Privacy Policy

1. Who we are

The data controller is Solaisoft Pty Ltd (trading as Examworthy), ABN 24 379 197 237, incorporated in Western Australia, Australia. Contact: support@examworthy.com.

2. What we collect and why

• Account data. When you register, we collect your email address and a bcrypt-hashed password. We never store your password in plain text.
• Practice and progress data. We record which questions you have answered, your responses, and your per-domain readiness scores. This data is essential to delivering the core service.
• Lead-capture email. If you enter your email before creating a full account (for example, on a landing page or sample question form), we store that email address to follow up with product information. You can opt out at any time.
• Payment information. We use Stripe to process payments. Examworthy never stores your card number or full payment details. Stripe may store payment method information in accordance with their own privacy policy.
• Product analytics. We use Umami, a self-hosted analytics tool running on our own server in Sydney, to understand how the site is used. It is cookieless: it stores no identifier on your device and sets no cookies. It records the page visited, the referring page, your browser language and screen size, and derives a short-lived visit identifier on our server from your IP address and browser user-agent. That identifier is not stored on your device and is not used to recognise you across days. We do not send this data to any third-party analytics company.
• Study data stored in your browser. The study app keeps your practice progress, flashcard review schedule, chosen certification and display preferences in your browser's local storage, including before you create an account. This is what allows a free practice session to work and to survive a page reload. It stays on your device, is not an advertising or tracking identifier, and is cleared when you sign out. The app also installs a service worker so it can show an offline page; it never caches your answers or any request to our API.

3. Legal bases for processing (GDPR)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contract. Processing your account data and progress data is necessary to perform the service you have signed up for.
• Legitimate interests. We use aggregated, cookieless analytics to improve the Service. Our legitimate interest in product improvement is not outweighed by your privacy interests given the cookieless, non-identifying nature of the data.
• Consent. If you provided a lead-capture email before registering, we rely on your consent to contact you. You may withdraw that consent at any time by emailing support@examworthy.com or clicking the unsubscribe link in any email we send.
• Legal obligation. We may process data where required by applicable law.

4. Sub-processors and third parties

We share data with the following sub-processors only to the extent necessary to operate the Service:

• Stripe - payment processing. Stripe may store your payment method in accordance with their own privacy policy and PCI-DSS compliance programme.
• Vercel - website hosting. Vercel processes request logs and serves the Service infrastructure. We do not use Vercel's analytics product.
• Vultr (Sydney, Australia). Your account and progress data is stored in a managed PostgreSQL database on a virtual private server hosted in Sydney, Australia. Our self-hosted analytics runs on the same server, so analytics data is not shared with an external analytics provider.

We do not sell your personal data to third parties. We do not use your data for advertising or share it with data brokers.

5. Cookies and tracking

Examworthy sets a small number of first-party cookies, all of them necessary to run the Service: a session cookie to keep you logged in, a companion cookie recording only that you are signed in, a short-lived cookie during sign-in with an external provider, a short-lived cookie after a purchase so you can correct a mistyped email, and a cookie remembering your light or dark theme choice.

We use no advertising cookies and no third-party tracking cookies. We run no third-party analytics, no advertising pixels and no tag manager, and we load no script that reads information from your device to identify you.

Because we set no cookies that require consent, you do not need to accept a cookie banner to use the Service. The marketing site stores nothing on your device at all. The study app stores your progress in your browser, as described in section 2, because that is how the feature works rather than to track you.

6. Data retention

We retain your account data and progress data for as long as your account is active and for a reasonable period thereafter to handle support requests or legal obligations. If you request deletion of your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (for example, transaction records required for tax purposes, which we retain for 7 years).

7. Security

We use industry-standard security measures including encrypted connections (TLS), bcrypt password hashing, and access controls to protect your data. No system is completely secure; if you become aware of a security issue, please contact us at support@examworthy.com immediately.

8. Your rights

Depending on where you are located, you may have the following rights:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate or incomplete data.
• Deletion. Ask us to delete your personal data ("right to be forgotten"), subject to legal retention requirements.
• Portability. Request your data in a structured, machine-readable format (GDPR right to data portability).
• Objection / restriction. Object to or ask us to restrict certain processing activities, including processing based on legitimate interests.
• Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• CCPA rights (California residents). You have the right to know what personal information we collect, to delete it, to opt out of its sale (we do not sell data), and to non-discrimination for exercising these rights.

To exercise any of these rights, email support@examworthy.com. We will respond within 30 days. If you are in the EEA and you believe we have not addressed your concern, you have the right to lodge a complaint with your local supervisory authority.

9. International data transfers

Examworthy is operated from Australia. Your data may be processed in countries outside your own, including Australia, the United States, and wherever our sub-processors operate. When transferring personal data from the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses or the sub-processor's adequacy decision where applicable.

10. Children

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice on the Service before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

For privacy enquiries or to exercise your rights, contact us at support@examworthy.com.