Privacy

Data and purposes

We process account email addresses, one-use sign-in challenges, essential session identifiers, answers, attempts and deadlines, bookmarks, lesson progress, optional target date and scratch notes, contractual consent, per-account free-trial eligibility, billing references and support requests. Study records are private to the signed-in learner. Do not enter patient information, identity documents, health/accommodation evidence or unnecessary personal data. We do not need your date of birth or school records. Processing supports the requested service and contract, legal billing obligations and security legitimate interests.

Storage and access

Study payloads and account email/key fields use server encryption at rest; HTTPS protects transmission. This is not end-to-end encryption: authorised support can decrypt records. The transactional email outbox, billing/declaration records and necessary host logs may contain contact and contract data outside the encrypted study payload. Secure HttpOnly SameSite session cookies last up to seven days. No third-party fonts or cloud AI are used. Optional ad measurement is described below. No automated admissions or clinical decisions are made.

Providers and retention

Stripe processes payment details on its hosted service; we retain scoped order, subscription and contractual consent references, not full card data. SendGrid processes sign-in and transactional confirmation emails. The established Labs host stores service data and security logs; host backup geography and exact backup deletion timing remain unconfirmed. Email/payment providers may process data internationally under their applicable contractual transfer safeguards. Study records remain until you remove them, erase study data or request account deletion. Billing/contract records may be retained for up to six years as required for accounting, disputes and legal obligations; backups can persist under host schedules. Expired sign-in challenges are cleaned up; requested-link email outbox entries are removed after use/expiry cleanup.

Your choices and rights

Export study records, remove completed attempts, erase study records, sign out all devices, cancel renewal or contact [email protected] to request account deletion, access, correction, restriction, objection or portability where applicable. Erasure does not cancel a subscription; cancellation does not erase study history. We do not sell your information. You may complain to the UK Information Commissioner or your local supervisory authority. Protect your email account and sign-in links. Official-resource links open external sites under their own privacy policies.

Optional advertising measurement

Updated 23 October 2026. With your permission, Yolleg Ltd uses a first-party cookie and storage to remember the Google advert that brought you here and measure consented visits, sign-ins, checkout starts, free trials and verified payments. We share the advert click identifier (GCLID, GBRAID or WBRAID), event time, an opaque transaction identifier and actual transaction value/currency with Google Ads. We do not send your email, contact details, practice answers, health information or workspace contents for advertising measurement. Ad personalisation is not enabled by this integration.

The measurement cookie is Secure, HttpOnly and SameSite and lasts up to 90 days. Click identifiers are encrypted on our protected server and expire within 90 days; deduplicated event records are retained for up to 180 days. Your browser saves your permission choice for up to 90 days, or a refusal for up to 180 days. Google processes shared data under its own privacy terms and may process it internationally. The basis for this optional processing is your consent.

Choose Allow measurement or No thanks. Refusal does not limit the app, sign-in or purchases. Change or withdraw your choice through the Ad measurement control in the footer. Withdrawal stops new collection and pending sharing; data already processed by Google may remain in its reports. Global Privacy Control is respected. Contact [email protected] about access or deletion. Change ad measurement choice · Google Privacy Policy.