Privacy Policy

1. Who is responsible for your data

GhostPrep, the operator of ghostprep.co.uk and its associated exam-practice platforms, is the data controller for the personal data described in this policy. For anything privacy-related — questions, requests, complaints — contact admin@ghostprep.co.uk.

2. What we collect

Waitlist: if you join a waitlist, we store your email address and which exam you signed up for.

Account: your email address, a securely hashed password (or your sign-in provider details), and the settings you choose — display name, exam date, interface preferences.

Practice history: the questions you attempt, your answers, scores, timings, mock results, essays and writing-task responses, saved questions, and any questions you flag along with notes you attach.

Billing: if you subscribe, payment is handled entirely by Stripe. We store a reference to your Stripe customer record and your subscription status. We never see or store your card details.

Bursary applications: if you apply for a bursary, we store which exam and sitting you applied for, the statement you write, your confirmation that it's true, and the decision we reach with any internal notes. Bursaries are assessed on financial need, so we invite supporting documents — a benefits letter, a payslip, free school meals confirmation or similar. Attaching one is optional and an application can succeed without it. Anything you do attach is stored privately alongside the application, can only be opened by an administrator who is signed in, and is used for nothing but that decision. Nothing you send us here is published, shared or used for marketing, and you can ask us to delete an attachment at any time.

Support: emails you send us, so we can reply and keep track of the conversation.

Technical: our hosting infrastructure keeps short-lived server logs (including IP addresses) for security, debugging and rate limiting. Our waitlist logging is deliberately built not to write full email addresses into logs.

3. What we deliberately don't do

• No advertising profiles of you, and no selling audiences on. We do run Google Ads conversion measurement, which tells us that an advertisement led to a registration or a purchase — it counts what worked, and does not follow you around other websites on our behalf.
• No analytics on your practice history — we never send your questions, answers, scores or readiness to any analytics provider. Measurement on the practice platform is limited to the first-run setup and product tour, recording which step you reached and where you left off.
• No selling or renting personal data, ever.
• No sharing data with anyone except the processors listed below.

4. Why we process it (legal bases)

To provide the Service — creating your account, saving your practice history, processing subscriptions: performance of a contract.

To email a waitlist about the launch of the exam you chose: your consent, which you can withdraw at any time by unsubscribing or emailing us.

To assess a bursary application you send us, and to keep a record of the decision: performance of a contract — we can't decide whether to give you free access without reading what you tell us.

To improve the question bank — for example, using aggregated answer statistics to check question difficulty: our legitimate interest in making the Service better, using data in a way that doesn't single you out.

To measure how the public marketing site is used, in aggregate: our legitimate interest in understanding which pages help people, relying on analytics that aren't used for advertising or linked to your account.

To see how the public marketing pages are actually used — clicks, scrolling and page replays: our legitimate interest in making them clearer. This covers the public pages only, never the sign-in screens or the practice platform, and form contents are masked.

To see how new students get on with the introductory setup and product tour — which step they reached, and where they stopped: our legitimate interest in making the first few minutes work. This records the step, never your practice.

To know which channel brought a new student to us — a search, an advertisement, a link on another site, or the code in our textbook: our legitimate interest in understanding what actually reaches students, so we spend our effort where it helps. We record how the visit arrived, not who you are or what you did before it.

To keep the Service secure and prevent abuse: our legitimate interest in protecting the platform and its users.

To meet legal obligations, such as tax records for payments: legal obligation.

5. Cookies

Essential cookies: a session cookie that keeps you signed in, and a temporary access cookie used during pre-launch previews. Your light/dark theme choice is stored in your browser's local storage, not a cookie.

Measurement cookies: our public marketing site and practice platform use Google Analytics 4 to count visits, see which pages people find useful, and follow how far new students get through the introductory tour. It sets first-party cookies (names beginning “_ga”) that give your browser a random identifier. We use it for aggregate reporting only — we don't use it for advertising, we don't link it to your account, and we don't enable Google Signals or ad personalisation. You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout, or by using your browser's tracking protection.

Session-replay cookies: our public marketing pages use Microsoft Clarity to see how people actually use them — where they click, how far they scroll, and a replay of the pages they viewed. It sets first-party cookies (names beginning “_clck” and “_clsk”). It runs ONLY on the public pages: never on the login, registration or password screens, and never inside the practice platform. Clarity masks the contents of form fields by default, so what you type is not captured. You can opt out with your browser’s tracking protection.

Acquisition cookie: when you first arrive we set a first-party cookie (“gp_attrib”) recording how that visit reached us — any campaign details in the link you followed, and the address of the site that linked to you, kept as the site’s name only and never the full page address. It is set once, is not updated on later visits, and expires after 90 days. It contains no identifier for you and cannot be read by scripts in your browser. If you go on to create an account, we store that single record against it, so we can tell which channels bring students to us; we never use it to build a profile of your browsing.

Advertising cookies: we advertise on Google Ads, and its conversion tag sets first-party cookies (names beginning “_gcl”) so that a registration or purchase can be matched to the advertisement that led to it. When you register or subscribe we send Google a one-way encrypted (hashed) form of your email address for that matching — never the address itself. We do not use these cookies to show you personalised advertisements on our own site.

6. Who we share data with

We use a small number of service providers who process data on our instructions:

• Supabase — database and authentication hosting (accounts, practice history, waitlist).
• Vercel — website hosting and server logs.
• Stripe — payment processing for subscriptions.
• Google Analytics — aggregate usage measurement on the public marketing site, and on the practice platform for the introductory setup and tour only.
• Microsoft Clarity — heatmaps and session replay on the public marketing pages only, to see which parts of a page work. Not used on sign-in or registration screens, and not inside the practice platform.
• Google Ads — conversion measurement only: it is told that a registration or purchase happened and which advertisement preceded it, with your email address sent in a one-way encrypted (hashed) form so the two can be matched.

Each is bound by a data-processing agreement. We may also disclose data if the law requires it, or as part of a sale or restructuring of the business (in which case this policy would continue to apply to your data).

7. International transfers

Our providers may store or process data outside the UK, including in the United States. Where they do, transfers are protected by UK-approved safeguards such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision.

8. How long we keep it

Account and practice data: for as long as your account exists. Delete your account (or ask us to) and we'll erase it, except where we must keep records for legal reasons.

Waitlist emails: until we've told you about the launch you signed up for, or until you unsubscribe — whichever comes first.

Bursary applications: for as long as your account exists, so we have a record of what was granted and why. Ask us to delete your application and we will, once any bursary it granted has ended.

Payment records: as long as tax and accounting law requires.

Server logs: short-lived and rotated automatically.

9. Your rights

Under UK data protection law you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to how we process it;
• provide your data in a portable format;
• withdraw consent, where consent is the basis we rely on.

To exercise any of these, email admin@ghostprep.co.uk from the address on your account. We'll respond within a month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

10. Children

The Service is for users aged 13 and over. We don't knowingly collect data from anyone under 13; if we learn we have, we'll delete it. If you believe a child under 13 has given us data, contact us and we'll remove it.

11. Changes to this policy

If how we handle data changes, we'll update this page and its date. For significant changes we'll also tell you directly — by email or a notice on the Service — before they take effect.