Privacy Policy

This Privacy Policy explains how StatEM ("we", "us"), operated by a UK-based sole trader acting as the data controller, collects, uses and protects your personal data in accordance with the UK GDPR and the Data Protection Act 2018.

1. What data we collect

Data you provide: your name (optional) and email address, an encrypted (hashed) password when you register, and study data (such as your progress, streaks, flagged cards and mock results) to run the Service. Payment information is processed and stored by Stripe — we do not store your full card details.

Data collected automatically: when you use the Service, we (and our providers) automatically collect certain technical and usage data, such as your IP address, browser and device type, operating system, referring pages, approximate country, and information about how you use the Service. This is used to keep the Service secure and working and for our own analytics. We do not use this data to build advertising profiles.

2. How we use your data

We use your data to: create and manage your account; provide access to the Service and your study progress; process payments; provide support and respond to feedback; understand how the Service is used so we can improve it; and maintain the security and functioning of the Service.

3. Our lawful bases

Under the UK GDPR we only process your data where we have a valid lawful basis to do so. We rely on:

• Performance of a contract — to provide the Service you register or pay for, including managing your account and access.
• Legitimate interests — to operate, secure and improve the Service (for example, analysing usage, preventing fraud, and diagnosing problems), where this does not override your rights.
• Legal obligation — to comply with our legal and regulatory duties, such as tax and accounting requirements.
• Consent — where we rely on your consent for a specific purpose, which you can withdraw at any time.

4. Who we share it with

We share data only with the service providers necessary to run StatEM, acting as our processors under contract — currently including Stripe (payments), and our hosting, database and analytics providers (for example, Vercel and Neon). These providers may only use your data on our instructions. We do not sell your personal data or share it for advertising. Some providers may process data outside the UK/EEA under appropriate safeguards. We may also disclose data if required by law or in connection with a business transfer.

5. How long we keep it

We keep your account data for as long as your account is active, and for a reasonable period afterwards for legal, accounting and security purposes. You can request deletion of your account at any time, after which we will delete or anonymise your data unless we are required to retain it by law.

6. Your rights

Under the UK GDPR you have the right to access, correct, delete or restrict processing of your personal data, to object to processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these rights, contact us using the details in section 9.

7. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

8. Security

We take appropriate technical and organisational measures to protect your data, including password hashing, encrypted connections (HTTPS) and restricted access. No online service can be guaranteed completely secure, but we work to protect your information and to respond promptly to any breach, including notifying the ICO where required.

9. Cookies

We use essential cookies that are required to keep you logged in and to operate the Service. We do not use advertising or tracking cookies. Our analytics are privacy-friendly and cookieless. You can control cookies through your browser settings, though disabling essential cookies may stop you from logging in.

10. Contact

For any privacy questions, to exercise your rights, or to request deletion of your account, please contact us at support@statem.co.uk. A postal address is available on request.

11. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be posted here with an updated date at the top. We encourage you to review it periodically.