Privacy Policy

Who controls your data

AI Exam Lab is the data controller for the personal data described here. Contact us at legal@aiexamlab.com.

What we collect, and why

• Account data — name, email address, password hash. Necessary to create your account and secure it (performance of a contract).
• Order data — items purchased, amounts, currency, tax country and region, order references. Necessary to fulfil your order, meet tax and accounting obligations (legal obligation), and handle refunds.
• Learning data — which lessons you complete and where you paused. Necessary to provide progress tracking (performance of a contract).
• Technical data — hashed IP address, user agent and a timestamp when you request a download, plus rate-limiting counters keyed by a salted hash of your IP. Necessary for security and abuse prevention (legitimate interests).
• Consent data — your cookie choices and when you made them. Necessary to demonstrate compliance (legal obligation).

What we deliberately do not do

• We never store your card details. Payment data is handled entirely by our payment provider.
• We do not store your raw IP address for analytics or download logs — only a salted, one-way hash.
• We do not sell your personal data, and we do not share it for third-party advertising.
• We do not load analytics scripts before you consent to them.

Who processes data on our behalf

Each of these is bound by a data-processing agreement and only acts on our instructions: our hosting provider; our payment provider, which acts as merchant of record for payment and tax; our transactional email provider, for receipts, password resets and product updates; our content-management provider, for editorial content (which contains no learner data); and our analytics provider, only if you consent.

International transfers

Some providers are located outside your country. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and we choose providers that offer them.

How long we keep it

• Account and learning data: while your account is open, then deleted within 30 days of a deletion request.
• Order and tax records: retained for the period tax and accounting law requires (typically 6–10 years), because we cannot lawfully delete an invoice record. These records are kept for compliance only.
• Download and rate-limit logs: 12 months, then deleted.
• Email outbox records: 24 months, so we can prove what was sent.

Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, withdraw consent, and lodge a complaint with your local supervisory authority.

To exercise any of these, email legal@aiexamlab.com. We respond within 30 days. We may retain order records where the law requires it, and we will tell you when that applies.

We do not use automated decision-making to make decisions with legal or similarly significant effects about you.

Children

This service is intended for professional and adult learners and is not directed at children under 16. We do not knowingly collect their data; if you believe a child has created an account, contact us and we will remove it.

Security

Passwords are stored using a modern password-hashing function and are never recoverable by us. Sessions use httpOnly, SameSite cookies and are revocable. Access to your purchases and download links is checked on the server for every request, and download links expire within minutes.

Changes

If we materially change this policy we will update the date above and, for significant changes, notify you by email before the change takes effect.