Privacy Policy

1. Who is responsible for your data

GhostPrep, the operator of ghostprep.co.uk and its associated exam-practice platforms, is the data controller for the personal data described in this policy. For anything privacy-related — questions, requests, complaints — contact admin@ghostprep.co.uk.

2. What we collect

Waitlist: if you join a waitlist, we store your email address and which exam you signed up for.

Account: your email address, a securely hashed password (or your sign-in provider details), and the settings you choose — display name, exam date, interface preferences.

Practice history: the questions you attempt, your answers, scores, timings, mock results, essays and writing-task responses, saved questions, and any questions you flag along with notes you attach.

Billing: if you subscribe, payment is handled entirely by Stripe. We store a reference to your Stripe customer record and your subscription status. We never see or store your card details.

Bursary applications: if you apply for a bursary, we store which exam and sitting you applied for, the statement you write, your confirmation that it's true, and the decision we reach with any internal notes. Bursaries are assessed on financial need, so we invite supporting documents — a benefits letter, a payslip, free school meals confirmation or similar. Attaching one is optional and an application can succeed without it. Anything you do attach is stored privately alongside the application, can only be opened by an administrator who is signed in, and is used for nothing but that decision. Nothing you send us here is published, shared or used for marketing, and you can ask us to delete an attachment at any time.

Support: emails you send us, so we can reply and keep track of the conversation.

Technical: our hosting infrastructure keeps short-lived server logs (including IP addresses) for security, debugging and rate limiting. Our waitlist logging is deliberately built not to write full email addresses into logs.

3. What we deliberately don't do

• No advertising trackers, marketing pixels or retargeting.
• No analytics on your practice history or account activity — site measurement covers the public marketing site only.
• No selling or renting personal data, ever.
• No sharing data with anyone except the processors listed below.

4. Why we process it (legal bases)

To provide the Service — creating your account, saving your practice history, processing subscriptions: performance of a contract.

To email a waitlist about the launch of the exam you chose: your consent, which you can withdraw at any time by unsubscribing or emailing us.

To assess a bursary application you send us, and to keep a record of the decision: performance of a contract — we can't decide whether to give you free access without reading what you tell us.

To improve the question bank — for example, using aggregated answer statistics to check question difficulty: our legitimate interest in making the Service better, using data in a way that doesn't single you out.

To measure how the public marketing site is used, in aggregate: our legitimate interest in understanding which pages help people, relying on analytics that aren't used for advertising or linked to your account.

To keep the Service secure and prevent abuse: our legitimate interest in protecting the platform and its users.

To meet legal obligations, such as tax records for payments: legal obligation.

5. Cookies

Essential cookies: a session cookie that keeps you signed in, and a temporary access cookie used during pre-launch previews. Your light/dark theme choice is stored in your browser's local storage, not a cookie.

Measurement cookies: our public marketing site uses Google Analytics 4 to count visits and see which pages people find useful. It sets first-party cookies (names beginning “_ga”) that give your browser a random identifier. We use it for aggregate reporting only — we don't use it for advertising, we don't link it to your account, and we don't enable Google Signals or ad personalisation. You can opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout, or by using your browser's tracking protection.

We set no advertising cookies of any kind.

6. Who we share data with

We use a small number of service providers who process data on our instructions:

• Supabase — database and authentication hosting (accounts, practice history, waitlist).
• Vercel — website hosting and server logs.
• Stripe — payment processing for subscriptions.
• Google Analytics — aggregate usage measurement on the public marketing site.

Each is bound by a data-processing agreement. We may also disclose data if the law requires it, or as part of a sale or restructuring of the business (in which case this policy would continue to apply to your data).

7. International transfers

Our providers may store or process data outside the UK, including in the United States. Where they do, transfers are protected by UK-approved safeguards such as the UK International Data Transfer Agreement or Addendum, or an adequacy decision.

8. How long we keep it

Account and practice data: for as long as your account exists. Delete your account (or ask us to) and we'll erase it, except where we must keep records for legal reasons.

Waitlist emails: until we've told you about the launch you signed up for, or until you unsubscribe — whichever comes first.

Bursary applications: for as long as your account exists, so we have a record of what was granted and why. Ask us to delete your application and we will, once any bursary it granted has ended.

Payment records: as long as tax and accounting law requires.

Server logs: short-lived and rotated automatically.

9. Your rights

Under UK data protection law you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct inaccurate data;
• delete your data;
• restrict or object to how we process it;
• provide your data in a portable format;
• withdraw consent, where consent is the basis we rely on.

To exercise any of these, email admin@ghostprep.co.uk from the address on your account. We'll respond within a month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

10. Children

The Service is for users aged 13 and over. We don't knowingly collect data from anyone under 13; if we learn we have, we'll delete it. If you believe a child under 13 has given us data, contact us and we'll remove it.

11. Changes to this policy

If how we handle data changes, we'll update this page and its date. For significant changes we'll also tell you directly — by email or a notice on the Service — before they take effect.