Privacy Policy
Last updated: 24 May 2026
This Privacy Policy explains how [Your Company Name]("we", "testwises") collects, uses, and protects personal data when you use testwises.io (the "Service"). We comply with the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.
1. Data Controller
[Your Company Name]
[Registered Address]
Email: support@testwises.io
2. What Data We Collect
You provide to us:
- Account information: name, email address, password (hashed).
- Exam preferences: which exam(s) you are preparing for.
- Communications: messages you send to our support team.
Generated as you use the Service:
- Quiz activity: answers, scores, time spent, weak topics.
- Subscription history: plans purchased, billing dates.
- Technical data: IP address, browser type, device, pages visited (used for security and product improvement).
We do NOT collect:
- Your full payment card details. These go directly to Stripe — we only receive a tokenised reference and the last 4 digits.
- Sensitive personal data (health, religion, political opinions, etc.).
3. How We Use Your Data
| Purpose | Legal basis |
|---|---|
| Provide the Service (login, save results, deliver content) | Contract |
| Process payments and prevent fraud | Contract / legitimate interest |
| Provide customer support | Contract |
| Send transactional emails (receipts, expiry reminders) | Contract |
| Send marketing emails (only if you opt in) | Consent |
| Improve the Service (analytics, A/B testing) | Legitimate interest |
| Comply with legal obligations (accounting, tax) | Legal obligation |
4. Who We Share Data With
We only share data with the third-party processors required to run the Service:
- Stripe (Ireland / USA) — payment processing.Privacy.
- Supabase (USA) — database and authentication.Privacy.
- Vercel (USA) — website hosting and CDN.Privacy.
- Railway (USA) — backend hosting.Privacy.
We do not sell or rent your personal data to advertisers. Data transferred outside the EEA/UK is protected by Standard Contractual Clauses or equivalent safeguards.
5. How Long We Keep Data
- Account & quiz data: while your account is active, plus 12 months after closure for backup and dispute resolution.
- Billing records: 7 years (legal requirement for accounting).
- Support messages: 24 months.
- Backups: rotated out within 35 days.
6. Your Rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten"), subject to legal retention requirements.
- Restrict or object to certain processing.
- Portability — receive your data in a machine-readable format.
- Withdraw consent for any processing based on consent (e.g. marketing).
- Lodge a complaint with your local data protection authority (in the UK: the ICO).
Exercise these rights by emailing support@testwises.io. We will respond within 30 days.
7. Security
We protect your data with industry-standard measures:
- TLS/HTTPS encryption for all traffic.
- Passwords stored hashed (never in plain text) via Supabase Auth.
- Database access restricted by Row Level Security policies.
- Payment data never touches our servers — handled by PCI-DSS Level 1 certified Stripe.
- Regular dependency updates and security audits.
8. Cookies
See our Cookie Policy for details.
9. Children
The Service is not directed to children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.
10. Changes to This Policy
We may update this Policy. Material changes will be notified by email and/or in-product notice at least 14 days in advance.
11. Contact
Data questions, complaints, or requests: support@testwises.io.