Get the iPhone app
Legal

Privacy Policy

Last updated 2 September 2026

This policy explains what data PasskeyPrep collects, why we collect it, and what you can do about it. PasskeyPrep is operated from the United Kingdom and follows UK GDPR and the Data Protection Act 2018.

Who we are

PasskeyPrep is a study tool for CISI professional qualifications. You can reach us at hello@passkeyprep.com for any privacy questions or requests.

What we collect

We keep data collection light. The categories are:

  • Account data. Your email address and a hashed password, used to log you in.
  • Study data. Your answers, scores, and progress across syllabus elements, used to power practice mode, mock exams, and your weak-spot dashboard.
  • AI tutoring data. If the optional tutor is enabled for your account, we send the answered question, our approved teaching material, your selected answer, limited topic performance and any short reply you type to Google Cloud so it can explain the concept differently. We do not send your name, email, payment data or full study history. Raw tutoring conversations are retained by PasskeyPrep for 180 days for safety and quality review, then reduced to aggregate usage and quality records.
  • Support data. Anything you send us by email when you get in touch.
  • Payment data. Card details are handled entirely by Stripe. We store Stripe customer and checkout-session IDs, purchase status, amount, currency and any promotion code needed to provide access, support billing and measure completed purchases.
  • Technical data. Standard server logs (IP address, browser, request timestamps) retained briefly for security and debugging.
  • Product analytics. Page paths, the referring site, privacy-filtered campaign labels and key steps such as starting or completing the free mock, viewing pricing, signing up and purchasing. The current funnel uses random browser and session identifiers; after sign-in, journey rows may be linked to the account so we can measure completed purchases. It has no fields for question text, answers, names, email addresses or IP addresses. Historic signup-attribution records created before 6 August 2026 may contain a browser user-agent string or a fuller landing/referrer URL; those records remain linked to the relevant account and are removed when that account is deleted or analytics is turned off.

key, our study tutor, sends what you type in its box to Google's Gemini service to generate its reply, along with the approved question or note it is about. Google may process that request in a data centre outside the United Kingdom under its standard data transfer terms. Google does not use it to train its models and may keep it for up to 30 days for abuse monitoring. We keep the transcript linked to your account for 180 days so we can review quality and so you can be refunded a turn that failed, then we delete it. Deleting your account deletes it at once. Free accounts get one session a day and the same applies to those messages.

We do not collect special category data (health, political views, and so on). We do not sell your data. We do not share it with advertisers.

Why we process it

  • Running the service (contract performance): serving practice questions, saving your progress, authenticating you.
  • Improving the product (legitimate interests): looking at aggregate usage patterns to spot bugs and decide what to build next.
  • Billing (contract performance): managing subscriptions and one-time purchases through Stripe.
  • Security (legitimate interests): detecting abuse, brute-force attempts, and fraud.
  • Optional AI tutoring: adapting an approved explanation and checking understanding. AI output never decides your readiness or changes a marked answer.

Who we share it with

We use a small number of processors to operate PasskeyPrep:

  • Supabase (database, authentication). Data is stored in EU regions where available.
  • Vercel (hosting). Traffic may transit US data centres.
  • Stripe (payments). Card data never touches our servers.
  • Google Cloud (optional AI tutoring). Only the bounded study context described above is sent. Google states that customer data is not used to train its managed models without permission; limited abuse-monitoring retention and isolated in-memory caching may apply.

Where a processor is outside the UK or EEA, we rely on UK-approved safeguards such as the International Data Transfer Agreement or the EU Standard Contractual Clauses.

How long we keep it

Account and study data stay on file for as long as your account exists. Raw first-party funnel events are automatically deleted after 45 days; aggregated statistics may be kept for longer because they no longer identify a browser or account. Turning analytics off deletes linked raw funnel events and first-touch attribution. If you delete your account, we remove your personal data within 30 days, except for anonymised statistics that can no longer be tied back to you. Billing records are kept for the period required by HMRC (currently six years).

Your rights

Under UK GDPR you can ask us to:

  • give you a copy of your data;
  • correct anything that's wrong;
  • delete your account and data;
  • restrict or object to specific processing;
  • export your data in a portable format;
  • withdraw consent where we rely on it.

Email hello@passkeyprep.com and we'll respond within one month. If you're unhappy with how we handle a request, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies and analytics

We use browser storage that is necessary for authentication and preferences. We also use Vercel Web Analytics and Speed Insights for cookieless, aggregated website statistics, plus a first-party random identifier to understand the route from a first visit to a completed purchase. This analytics is used only to improve PasskeyPrep, never for advertising, profiling or selling data. URL queries are removed before analytics is sent, except for privacy-filtered values from the five standard utm_* campaign fields; values resembling contact details, URLs or markup are discarded. We honour Global Privacy Control and provide the free, simple objection below. For signed-in users, that objection is stored on the account and applies across devices.

Loading your analytics preference…

Changes to this policy

If we make material changes we'll email account holders and update the date at the top of this page. Routine wording fixes won't trigger an email.

Questions? Get in touch.