Privacy Policy

ProntoEsame — UK GDPR · Last updated: 12 September 2026

1. Introduction

ProntoEsame is committed to protecting your personal data in accordance with UK GDPR and the Data Protection Act 2018.

2. Data Controller

ProntoEsame LTD

Registered in England and Wales

Company No: 17442355

Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Email: [email protected]

3. Payment Processing

We use Paddle.com Market Ltd as Merchant of Record. This means: Paddle is the seller of record for transactions. Paddle processes payments, VAT, invoicing, and refunds. Paddle may collect and process your billing data independently as a separate data controller. See their Privacy Statement at paddle.com/legal/privacy.

4. Data we collect

• Name and email address
• Account login details
• Usage data (platform activity)
• Communications (support messages)
• Limited billing metadata (order reference, subscription status)

We do not store full payment card details.

5. How we use data

We use personal data to:

• Provide access to services
• Manage accounts
• Deliver learning content
• Provide customer support
• Maintain platform security
• Comply with legal obligations

6. Legal bases

Contract (service provision), Consent (marketing), Legitimate interests (service improvement), Legal obligation.

7. We may share data with:

• Paddle.com Market Ltd (payments, billing and invoicing)
• Supabase, our hosting, database and authentication provider, which also stores our logs and analytics records
• Lovable AI Gateway, used to generate AI feedback on writing and oral answers you submit
• ElevenLabs, used to generate the spoken audio used in listening and oral exercises
• Our transactional email service, used to send account, support and campaign emails

We do not sell personal data, and we do not use third-party advertising or tracking networks.

8. International transfers

Some of the providers listed above process data outside the UK. Where that happens, transfers rely on the safeguards offered by those providers, such as UK International Data Transfer Agreements or Standard Contractual Clauses. The specific hosting locations of our providers are kept under review.

9. Logging, security and audit records

We record certain technical and activity information so that we can keep the service secure, detect and investigate unauthorised access, troubleshoot technical problems, keep the platform reliable, and understand how features are used in aggregate so we can improve them.

• Timestamps of events
• Account identifiers (your internal user ID) or, where no account exists yet, a salted one-way hash instead
• Authentication and security events, such as sign-in success and failure, sign-out, registration, email verification, password reset and change, magic-link requests, account deletion, rate limiting and suspicious activity
• IP address, but only for security-relevant and administrator events (for example failed sign-ins, password changes, account deletion and administrator actions), because these are the events where it has genuine security and audit value
• Application events and error/diagnostic information, such as an error name and a short technical message, a failing operation, or a third-party service failure
• Administrator and audit events, such as an administrator viewing or changing a user record, changing permissions, exporting data, deleting data or changing configuration

We do not collect device fingerprints, and we do not store browser user-agent strings in these records.

Our logs are designed so that they do not contain:

• Passwords
• Authentication or session tokens
• API keys and other secrets
• Payment card information
• Full exam answers
• Private notes
• Any other user-generated educational content that is not needed for the purpose of the log

Sensitive field names and secret-looking values are stripped automatically before a log record is stored, and email addresses appearing in technical messages are removed. Security and audit records cannot be edited or deleted by the application; only the scheduled retention job can remove or anonymise them.

10. Analytics and cookies

Our product analytics is first-party: events are stored in our own database with our hosting provider and do not use cookies. If you opt in via the consent banner, we also load Google Analytics 4 (Google Ireland Ltd.) to measure site usage; it is never loaded if you decline or withdraw consent. With consent, our first-party analytics may also record whether you are a new or returning visitor, campaign (UTM) parameters from the link you arrived with, and your approximate country (provided by our hosting network, never precise location). We do not use any advertising or retargeting providers.

• Purpose: understanding in aggregate which parts of the service are used, so we can improve them
• What is recorded: an event name from a fixed list (for example page view, feature used, practice session started or completed), a simplified page path with identifiers removed, your language, and a small set of pre-defined labels such as exam section, mode or a score band. Free text cannot be recorded
• Identifiers: a random identifier is created in your browser's local storage only after you opt in, and is hashed again on our servers. If you are signed in, your user ID is stored only as a salted hash
• Consent: analytics is switched off by default and only runs if you accept it in the banner. You can withdraw consent at any time on the Cookies page, which also deletes the random identifier from your browser
• Retention: analytics events are deleted after 12 months; only anonymous daily totals are kept after that

Cookies used by the platform itself are strictly necessary ones for signing in, keeping your session and protecting the service, plus the cookie used for administrator access. Paddle may set its own cookies on its checkout pages.

11. Data retention

We keep information only for as long as we need it. Our normal periods are:

• Account data: for as long as your account is active, plus a reasonable period afterwards
• Transaction records: managed by Paddle, plus any retention required for accounting purposes
• Support tickets and feedback submissions: deleted automatically 30 days after the last contact date (or the submission date if we never contacted you)
• Operational and application logs: normally 90 days
• Security, authentication and administrator audit logs: normally 12 months, with user identifiers and IP addresses removed after 6 months
• Identifiable or pseudonymous analytics: normally no more than 12 months

These are our own operational retention periods, not statutory requirements, unless a specific legal obligation applies. Information may be kept for longer where that is necessary for a documented security incident, a legal obligation, a dispute or investigation, or another lawful purpose; any such extension is time-limited and recorded. Genuinely anonymised or aggregated information, which cannot be linked back to you, may be kept for longer. We review these periods periodically and delete or anonymise information when it is no longer needed.

12. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data
• Ask us to restrict how we use your data
• Object to processing based on our legitimate interests
• Receive your data in a portable format
• Withdraw consent at any time where we rely on consent, such as analytics and marketing emails, without affecting processing carried out before withdrawal

You can delete your account from your profile. Some information may still need to be kept where we have a lawful reason to do so — for example security and audit records, an active investigation, a dispute, or a legal or accounting obligation. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO).

Contact: [email protected]