Privacy Policy

Overview

HSK Prep ("we", "the service") is an online HSK exam preparation tool. This policy explains what personal data we collect, why, and the rights you have over it. We process personal data in line with the EU General Data Protection Regulation (GDPR).

Data controller: HSK Prep, an individual-operated service. For any privacy question or request, contact us at support@hsk-prep.vercel.app.

Data we collect

Account data: your email address (used for magic-link sign-in) and, if you sign in with Google, your Google profile name and email.

Learning data: every answer you submit (question, chosen option, correctness, time spent), exam sessions and scores, and daily activity aggregates. This data powers your dashboard, mistakes notebook and diagnostics.

Payment data: payments are processed by Creem, our Merchant of Record. We never see or store your card number; we store only your subscription status, plan and period dates linked to your account.

Technical data: standard server logs (IP address, user agent) kept by our hosting provider for security and debugging.

How we use your data

To provide the service: sign you in, save your progress, grade your answers and show your statistics.

To operate the business: confirm your subscription, handle refund requests (we check your usage against our refund thresholds) and prevent abuse.

We do not sell your data, and we do not use your learning data for advertising.

Processors and international transfers

We use the following processors: Supabase (database and file/audio storage), Vercel (hosting), Resend (transactional email) and Creem (payments, Merchant of Record). Each processes data under its own data processing terms and only for the service it provides to us.

Your data may be processed outside your country of residence. Where data is transferred outside the EEA, it is protected by the processors' standard contractual clauses or equivalent safeguards.

Your rights (GDPR)

You have the right of access (a copy of your data), rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object. To exercise any of these, contact us by email; we respond within 30 days.

Deleting your account removes your profile and learning history. Records needed for tax and accounting (handled by Creem as Merchant of Record) are retained as required by law.

If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority.

Cookies and retention

We use only strictly necessary cookies: the session cookie that keeps you signed in. We do not use tracking or advertising cookies.

We keep your account and learning data while your account exists. Server logs are rotated by our hosting provider on their standard retention schedule.

Changes and contact

If we change this policy materially, we will notify you by email before the change takes effect. The current version is always available at /privacy.

Questions or requests: contact us at support@hsk-prep.vercel.app.