Privacy Policy

1. Personal Data We Collect

We collect only the data necessary to provide and operate the Service.

1.1 Data you provide directly

• Name
• Email address
• Account credentials
• Subscription and billing status
• Exam attempts, results, and learning progress
• Writing and speaking assistant submissions
• Support communications

Payment data:
We do not store credit card numbers or bank details.
All payments are processed securely by Mollie (including iDEAL and SEPA).

1.2 Data collected automatically

• IP address
• Device and browser information
• Log and usage data
• Analytics data (e.g. Google Analytics, Vercel Analytics)

2. Legal Basis for Processing

We process personal data under the following GDPR legal bases:

• Contract – to provide access to the Service and its features
• Legitimate interest – to improve the Service, prevent fraud, and provide support
• Legal obligation – to comply with tax, accounting, and regulatory requirements
• Consent – where required (e.g. non-essential cookies)

3. How We Use Your Data

We use your data to:

• Create and manage user accounts
• Deliver exam practice and AI-assisted learning features
• Store exam progress and results
• Process subscriptions and payments
• Provide customer support
• Improve performance, usability, and content quality
• Prevent misuse, fraud, and security incidents
• Fulfill legal and accounting obligations

4. Cookies and Tracking

We use essential cookies required for the Service to function and analytics cookies to understand usage and improve the Service.
You can disable non-essential cookies through your browser settings.

5. Sharing of Personal Data

We only share personal data with trusted service providers necessary to operate the Service, including:

• Payment processors (Mollie)
• Email and workspace providers (Google Workspace)
• Analytics providers (Google Analytics, Vercel Analytics)
• Hosting and infrastructure providers (Vercel, Supabase)
• AI service providers (OpenAI — for processing Writing and Speaking submissions)

We do not sell personal data.

6. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), including in the United States (e.g. OpenAI, Google, Vercel).

When personal data is transferred outside the EEA, we rely on appropriate safeguards as required by GDPR, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Supplementary technical and organisational measures where necessary
• Providers certified under applicable data transfer frameworks (e.g. the EU-U.S. Data Privacy Framework, where available)

You may request more information about the specific safeguards in place for any transfer by contacting us.

7. Data Retention & Inactive Accounts

We retain personal data only as long as necessary for the purposes described above.

Active accounts:
Personal data is retained while your account is active and the Service is in use.

Inactive accounts:
An account may be considered inactive if there has been no login or learning activity for an extended period (e.g. 12 months).

In such cases:

• We may notify you by email before taking any action
• Your account may be deactivated (login disabled)
• All data is preserved and can be restored upon request

Voice recordings:
Voice recordings submitted to the Speaking AI assistant are transcribed and deleted immediately after processing. We do not store audio files. The resulting transcription and AI feedback are saved to your account as part of your learning history.

Writing submissions:
Written submissions and AI feedback are stored with your account to provide progress tracking. You can delete them at any time from account settings.

Deletion:
You may request deletion of your account at any time.
Certain data (e.g. billing records) may be retained longer where required by law.

8. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Correct inaccurate data
• Export your data
• Request deletion of your account
• Restrict or object to processing
• Withdraw consent (where applicable)
• Lodge a complaint with your local Data Protection Authority, or with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) as our lead supervisory authority

To exercise your rights, contact:

support@dutchexam.online

9. Data Security

We use appropriate technical and organizational measures to protect personal data, including encrypted connections, access controls, and secure infrastructure.

10. Children’s Privacy

The Service is not intended for users under the age of 16.
We do not knowingly collect personal data from children.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

When we make material changes, we will update the “Last updated” date at the top of this page and notify registered users by email where appropriate. We encourage you to review this page periodically.

12. Contact

For privacy-related questions or requests:

support@dutchexam.online