Privacy policy
Version 9 September 2026.
Who is responsible for your information?
The controller for the information processed through ESAT and TMUA Prep is Marlow Valentine Barrett Figueras, trading as Vector. Registered/contact address: 29 Ruston Mews, London, W11 1RB, United Kingdom. Contact: vector.revision@gmail.com.
This policy is written for the UK launch of an independent ESAT revision service. It is not legal advice. The operator should review the final controller details, lawful bases, supplier contracts and retention periods before opening public registration.
Information we collect
If you use the free samples, your answers remain in that page and are not saved to a ESAT and TMUA Prep account. If you register, we collect your verified email address, public handle, age range, guardian-agreement declaration where applicable, registration time, notice version and the source code in your signup link. We also store your account settings, practice questions, answers, skips, confidence ratings, answer changes, timing estimates, diagnostic selection records, timed-paper answers and challenge results.
For security and service operation, authentication and infrastructure providers may process session, device and network information. Do not put passwords, payment-card details, medical information or other sensitive personal information into feedback.
Why we use it
- To create and secure your account and send your requested sign-in code.
- To provide saved progress, adaptive practice, timed papers and challenge results.
- To detect repeated answer patterns and select an appropriate next question.
- To provide support, investigate faults, prevent abuse and protect the service.
- To send optional product research or promotional email only where you have separately opted in.
- To fulfil purchases, provide paid access, prevent fraud and manage refunds where paid access is enabled.
The operator must document the applicable UK GDPR lawful basis for each purpose before launch. Core learning records are used to provide the requested service; optional research and promotional messages are separate choices and are not required to use ESAT and TMUA Prep. Inferred mistakes are learning estimates, not medical or psychological diagnoses, and are not sold or used for advertising decisions.
Research, marketing and rankings
Optional product research is off by default and can be withdrawn in your account. Withdrawing it removes optional research events where the service can do so; core records needed to provide your account are separate. Promotional email is also optional and can be turned off. If you opt into a public challenge ranking, your chosen handle and score may be shown; your email and practice history are not displayed. Ranking is private by default.
Who processes it?
Cloudflare hosts the Worker and website. Supabase provides authentication and stores the application database in the configured region. Brevo sends verification, welcome and access-expiry emails when configured. Stripe hosts payment checkout and processes payment details when paid access is enabled. ESAT and TMUA Prep stores payment references and access status, not card numbers. These providers may process information under their own terms; the operator must keep the relevant data-processing and international transfer details up to date.
How long we keep it
Optional research events are scheduled for deletion after 30 days. Account learning history is retained while your account is active so that ESAT and TMUA Prep can provide progress and adaptive selection. You can request deletion; required payment, fraud-prevention, accounting and security records may be retained for the period required by law or legitimate operational needs. Provider logs and backups may take longer to expire. The operator should publish a detailed retention schedule before launch.
Your rights
Subject to legal exceptions, you may ask for access, correction, deletion, restriction or portability, object to applicable processing, and withdraw consent where processing relies on consent. Account controls provide an account export, preference changes and deletion. A complete access request may include provider logs or records not included in the account summary; contact the operator for that request.
Contact vector.revision@gmail.com with a privacy complaint. You may also complain to the Information Commissioner’s Office.
Young people
ESAT and TMUA Prep is intended for people aged 16 and over. We collect an age range, not a date of birth. People aged 16–17 must declare that a parent or guardian has read the privacy summary and agreed. This declaration is not independent verification. The operator should complete an age-appropriate design and children’s-data assessment before wider youth distribution.
Changes
We will publish material changes on the updates page and update the notice version shown here. See the cookie policy and terms and conditions for related information.