Privacy Policy

1. About this policy

This policy covers everyone who visits testprepeurope.com, creates an account or buys tutoring, group courses, question banks or practice tests from us, including parents who register a student. Section 11 says who the data controller is and how to reach us.

2. What data we collect

We collect only the data we need to deliver and improve our services:

• Name and contact details — your name, email address and phone number. Your password is stored hashed.
• School and exam goal — your school, the exam you are preparing for and your target score.
• Lesson records — recordings of live lessons, your lesson history, your practice-test and question-bank answers and results, and your TestPrep AI Tutor sessions.
• Payment and invoice information — purchase history, invoice details and payment status. Card numbers are processed by Stripe; we never store them on our servers.
• IP address and cookies — your IP address, browser and device details, and the cookies described in our Cookie Policy.
• Messages — what you send us through the contact form, by email or on WhatsApp, and our replies.

TestPrep AI Tutor lessons are not recorded as audio; the lesson's written transcript and a short note per question (the type of mistake, the hints given) are kept with your account and deleted when your account is deleted.

The reports your tutor writes after private lessons, the lesson and weekly summaries sent to your parent, and your part of a group course's weekly report are kept until your account is deleted, and are deleted with it. Summaries already sent by email stay in the recipient's inbox.

Account security — to keep each account to one session at a time and to prevent account sharing and bulk copying of our content, when you sign in we record one-way hashed digests of your browser's user agent and of your network block (the first three parts of your IP address), your session identifier, the site you signed in on, and when a session was closed because of a sign-in on another of our sites or another device. A new sign-in to your account closes all your other sessions. We do not store your IP address or browser string themselves for this purpose and we do not use device fingerprinting. These records are deleted 90 days after last use. Legal basis: performance of our contract with you and our legitimate interest in keeping accounts secure.

When a parent registers a student for a group course, the parent gives us the student's name and email address. We open the student's account at that address and email the student a link to set a password.

The leaderboard in your dashboard shows your points and place. Your name (first name and surname initial) appears only if you turn this on yourself; otherwise other students see only a number in place of your name.

3. Why we process it (legal bases)

Under Article 6 of the GDPR, we process your data on the following legal bases:

• Contract — to create your account, deliver the programmes you purchased and provide customer support.
• Legitimate interest — to keep the platform secure, prevent fraud, run aggregate analytics and improve the product.
• Consent — for non-essential cookies, marketing emails and any optional features you opt in to. You can withdraw consent at any time without affecting prior processing.
• Legal obligation — to keep accounting records and respond to lawful requests from authorities.

4. How long we keep it

Account, learning and billing data are retained while your account is active and for up to 10 years after closure to comply with tax and accounting laws. Technical logs are retained for a maximum of 12 months. You can request earlier deletion (see Section 7).

An account that has not been used for 90 days is deleted, together with its learning data. We send an email to your confirmed email address 14 days before that happens, giving the date. Signing in, or simply using your dashboard, before that date keeps your account. Staff accounts and any account with a purchase are never deleted this way, and nothing you have paid for is ever deleted.

For an account deleted this way, we keep a record of the deletion (the email address; the dates the account was opened, last used and deleted; the number of practice tests deleted with it) for 2 years, then erase it.

We also use this record to stop a new account opened with the same email address from getting the free trial again (the free practice test, the question bank's sample questions and the TestPrep AI Tutor trial). Anything you buy is not affected. Our legal basis is our legitimate interest in offering the free trial once per person.

5. Who we share data with

We share data only to the extent needed to run the service, with your tutor and with these service providers:

• Tutors — the tutor who teaches you sees your name and what they need to prepare your lessons.
• Hosting & infrastructure — Vercel and Supabase (EU regions where available).
• Payments — Stripe.
• Email delivery — Resend.
• Analytics & product telemetry — Vercel Web Analytics (cookieless) and Google Analytics 4 (cookies only after you accept analytics cookies; before that, cookieless anonymous measurement).
• TestPrep AI Tutor — model providers we route requests through (no payment or government-ID data is sent).

We do not sell your personal data. Where data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

6. Cookies

We use a small number of cookies for authentication, security and aggregate analytics. Details are in our Cookie Policy.

While you take an AP practice test, your answers are kept in your browser until the test ends, so that they are not lost if the page reloads; they are deleted when you hand the test in.

7. Your rights

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, request portability, and withdraw consent for any processing based on consent. You can exercise these rights by emailing info@testprepeurope.com. We will respond within one month.

You also have the right to lodge a complaint with your local data protection authority if you believe we are not handling your data lawfully.

8. Security

We protect personal data using industry-standard measures: HTTPS for all traffic, encryption at rest, hashed passwords, role-based access controls, audited admin actions and Row-Level Security on our database. No system can guarantee absolute security, but we treat incidents seriously and will notify you and the relevant authority where required by law.

9. Children

Our services are aimed at students aged 13 and above. If you are under 16, we ask that a parent or guardian register on your behalf and provide consent.

10. Changes to this policy

We may update this policy from time to time. We publish changes on this page, and the "Last updated" date changes with them.

11. Who we are

The data controller is TestPrep LLC., trading as TestPrep Europe.

• Registered office: 777 NW 72nd Ave STE 1075, Miami, FL 33126, United States
• Email: info@testprepeurope.com