Privacy Notice

• Account data — email address, password (stored hashed), and, if you sign in with Google, your name and Google account email.
• Subscription data — your plan, subscription status and renewal dates (received from Paddle). We never see or store your card details.
• Study data — flashcard and practice-test progress. Most of this is stored in your own browser.
• Support messages — what you send us when you get in touch.
• Technical data — IP address, device and browser information, and basic usage/error logs.

• Creating your account and providing the Service — performance of our contract with you.
• Managing subscriptions and access — performance of our contract.
• Security, fraud prevention and keeping the Service reliable — legitimate interests.
• Improving the product and fixing faults — legitimate interests.
• Responding to support requests — legitimate interests.
• Marketing emails, if you ask for them — consent.
• Accounting and legal obligations — legal obligation.

• Service providers — hosting, database, authentication and error-monitoring providers who process data on our instructions.
• Paddle — our Merchant of Record, for the sale of the subscription, payments, subscription management, invoicing and tax compliance.
• Professional advisers — legal and accounting, where needed.
• Authorities — where we are required to by law.

We do not sell your personal data.

Some of our providers process data outside the UK/EEA. Where that happens we rely on appropriate safeguards, such as UK/EU Standard Contractual Clauses or an adequacy decision.

We keep account and subscription data for as long as your account is active and for up to 6 years afterwards where needed for tax and accounting records. Logs are kept for a short period. When data is no longer needed it is deleted or anonymised.

We use appropriate technical and organisational measures, including encryption in transit, hashed passwords, and access controls limiting who can reach personal data.

We use essential cookies and browser storage to keep you signed in and to save your revision progress on your device. We do not use advertising cookies. You can clear this data through your browser settings, though doing so will sign you out and reset locally stored progress.

Under UK GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, request portability, and withdraw consent at any time. Contact us at support@a-plus-biology.co.uk and we will respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk).