Privacy policy

This policy explains what personal data we process when you use Semplr, why, on what legal basis, for how long, and the rights you have under the EU and UK General Data Protection Regulation (GDPR) and similar laws. This document is provided in English; translations, where offered, are for convenience and the English version applies.

1. Who is responsible

The controller is [Legal entity name], [Registered address], [Country of registration]. Contact for privacy questions and requests: privacy@semplr.com.

2. What we process

Practising without an account. Your drafts, scores and language and currency choices are stored only in your own browser (local storage). We do not receive them, except as described below.
Multiple-choice mocks. Our servers pick the questions for each mock, and the answers you choose are sent to us when you hand it in so we can mark it. We keep the questions and answers for 30 days to find questions that are unclear or wrong. If you are signed in they are linked to your account; if you delete your account they are unlinked from it and deleted when the 30 days end.
Writing you hand in for marking. The text of your answer, the exam and task, and the feedback language are sent to our servers and passed to our AI provider to be marked. If you are not signed in, we do not store the text after the marking is returned to you. If you are signed in, we save the answer and its marks to your account so you can see them on your dashboard.
Speaking you record for marking. The recording is sent to our servers and turned into text by speech recognition running on our own server. The audio is not kept and not sent to anyone else: it is deleted as soon as the text is made. The text is then handled exactly like writing you hand in (above).
Questions you ask the study chat. Your messages, the exam, and a short summary of your latest results on that exam are sent to our servers and passed to our AI provider to answer. We do not store the conversation; it lives only in your open browser tab.
Your account, if you create one. Supabase Auth handles your email address, password and email confirmation. We store your Supabase user ID, email address, join date, language, the exam and exam date you tell us, your mock scores and marked writing so you can see your progress on any device.
Account emails. Supabase sends email confirmation and password reset links.
Exam passes, if you buy one. Which pass, for which exam, when it starts and ends, the amount and currency, and when you asked for it to start at once. Stripe processes the payment; we never see your card.
Sign-in session. Supabase keeps your session in your browser so you stay signed in.
Technical data. A one-way hash of your IP address, used to limit abuse (for example, too many sign-in attempts or marking requests). It is deleted within a day. If a page breaks in your browser, it reports the error message, the script file and line, and the page address — nothing that identifies you. We also keep daily totals (requests, errors, sign-ups, marking volume) that contain no personal data.

We do not use advertising, analytics or tracking cookies, we do not build marketing profiles, and we do not sell or rent personal data. If we measure visits, we use self-hosted Plausible Analytics, which sets no cookies and counts page views without collecting personal data.

3. Why, and on what legal basis

Providing the service you ask for — marking your writing and speaking, running your account and saving your progress (Article 6(1)(b) GDPR, performance of a contract).
Keeping the service secure and available — rate limits and abuse prevention (Article 6(1)(f) GDPR, our legitimate interest in protecting the service and its users).
Meeting legal obligations — for example, keeping payment records once paid passes launch (Article 6(1)(c) GDPR).

4. Automated marking

Writing and the text of recorded speaking are marked by an AI model. The result is a practice estimate to help you study. It has no legal or similarly significant effect on you, and no authority, employer or exam body receives it.

5. Who we share data with

We use these service providers (processors) under contracts that require them to protect your data:

OpenAI, L.L.C. (USA) — AI marking of written answers and answers in the study chat. Data is processed under OpenAI's API business terms, which do not allow it to train models on this data; we ask it not to store our requests beyond its abuse-monitoring period.
Fly.io (USA, servers in Virginia) — hosting of our API and its database.
[Website host] — hosting of our website.
Stripe — payment processing, tax calculation and receipts for exam passes. We never see or store your card number.
Supabase (USA, servers in Virginia) — account authentication and confirmation or password reset emails.

Where data is transferred outside the EU/EEA or UK, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses (and the UK addendum) as safeguards.

6. How long we keep data

Account data and progress: until you delete your account.
Sign-in sessions: until you sign out or the session expires under the Supabase project settings.
Writing sent for marking: not stored if you're signed out; saved to your account until you delete it if you're signed in.
Multiple-choice mock answers: 30 days.
Study chat messages: not stored.
Account email links: until used or expired under the Supabase project settings.
IP address hashes for rate limiting: at most one day.
Exam passes: until you delete your account. Payment records are kept by Stripe as long as tax law requires.

7. Your rights

You have the right to:

access your data and receive a copy in a portable format — use Download my data in your dashboard;
have your data erased — use Delete my account in your dashboard, which deletes it immediately;
have inaccurate data corrected, and to restrict or object to processing;
complain to a data protection supervisory authority, in particular in the country where you live or work. We'd appreciate the chance to help first: privacy@semplr.com.

8. Cookies and local storage

Supabase stores the sign-in session in your browser's local storage. We also use local storage for things you ask us to remember on your device: drafts, scores, language and currency. Because none of this is used for tracking or advertising, no consent banner is needed. You can clear it at any time in your browser settings.

9. Children

Semplr is not directed at children under 16, and we do not knowingly create accounts for them.

10. Changes

If we change this policy in a way that matters, we'll update the date above and tell signed-in users before it takes effect.