Privacy Policy

1. Personal Data We Collect

We collect only the data necessary to provide and operate the Service.

1.1 Data you provide directly

• Name
• Email address
• Account credentials
• Subscription and billing status
• Exam attempts, results, and learning progress
• Writing and speaking assistant submissions
• Support communications

Payment data:
We do not store credit card numbers or bank details.
Payments on the website are processed securely by Mollie (including iDEAL and SEPA). Purchases in the iPhone app are processed by Apple; we receive only a record of what was bought and when, never your payment details.

1.2 Data collected automatically

• IP address
• Device and browser information
• Log and usage data
• Analytics data on the website (Vercel Analytics, which sets no cookies, and, only if you accept analytics cookies, Google Analytics and PostHog)
• Error reports (Sentry): technical details about errors in the website and the app. On the website, an error report can include a short replay of the page before the error, with all text masked, and is linked to your account ID. Error reports from the app are not linked to your account.

2. Legal Basis for Processing

We process personal data under the following GDPR legal bases:

• Contract – to provide access to the Service and its features
• Legitimate interest – to improve the Service, prevent fraud, and provide support
• Legal obligation – to comply with tax, accounting, and regulatory requirements
• Consent – where required (e.g. non-essential cookies)

3. How We Use Your Data

We use your data to:

• Create and manage user accounts
• Deliver exam practice and AI-assisted learning features
• Store exam progress and results
• Process subscriptions and payments
• Provide customer support
• Improve performance, usability, and content quality
• Prevent misuse, fraud, and security incidents
• Fulfill legal and accounting obligations

4. Cookies and Tracking

We use essential cookies required for the Service to function and analytics cookies to understand usage and improve the Service.
Analytics cookies are set only if you accept them in the cookie banner. You can change or withdraw your choice at any time under Cookie settings at the bottom of the page.
The iPhone app does not use cookies and contains no analytics or advertising tools.

5. Sharing of Personal Data

We only share personal data with trusted service providers necessary to operate the Service, including:

• Payment processors (Mollie)
• Email and workspace providers (Google Workspace)
• Analytics providers (Google Analytics, Vercel Analytics, PostHog)
• Hosting and infrastructure providers (Vercel, Supabase)
• AI service provider (OpenAI): to transcribe spoken answers and to evaluate written and spoken answers
• Apple: for purchases made in the iPhone app
• Error monitoring (Sentry)

We do not sell personal data.

6. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), including in the United States (e.g. OpenAI, Google, Vercel).

When personal data is transferred outside the EEA, we rely on appropriate safeguards as required by GDPR, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Supplementary technical and organisational measures where necessary
• Providers certified under applicable data transfer frameworks (e.g. the EU-U.S. Data Privacy Framework, where available)

You may request more information about the specific safeguards in place for any transfer by contacting us.

7. Data Retention & Inactive Accounts

We retain personal data only as long as necessary for the purposes described above.

Active accounts:
Personal data is retained while your account is active and the Service is in use.

Inactive accounts:
An account may be considered inactive if there has been no login or learning activity for an extended period (e.g. 12 months).

In such cases:

• We may notify you by email before taking any action
• Your account may be deactivated (login disabled)
• Your data is preserved and can be restored upon request, except exam recordings, which are deleted after 90 days (see below)

Voice recordings:
In speaking practice, your recording is sent to our AI provider for transcription and is not stored by us; the transcript and AI feedback are saved to your account as part of your learning history. In practice exams, your spoken answers are stored in private storage so you can listen to them with your results. Exam recordings are deleted automatically 90 days after they are made, or earlier if you delete your account.

Writing submissions:
Written submissions and AI feedback are stored with your account to provide progress tracking. You can delete them at any time from account settings.

Deletion:
You can delete your account at any time: in the iPhone app from the Profile screen, or on the website from your Account page.
Certain data (e.g. billing records) may be retained longer where required by law.

8. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Correct inaccurate data
• Export your data
• Request deletion of your account
• Restrict or object to processing
• Withdraw consent (where applicable)
• Lodge a complaint with your local Data Protection Authority, or with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) as our lead supervisory authority

To exercise your rights, contact:

privacy@dutchexam.online

9. Data Security

We use appropriate technical and organizational measures to protect personal data, including encrypted connections, access controls, and secure infrastructure.

10. Children’s Privacy

The Service is intended for people aged 16 and over.
We do not knowingly collect personal data from children under 16. If you believe a child under 16 has given us personal data, contact us and we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

When we make material changes, we will update the “Last updated” date at the top of this page and notify registered users by email where appropriate. We encourage you to review this page periodically.

12. Contact

For privacy-related questions or requests:

privacy@dutchexam.online