Privacy Policy

Who is responsible

Contact: hello@refereeprep.com

What we collect

Only what the service needs to work:

• Account details — your email address, a display name and country if you choose to give them, and your password stored as a salted scrypt hash. We never store your password itself and cannot read it.
• Study data — the papers you sit, the answers you select, your scores and per-Law breakdowns, and when each attempt started and finished.
• Purchase records — your credit balance, a ledger of credits added and spent, and your subscription status and renewal date.
• Technical data — our hosting and database providers process standard server logs, including IP address, as part of delivering and securing the service.

We do not collect payment card details. Those go directly to our payment provider and never reach our servers.

We do not currently run analytics or advertising trackers.

Why we process it, and on what basis

• To provide the service you signed up for — running papers, saving results, applying credits and subscriptions. Legal basis: performance of a contract.
• To send account email such as welcome and password-reset messages. Legal basis: performance of a contract.
• To keep the service secure and prevent abuse, and to keep accurate business records. Legal basis: our legitimate interests, and legal obligation for records we must retain.

We do not sell personal data, and we do not use your study data for anything other than showing you your own results.

Cookies

We set one cookie. It holds a signed session token so you stay logged in, is HttpOnly, uses SameSite=Lax, and lasts thirty days.

It is strictly necessary to provide a service you asked for, so it does not require consent. We set no advertising or analytics cookies.

Clearing it logs you out and nothing else.

Who else processes your data

We use a small number of providers, each acting on our instructions:

• Our hosting provider, which serves the site and runs the API.
• Our database provider, which stores your account and study data.
• Our email provider, which delivers account email.
• Lemon Squeezy, which processes payments and holds the purchase record.

Some of these may process data outside your country, including outside the European Economic Area. Where that happens we rely on the transfer safeguards those providers have in place, such as standard contractual clauses.

How long we keep it

Account and study data are kept while your account exists, so your history stays available to you.

If you delete your account we remove your personal data, keeping only what we must for legal and accounting reasons — typically transaction records for the period tax law requires.

Anonymous attempts by visitors who never create an account are removed periodically.

Your rights

If you are in the UK or EEA you have the right to access your data, correct it, delete it, restrict or object to processing, and receive a copy in a portable format. These rights apply to people elsewhere too, as a matter of policy.

To exercise any of them, email hello@refereeprep.com. We will respond within one month.

You can also complain to your local data protection authority if you think we have handled your data badly. We would rather you told us first so we can put it right.

Children

The service is intended for referees aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will delete it.

Changes

If this policy changes materially we will say so on the site and update the date above before the change takes effect.