Privacy notice

This explains what personal data Acrestep collects, why, who sees it and what your rights are. Acrestep is run by Skrivon Ltd, trading as Acrestep, registered in England and Wales, company number 17461746, registered office 105 Loachbrook Farm Way, Congleton, England, CW12 4BF. We are the controller of your data. Contact us at hello@acrestep.co.uk.

What we collect and why

• Your email address. To create your account, sign you in (with a password you choose, or an emailed one-time code), send your purchase confirmation and reply to you. If you set a password it is checked on our server when you sign in and stored by our account provider as a salted hash; we never store it ourselves. Legal basis: it is needed to provide the service you asked for (contract).
• Your purchase. Payment reference, amount, date, and the record that you accepted the cancellation notice at checkout. Card details go straight to Stripe in its payment form and we never see or store them. Stripe collects your name and the card details it needs. Legal basis: contract, and our legal duty to keep accounting records.
• Your practice. The questions you answered, scores, mock exam results and any question you report. This powers your history and weak-topics practice. Legal basis: contract.
• Technical data. Our hosting provider keeps short-lived server logs (such as IP address and browser type) for security and fixing faults. Legal basis: legitimate interests in keeping the service secure. Our account provider keeps similar short-lived logs.
• Visit statistics. We use Plausible, which counts visits without cookies and without personal data. We use it to see which pages work and how many people try the free questions and buy. Legal basis: legitimate interests in understanding how the site is used.

If you use the free questions without an account, your answers stay in your own browser. They are not sent to us.

Cookies

We use a cookie to keep you signed in. On the payment page, Stripe sets cookies to prevent fraud. Your browser also stores your free-question answers and the app's files so the site works offline. None of these are used for advertising or tracking, so we do not show a cookie banner.

Who we share data with

These companies process data for us, only to run the service:

• Supabase (accounts and database; our project is hosted in Ireland).
• Vercel (website hosting; our functions run in London).
• Stripe (payments). Stripe also acts as an independent controller for payment and fraud checks.
• Resend (sending sign-in and confirmation emails).
• Cloudflare (domain name and email forwarding: emails you send to hello@acrestep.co.uk pass through Cloudflare) and Google (our email inbox, where your emails to us are stored).
• Plausible (cookie-free visit statistics).

Some of these providers are based outside the UK. Where data is transferred we rely on the UK's adequacy arrangements or approved contract terms. We do not sell your data and we do not use it for advertising.

How long we keep it

• Account and practice data: until you delete your account (see below).
• Purchase records: six years, because tax and accounting law requires it. These are kept even if you delete your account, without your email address.
• Server logs: a short period set by our hosting provider.

Your rights

You can ask to see your data, correct it, delete it, restrict or object to how we use it, and receive a copy you can move. You can delete your account and practice data yourself on the account page, or email us. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

Age

Acrestep is for people aged 16 or over. If you are under 16, please do not create an account.

Changes

If we change this notice in a way that matters, we will say so on this page and, if we hold your email address, tell you.