Privacy notice

Who is responsible for your data

MRCGP Revision Limited (company number 17267291) is the data controller for Trade Exams. Privacy contact: info@tradeexams.co.uk.

Trade Exams is an exam-revision service. Do not enter another person's identifying information in notes or reports.

Data we process

• Account identity: email, sign-in records, name and authentication/security state.
• Historical pre-launch waitlist records: email address, signup source and the time you joined, if you previously used that service.
• Profile and preferences: exam date, onboarding answers and confidence settings.
• Revision activity: answers, correctness, confidence, timing, notes, flags, reads, revision schedules and mock-test results.
• Support and editorial data: content reports, queries and our response or resolution.
• Purchase data: Stripe customer, checkout and payment references, the exam pass purchased, access dates and refund or dispute information. Card details are handled by Stripe and are not stored in this application.
• Legal acceptance: the Terms and Privacy notice versions acknowledged when you create an account, and the server-recorded acceptance time.
• Security and technical data: essential session information, IP/device details in provider logs, and diagnostic records needed to protect and operate the service.

Why we use it and our lawful bases

Withdrawing analytics consent does not affect processing that occurred lawfully before withdrawal.

Analytics, cookies and peer comparisons

Essential authentication/session storage is required to keep you signed in. Vercel Analytics stays disabled unless you opt in through the cookie banner or Cookie settings. Practice results are included in the anonymous comparison service described in the Terms. A scheduled job converts eligible scores into count buckets; the persisted comparison snapshot contains no name, email or user identifier, and small cohorts are not displayed.

Service providers and international transfers

We use a limited set of providers to operate the service:

• Supabase — authentication, database and account email infrastructure.
• Stripe — one-off checkout, payment records, refunds, disputes and payment compliance.
• Vercel — application hosting, security/diagnostic logs and optional analytics.
• Cloudflare — delivery of editorial images and associated access/security logs; ordinary account and revision records are not stored in R2.
• Airtable — the editorial question bank; ordinary member account and revision data are not stored there.
• Resend — delivery of contact-form messages, service email and any launch update previously requested.

Some providers and subprocessors operate outside the UK/EEA. Where a restricted transfer occurs, we rely on an applicable adequacy mechanism or contractual safeguards such as the EU Standard Contractual Clauses and UK Addendum, and assess supplementary protections where required. You may ask the privacy contact for the current processor/transfer register.

Retention and deletion

Account, profile and learning data are kept while your account exists so progress remains available. Terms-acceptance records and content reports linked only to your account are removed through the account-deletion process, along with revision history and authentication. Rights-request audit records are separated from the account after deletion and retained only for the documented compliance period.

Providers may retain encrypted backups under their documented rolling schedules. Stripe or we may retain limited invoice, tax, fraud, dispute or rights-request evidence where law requires or permits it; it is then restricted to that purpose and deleted or anonymised when the retention period ends.

Waitlist records are kept until launch updates are complete or you withdraw consent, whichever comes first. Any remaining unused waitlist addresses are deleted within 12 months after launch.

Your rights

Depending on the law that applies, you may ask to be informed, access your data, correct it, erase it, restrict processing, object, receive portable data, withdraw consent, and obtain information about safeguards. Account provides immediate JSON export, correction controls and account deletion. For restriction, objection, a different format, or anything not covered there, contact info@tradeexams.co.uk.

We may need to verify identity. We normally respond without undue delay and within one month. A right can have legal exceptions; if we refuse or limit a request, we will explain why and describe complaint options.

You can complain to the UK Information Commissioner's Office or, in the EEA, the data protection authority where you live, work, or believe an infringement occurred. We would appreciate the chance to address the issue first, but you do not have to contact us before a regulator.

Security, children and changes

We use access controls, row-level database rules, server-side entitlement checks, MFA for privileged editorial/owner access, encrypted provider connections and ownership checks for billing operations. No internet service is risk-free; please report a suspected account or data incident promptly.

The service is for adults preparing for UK trade and technical exams and is not directed to children.

We may update this notice when processing changes. Material changes will be highlighted in the service or by email where appropriate. You can manage Account preferences in Accountand optional analytics through Cookie settings.