Privacy Policy

Quietrooms (trading as "The Quiet Rooms", "we") is the data controller for personal data collected through this site. This policy explains what we collect, why, and your rights under UK GDPR.

1. What we collect

• Account: email address, display name, hashed password, login timestamps and IP address (for security).
• Study data: the questions you answer, your ratings on flashcards, mock results, and derived progress statistics.
• Billing: we do not store card numbers. Payments are handled by Paddle, our Merchant of Record, who acts as data controller for billing data (name, billing address, tax status, card details, transaction history).
• Support: messages you send through the contact form.
• Technical: minimal cookies for session management and basic device/telemetry data (browser, OS, approximate location from IP) for security and abuse prevention. We do not use advertising cookies.

2. Purposes and legal basis

We process account and study data on the basis of the contract between us (to create your account and deliver the Service). Security telemetry and abuse prevention are processed on the basis of our legitimate interests. Billing records are processed to comply with our legal obligations (UK tax and accounting). Support messages are processed on the basis of our legitimate interest in replying to you. Any marketing emails are sent only with your consent, which you can withdraw at any time.

3. AI-generated feedback

Where you receive AI-generated feedback on a mock, the question, your answer and the correct answer are sent to our AI provider (Google, via the Lovable AI Gateway) to produce a written explanation. We do not include your name or email in that request.

4. Retention

We retain account and study data for as long as your account is active, and for up to 12 months after closure so you can reactivate. Billing records are kept for 7 years to meet UK tax obligations. Data no longer required is deleted or anonymised.

5. Sharing and international transfers

We do not sell your data. We share it only with the following categories of recipient:

• Merchant of Record: Paddle.com Market Ltd — payments, subscription management, tax compliance, invoicing and refunds.
• Infrastructure and subprocessors: Supabase (database & auth hosting, EU region), Lovable (hosting & AI gateway), Google (AI feedback generation).
• Professional advisers (legal, accounting) and authorities where required by law.

Where data is transferred outside the UK/EEA it is protected by Standard Contractual Clauses or an equivalent safeguard.

6. Your rights (UK GDPR)

You have the right to: access your data; ask us to rectify inaccurate data; erase your data; restrict or object to processing; port your data to another provider; and withdraw consent at any time where processing is based on consent. Contact us to make a request — we will respond within one month. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), encryption at rest, hashed passwords and access controls on our infrastructure.

8. Cookies

We use only essential first-party cookies to keep you signed in. We do not use analytics or advertising cookies. If we add analytics in future we will update this notice and, where required, ask for your consent.

9. Contact

Quietrooms — contact us for any privacy question or data-rights request.