Privacy Policy
Version 1.0 · effective 8 September 2026
This policy explains what personal data PassthePSA collects, why, and what your rights are. The data controller is PassthePSA, based in the United Kingdom. Contact for all data matters: support@passthepsa.com.
1. What we collect
- Account data: your email address, a salted hash of your password (never the password itself), whether your email has been verified, and any referral code you signed up with.
- Practice data: your answers, scores, timings, flagged questions, study plan and notes, so that your dashboard and progress work across devices.
- Feedback: votes and reports you submit about questions, and any text you include.
- Payment data: which plan you bought, when, the amount, and Stripe’s reference for the payment. Card details are entered on Stripe’s pages and are never sent to or stored by us.
- Technical data: your IP address and browser details in short-lived server logs and rate-limiting counters, used to keep the Service secure.
2. Why we use it, and the legal basis
| Purpose | Basis (UK GDPR Art. 6) |
|---|---|
| Running your account, saving your progress, providing the plan you bought | Performance of a contract |
| Taking payment, managing renewals, sending receipts and renewal reminders | Performance of a contract; legal obligation (accounting records) |
| Verification, password-reset and service emails | Performance of a contract |
| Security, fraud prevention, rate limiting, preventing account sharing | Legitimate interests |
| Improving questions from your votes and reports | Legitimate interests |
| Recording your acknowledgement at checkout that access begins immediately | Legal obligation; legitimate interests (evidence of consent) |
We do not send marketing email and we do not sell or share your data for advertising.
3. Who we share it with
- Stripe (payments, subscriptions, billing portal), which acts as an independent controller for card and fraud data under its own privacy policy.
- Resend, which delivers our transactional emails.
- Vercel (hosting) and Turso (database, hosted in the AWS eu-west-1 region in Ireland).
- Microsoft 365, which hosts our support mailbox and receives an encrypted nightly database backup.
These providers process data on our instructions under written terms. Where data leaves the UK it is protected by the UK International Data Transfer Agreement, the UK addendum to the EU standard contractual clauses, or an adequacy decision.
4. Cookies and local storage
We set one cookie, psa_session, which keeps you signed in. It is strictly
necessary for the Service, so no consent banner is required. We use your browser’s
local storage to hold in-progress answers, timers and a referral code until you sign up.
We do not use analytics or advertising cookies.
5. How long we keep it
- Account and practice data: for as long as your account exists, and up to 12 months after your last sign-in, after which we may delete inactive free accounts.
- Payment records: 6 years after the payment, as required for tax and accounting.
- Session cookies and email tokens: until they expire or you sign out.
- Server logs and rate-limit counters: no more than 30 days.
- Backups: rolling, overwritten within 30 days.
6. Your rights
Under UK GDPR you can ask us to access, correct, delete or restrict your personal data, to give you a copy in a portable format, and to object to processing based on legitimate interests. To exercise any right, email support@passthepsa.com from your account address. We answer within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk, but we would welcome the chance to resolve any concern first.
7. Security
Passwords are stored as salted hashes, all traffic is encrypted with HTTPS, session cookies are marked Secure and HttpOnly, and access to the database and backups is limited to the operator. No system is perfectly secure; if we discover a breach that puts your rights at risk we will tell you and the ICO as the law requires.
8. Age
The Service is for adults: you must be 18 or over to use it, and you confirm this at checkout. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it.
9. Changes
We may update this policy. The version and date appear at the top of this page, and we will email account holders about any material change.