Privacy Policy

Exam Study Hacks is a trading name of BuyABusiness Ltd, a company registered in England & Wales (company number 11440681), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

BuyABusiness Ltd is the data controller for Exam Study Hacks and is registered with the UK Information Commissioner's Office (ICO), registration reference ZC142850.

For any privacy question or request, contact privacy@examstudyhacks.com.

Account data: email address, display name, role (student, parent or admin), year group and onboarding choices such as exam board and target exam date.

Learning data: question attempts, confidence choices, mastery scores, XP, streaks, achievements and readiness signals.

Parent/guardian data: parent name and email where a parent is invited or manages a child's account, and notification preferences.

Billing data: where you subscribe, Stripe processes your card details. We store Stripe customer, subscription and price IDs, plan status and billing period dates — not your full card number.

Support and contact data: information you submit through our contact or waitlist forms.

Technical and analytics data: basic device/browser information and, only if you accept analytics cookies, privacy-safe usage analytics.

To provide the service — adaptive lessons, knowledge maps, Hattie Ed coaching, readiness tracking and parent progress summaries (lawful basis: performance of a contract).

To run subscriptions, payments and billing emails (lawful basis: contract, and legal obligation for keeping financial records).

To improve and secure the product, prevent abuse and respond to support requests (lawful basis: our legitimate interests, balanced against your rights).

To send optional analytics and any optional marketing only where you have given consent (lawful basis: consent, which you can withdraw at any time).

We do not sell personal data, and we do not use private admin source uploads to create public content without human review.

Exam Study Hacks is likely to be accessed by children. Where a child uses the service, a parent or guardian sets up and manages the account and is responsible for it.

Student data is private by default. We do not operate public leaderboards, we minimise the optional data we collect, and we avoid unnecessary profiling.

Parents only see appropriate learning progress, not sensitive or excessive student data.

Necessary cookies keep sign-in, security and your preferences working. Optional analytics cookies only load after you accept them, and analytics are never collected on admin or API routes.

You can change your choice at any time using the Cookie settings link in the footer. See our Cookie Policy for details.

We use trusted processors to run the service: Supabase (database, authentication and storage), Vercel (hosting), Stripe (payments), Resend (transactional email), Cloudflare (media storage and DNS) and Google Analytics (optional, consent-based analytics).

Each processor handles data only as needed to provide its part of the service and under appropriate data-processing terms. Server-side secret keys are never exposed to the browser.

Our database and email are hosted in the UK/EU region where possible. Some processors may store or process data outside the UK. Where that happens, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

We keep account and learning data while your account is active. If you delete your account, we remove associated data except where we must keep records for legal reasons.

Billing and tax records are kept for as long as required by law (generally six years). Analytics data is retained for up to 14 months. Email event logs are kept only as long as needed to operate and audit our emails.

We use HTTPS with HSTS, security headers, row-level database security and named-admin access controls, and Stripe for PCI-compliant payments. See our Security & Trust page for more detail and how to report a vulnerability.

Under UK GDPR you have the right to access your data; to rectification; to erasure; to restrict or object to processing; to data portability; and to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email privacy@examstudyhacks.com. We will respond within one month. Where a child uses the service, requests are normally made by the parent or guardian who manages the account.

Transactional emails (such as account, billing and security messages) are part of the service. Any marketing emails are sent only with consent or where permitted, and always include an unsubscribe option.

If you have a concern, please contact us first at privacy@examstudyhacks.com so we can help.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. Our ICO registration reference is ZC142850.

We may update this policy from time to time. We will change the 'last updated' date above and, where appropriate, notify you of significant changes.