Privacy Policy

Last updated: 12 October 2026

This Privacy Policy explains how [TODO for Kevin: seller's legal company name]("we"), which runs MortgagePrep, collects, uses and protects your personal data. We are the controller of your data under the UK GDPR and the Data Protection Act 2018. We are a company registered in [TODO for Kevin: country of registration]; registered office: [TODO for Kevin: registered address]. Our representative in the UK under Article 27 of the UK GDPR is [TODO for Kevin: UK GDPR representative's name and UK address].

1. Data we collect

Account data: your email address, and your name if you sign in with Google.
Study data: your answers, mock results and progress, so we can show your stats and readiness.
Billing data: your purchase history, the pass you hold and a Stripe customer reference. We never see or store your card details; Stripe handles payments.
Technical data: basic logs needed to run and secure the Service.

2. Why we use it, and our lawful basis

To provide the Service and your pass: contract.
To keep records required by tax law: legal obligation.
To secure the Service and understand how people find us: legitimate interests.
To send emails about other study material or offers to people who have bought a pass: legitimate interests (the PECR "soft opt-in" for customers).
To send those emails to anyone else, and for advertising cookies: consent, which you can withdraw at any time.

3. Who we share it with

Only with service providers that help us run MortgagePrep, under contract:

Stripe: payments and billing.
Supabase: database hosting.
Vercel: application hosting and cookie-free page statistics.
Resend: account and service emails.
Google: optional "Sign in with Google" and, only with your consent, ad conversion measurement.

Some of these providers process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum. We do not sell your personal data.

4. Marketing email

Account emails (sign-up, password resets, receipts and your pass confirmation) are part of the service. Promotional emails, such as study reminders, offers to extend a pass and news of new material, go to customers who have bought a pass, and to anyone else only if they opted in. Every promotional email has an unsubscribe link, and you can also opt out at any time on our unsubscribe page.

5. Cookies

We use these first-party cookies, which the service needs to work:

a sign-in session cookie, so you stay logged in;
the CeMAP unit you chose, for one year;
the referral code from a friend's link, for 60 days, so they and you get the referral reward;
how you first reached the site (for example a search engine or a campaign link), for 60 days;
your cookie choice, for 180 days.

Our page statistics (Vercel Web Analytics) use no cookies. If we run Google Ads, its cookies measure which ads bring visitors. They are set only if you press "Accept" in the cookie banner, and pressing "Reject" is just as easy. You can change your choice at any time with "Cookie settings" in the footer of every page.

6. How long we keep it

We keep your data while your account is active. If you delete your account we delete or anonymise your personal data, except payment records, which we keep for six years for tax purposes.

7. Your rights

You can ask for a copy of your data, and ask us to correct, delete, restrict or transfer it, or object to how we use it. We reply within one month. If you are unhappy with how we handle your data you can complain to the Information Commission (ico.org.uk), the UK data protection regulator.

8. Security

We use encryption in transit, hashed passwords and access controls. No system is perfectly secure, but we work to protect your data and will tell you and the regulator about a serious breach.

9. Contact

Privacy questions or requests: email support@example.com or use our feedback form.

Questions? See our Terms, Privacy Policy and Refund Policy.