle acts as its own controller for that data.
• Service providers (subprocessors) that host our application and database, deliver email, and provide error monitoring — acting on our instructions only.
• Professional advisers such as legal and accounting, where necessary.
• Authorities where we are required to disclose by law.

We do not sell your personal data.

4. International transfers

Some of our providers process data outside the UK and EEA. Where that happens, we rely on appropriate safeguards such as UK adequacy regulations or Standard Contractual Clauses with the UK addendum.

5. Retention

We keep your account and practice data for as long as your account is open, and delete or anonymise it within a reasonable period after you delete your account. Purchase and tax records are kept for as long as the law requires (typically six years).

6. Your rights

Under UK and EU data protection law you have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent at any time (for example by unsubscribing from emails). You can delete your account and reset your progress yourself in Settings. Email support@esatify.com to exercise any other right — we respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, hashed credentials, row-level database access controls and least-privilege access for staff.

8. Cookies

We use essential cookies and local storage to keep you signed in and to remember preferences such as theme. Our payment provider sets cookies during checkout to process your order securely. We do not use advertising cookies. You can clear or block cookies in your browser, but the app will not work correctly without the essential ones.

9. Children

ESATify is intended for students preparing for university admissions tests. We do not knowingly collect data from children under 13.