1. Information We Collect

We collect the following types of information:

• Account information: Name, email address, and password (stored as a salted hash) when you register.
• Profile information: Job title, company, education, social links, and career goals if you choose to provide them. All optional.
• Quiz data: Your answers, scores, and session history.
• Payment information: Processed entirely by Stripe. We do not see or store credit card numbers — we only retain a record of the transaction (amount, date, plan or certification purchased).
• Lead attribution: If you arrived via a campaign link, we capture UTM parameters and the referring URL at registration to understand which channels work. This data is linked to your account.
• Login audit: Login, logout, and password-reset events with timestamp and IP address, retained for security purposes.
• Server logs: Standard web server logs (IP address, request path, timestamp, user agent) retained for operational and security monitoring.
• Usage data: Pages visited and interactions, collected via Google Analytics. Until you consent, this is limited to cookieless, aggregate signals that do not identify you (Google Consent Mode v2 with all consent denied); analytics cookies and identifiers are used only with your explicit consent.

2. How We Use Your Information

• Provide and operate the certification exam preparation Service.
• Track your quiz progress and scores.
• Process payments and manage subscriptions.
• Send account-related communications (email verification, password reset, purchase confirmations, subscription notices).
• Detect and prevent fraud, abuse, and security incidents.
• Improve the platform based on aggregated, anonymized usage patterns (cookieless aggregate signals by default; identifiable analytics only when you consent).

We do not use your personal information for advertising, profiling for third-party use, or any purpose unrelated to operating the Service.

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, we process your personal data on the following legal bases:

• Contract: To provide the Service you signed up for (account, quizzes, billing).
• Legitimate interests: To secure our platform, prevent fraud, and operate our business — balanced against your privacy rights.
• Consent: For analytics cookies and any optional communications. You can withdraw consent at any time.
• Legal obligation: To comply with tax, accounting, and other legal requirements.

4. Cookies and Local Storage

We use the minimum set of cookies needed to make the Service work and to remember your preferences. The Google tag runs in a cookieless, consent-denied mode by default (Google Consent Mode v2) — analytics cookies are set only after you accept them in the consent prompt.

We also use browser localStorage and sessionStorage to hold your authentication token, cached quiz data (for offline-friendly browsing), and UTM attribution before registration. These are stored on your device only and are not shared with third parties.

You can withdraw consent at any time by clearing the aceit_cookie_consent cookie in your browser; you will be asked again the next time an action needs consent, and Google Analytics returns to cookieless consent-denied mode until you re-accept.

5. Service Providers (Sub-Processors)

We use the following third-party service providers to operate the Service. Each acts as a data processor on our behalf — they process data only to deliver the services we've contracted them for, and they cannot use your data for their own purposes.

• Amazon Web Services (AWS): Hosting, database storage, and file storage. Data is stored in the United States.
• Stripe: Payment processing and subscription management. Subject to Stripe's Privacy Policy.
• Cloudflare Turnstile: Bot protection on authentication forms (privacy-preserving alternative to traditional CAPTCHAs). Subject to Cloudflare's Privacy Policy.
• Google Tag Manager & Google Analytics 4: Aggregated usage analytics, loaded through Google Tag Manager. Runs cookieless in consent-denied mode (Google Consent Mode v2) until you consent; cookies and identifiers are used only when you consent. Subject to Google's Privacy Policy. We do not enable Google Signals, ad personalization, or data sharing with Google's advertising products.

Beyond these processors and any disclosure required by law, we do not share your personal information with anyone.

6. International Data Transfers

The Service is hosted in the United States on Amazon Web Services. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where the law requires, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) for cross-border transfers of personal data.

7. Your Rights

Under the GDPR, UK GDPR, CCPA, and similar laws, you have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): Request deletion of your personal data.
• Restriction: Request that we limit how we use your data.
• Portability: Request your data in a portable, machine-readable format.
• Objection: Object to processing of your data based on legitimate interests.
• Withdraw consent: Withdraw any consent you have given (e.g., for analytics) at any time.
• Non-discrimination (CCPA): We will not deny service, charge a different price, or provide a different quality of service because you exercised a privacy right.
• Right to opt out of sale/sharing (CCPA): Not applicable — we do not sell or share your personal information as those terms are defined under California law. There is therefore nothing to opt out of.

To exercise any of these rights, email click to reveal email from the address associated with your account. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

8. Data Retention

• Account and quiz data: Retained for as long as your account is active.
• Account deletion: If you request deletion, we will remove your personal data within 30 days, except where we are required to retain it for legal, tax, or accounting reasons (e.g., transaction records typically retained for 7 years).
• Login audit logs: Retained for 12 months for security purposes, then deleted.
• Server logs: Retained for 90 days for operational and security monitoring, then deleted.
• Aggregated, anonymized statistics: May be retained indefinitely as they are no longer linked to any individual.

9. Data Security

We use industry-standard security measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all traffic between your browser and our servers.
• Salted password hashing — we never store passwords in plain text.
• JWT-based authentication with token expiry.
• Bot protection (Cloudflare Turnstile) on authentication forms.
• Rate limiting to prevent abuse.
• Payment processing handled entirely by Stripe — we never see or store card details.
• Access controls limiting which staff can view production data.

No security system is perfect. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

10. Children's Privacy

The Service is not directed to children under 18. You must be at least 18 years old (or have the consent of a parent or guardian where the law allows) to create an account. We do not knowingly collect personal information from children under 18. If we learn we have collected information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, contact us at click to reveal email.

11. Do Not Track

We honour your choice to opt out of analytics through our cookie consent banner. Because there is no industry consensus on how to interpret browser "Do Not Track" signals, we do not respond to them separately — but our default state is "no analytics cookies, no identifiers" until you explicitly accept, which achieves substantially the same outcome.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date, and where appropriate we will notify you by email. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.

13. Contact

For privacy-related questions, to exercise your data rights, or for any other inquiry, contact us at click to reveal email.