Privacy Policy

1. Who we are

The data controller is Solaisoft Pty Ltd (trading as Examworthy) [CONFIRM: legal entity + ABN], incorporated in Western Australia, Australia. Contact: support@examworthy.com.

2. What we collect and why

• Account data. When you register, we collect your email address and a bcrypt-hashed password. We never store your password in plain text.
• Practice and progress data. We record which questions you have answered, your responses, and your per-domain readiness scores. This data is essential to delivering the core service.
• Lead-capture email. If you enter your email before creating a full account (for example, on a landing page or sample question form), we store that email address to follow up with product information. You can opt out at any time.
• Payment information. We use Stripe to process payments. Examworthy never stores your card number or full payment details. Stripe may store payment method information in accordance with their own privacy policy.
• Product analytics. We use Vercel Analytics to understand how the site is used. Vercel Analytics is cookieless and does not collect or transmit personal identifiers. No individual user is tracked across sessions.

3. Legal bases for processing (GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contract. Processing your account data and progress data is necessary to perform the service you have signed up for.
• Legitimate interests. We use aggregated, cookieless analytics to improve the Service. Our legitimate interest in product improvement is not outweighed by your privacy interests given the cookieless, non-identifying nature of the data.
• Consent. If you provided a lead-capture email before registering, we rely on your consent to contact you. You may withdraw that consent at any time by emailing support@examworthy.com or clicking the unsubscribe link in any email we send.
• Legal obligation. We may process data where required by applicable law.

4. Sub-processors and third parties

We share data with the following sub-processors only to the extent necessary to operate the Service:

• Stripe - payment processing. Stripe may store your payment method in accordance with their own privacy policy and PCI-DSS compliance programme.
• Vercel - website hosting and cookieless product analytics. Vercel processes request logs and serves the Service infrastructure.
• Database host: [CONFIRM: database hosting provider + region] - your account and progress data is stored in a managed database. We will update this policy with the provider name and region before publishing.

We do not sell your personal data to third parties. We do not use your data for advertising or share it with data brokers.

5. Cookies and tracking

Examworthy uses a session cookie to keep you logged in. We do not use advertising cookies, third-party tracking cookies, or fingerprinting.

Our analytics provider, Vercel Analytics, is cookieless and does not set any cookies or collect personal identifiers. You do not need to accept a cookie banner to use the Service.

6. Data retention

We retain your account data and progress data for as long as your account is active and for a reasonable period thereafter to handle support requests or legal obligations. If you request deletion of your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (for example, transaction records required for tax purposes, which we retain for 7 years).

7. Security

We use industry-standard security measures including encrypted connections (TLS), bcrypt password hashing, and access controls to protect your data. No system is completely secure; if you become aware of a security issue, please contact us at support@examworthy.com immediately.

8. Your rights

Depending on where you are located, you may have the following rights:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate or incomplete data.
• Deletion. Ask us to delete your personal data ("right to be forgotten"), subject to legal retention requirements.
• Portability. Request your data in a structured, machine-readable format (GDPR right to data portability).
• Objection / restriction. Object to or ask us to restrict certain processing activities, including processing based on legitimate interests.
• Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• CCPA rights (California residents). You have the right to know what personal information we collect, to delete it, to opt out of its sale (we do not sell data), and to non-discrimination for exercising these rights.

To exercise any of these rights, email support@examworthy.com. We will respond within 30 days. If you are in the EEA and you believe we have not addressed your concern, you have the right to lodge a complaint with your local supervisory authority.

9. International data transfers

Examworthy is operated from Australia. Your data may be processed in countries outside your own, including Australia, the United States, and wherever our sub-processors operate. When transferring personal data from the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses or the sub-processor's adequacy decision where applicable.

10. Children

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice on the Service before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

For privacy enquiries or to exercise your rights, contact us at support@examworthy.com.