Privacy Policy

The Quiet Rooms ("we") is the data controller for personal data collected through this site. This policy explains what we collect, why, and your rights under UK GDPR.

1. What we collect

• Account: email address, display name, hashed password.
• Study data: the questions you answer, your ratings on flashcards, mock results, and derived progress statistics.
• Billing: we do not store card numbers. Payments are handled by Paddle, our merchant of record, who acts as data controller for billing data.
• Support: messages you send through the contact form.
• Technical: minimal cookies for session management. We do not use advertising cookies.

2. Legal basis

We process account and study data on the basis of the contract between us. Billing data is processed to comply with our legal obligations. Support messages are processed on the basis of our legitimate interest in replying to you.

3. AI-generated feedback

Where you receive AI-generated feedback on a mock, the question, your answer and the correct answer are sent to our AI provider (Google, via the Lovable AI Gateway) to produce a written explanation. We do not include your name or email in that request.

4. Retention

We retain account and study data for as long as your account is active, and for up to 12 months after closure so you can reactivate. Billing records are kept for 7 years to meet UK tax obligations.

5. Sharing

We do not sell your data. We use the following processors: Supabase (database & auth hosting, EU region), Paddle (payments), and Google (AI feedback). Each is bound by a data processing agreement.

6. Your rights

You have the right to access, correct, delete or export your data, and to object to processing. Contact us to make a request. You may complain to the Information Commissioner's Office at ico.org.uk.

7. Cookies

We use only essential first-party cookies to keep you signed in. We do not use analytics or advertising cookies.

8. Contact

Questions? Contact us.