Privacy Policy

Last Updated: 28 February 2026

Ergo Prep Ltd (“Ergo”, “we”, “us”, or “our”) is committed to protecting your privacy and practising strict data minimisation. This Privacy Policy explains how we collect, use, and protect your personal data when you use our website and services (collectively, the “Service”).

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy.

1. Who We Are (Data Controller)

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller is:

Ergo Prep Ltd
Email: ergoprepuk@gmail.com
Registered Office: Office 17719, 182-184 High Street North, East Ham, London, E6 2JA.

2. The Data We Collect

We only collect the data strictly necessary to operate our testing platform, process your payments, and secure our intellectual property.

2.1. Information You Provide

  • Account Data: When you sign up, we collect your name and email address (via dedicated email sign-up or Google/LinkedIn authentication).
  • Educational Data: We collect information regarding your university and year of study via a short onboarding questionnaire.

2.2. Information We Collect Automatically

  • “Smart Detect” Verification: We utilise a script that identifies your university affiliation based on your email domain (e.g., @ucl.ac.uk).
  • Performance Tracking: Every answer you submit is logged to track your performance, recording the specific question ID, whether it was correct, and the time taken.
  • Technical & Security Data: To protect our platform from automated scraping and credential sharing, we log your IP address, browser type, and device information.

2.3. Financial Data

We do not store your credit card details or physical addresses. All financial transactions are tokenised and processed securely via Stripe. We only receive a webhook confirmation of a successful transaction to grant you access.

3. How We Use Your Data

We process your personal data under the following lawful bases:

  • To Provide the Service (Contract): We use your identity and performance data to grant you timed access, score your practice tests, and manage your account.
  • To Prevent Fraud & Scraping (Legitimate Interest): We use Technical Data and session monitoring to detect concurrent logins from different geographic locations or devices. If detected, sessions are invalidated to prevent credential sharing. We also use IP-based rate limiting to block automated bots attempting to download our question bank.

4. Data Sharing & Third Parties

We do not sell, rent, or share your personal data, contact information, or test performance with third-party recruiters, employers, universities, or marketing agencies.

We only share data with essential, highly secure infrastructure providers required to run the Service:

  • Stripe: For secure payment processing and subscription management.
  • Supabase: For our backend database and authentication logging.
  • Vercel: For secure hosting and server infrastructure.
  • NextAuth: For secure account authentication via Google and LinkedIn.

5. Data Security

We employ strict, enterprise-grade security measures to protect your data and our intellectual property, including:

  • Row Level Security (RLS): Database policies that mathematically prevent users from querying any data that isn’t their own account info or the single active question they are viewing.
  • Session Integrity Limits: Automatic session termination if system time discrepancies or concurrent logins are detected.

6. International Data Transfers

Some of our service providers (e.g., Stripe, Vercel, Supabase) may process data outside the UK/EEA. Whenever we transfer your data internationally, we ensure it is protected by appropriate safeguards, such as UK International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs), or the UK-US Data Bridge.

7. Data Retention

  • Account & Performance Data: Retained for as long as your account remains active so you can track your progress. If you request account deletion, your personal identifiers will be permanently erased within 30 days.
  • Financial Records: Basic transaction history (excluding card details) is retained for 6 years as required by UK tax law (HMRC).

8. Your Legal Rights

Under the UK GDPR, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Ask us to fix inaccurate information.
  • Erasure: Ask us to delete your data (the “right to be forgotten”).
  • Restriction/Objection: Object to or restrict us from processing your data in certain ways.

To exercise any of these rights, please contact us at ergoprepuk@gmail.com

9. Cookies & Tracking

We use strictly necessary cookies (such as NextAuth session tokens) required to keep you securely logged in and to enforce our anti-sharing security measures. Because we do not use third-party advertising or invasive tracking cookies, your experience remains private.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or a prominent notice on the Site prior to the change taking effect.

∴
Ergo