Privacy notice

Who controls your data

LexVerity Legal Limited is the data controller for the personal data described in this policy. If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. If you are in the European Economic Area, the EU GDPR applies. If you are in Pakistan, please read the International transfers section below.

What we collect, in short

• On this device (always): your progress, scores, error log and preferences, kept in this browser’s local storage. Never sent anywhere unless you sign in.
• In your account (only if you sign in): your profile (display name, country), subscription tier, and your progress (so it syncs across devices).
• Collaboration (only if you use it): friend requests and your friend list, plus any highlight, note or score you choose to publish, are visible to your accepted friends, never to anyone else.
• No advertising, analytics or third-party tracking cookies are set by this app.

Why we process it, and our legal basis

• Contract: to create your account, keep your progress in sync across devices, and provide the plan you signed up for.
• Consent: for anything opt-in, such as browser notifications for the daily reminder. You can withdraw consent at any time.
• Legitimate interests: keeping the service secure and working as intended, preventing abuse of shared features, and identifying which account a leaked copy of paid content came from (see the per-account watermark in Terms & Subscription). We balance these interests against your rights and will provide our assessment on request.
• Legal obligation: where we must retain or disclose data to comply with the law, for example tax, accounting or a valid legal request.

AI features and your data

Our study content is prepared using AI to extract and organise legal material, and is reviewed by legally qualified professionals before it forms part of the service. This content preparation does not involve your personal data. The application does not currently provide a live or interactive AI feature, and we do not use AI to make any decision that produces legal or similarly significant effects about you. If we introduce a live AI feature in the future, we will update this policy to explain what is processed, and will not use your personal data to train third-party foundation models.

Who processes your data

We use the following processors under written data-processing agreements, each processing personal data only on our instructions: Supabase (account database, authentication and, where used, file storage), hosted in the United States (AWS region us-east-1, Northern Virginia); and our payment provider (payment processing, once payments are live), which we will name here when payments are switched on.

International transfers

Our account database is hosted in the United States (AWS region us-east-1). This means that if you are in the United Kingdom or the European Economic Area, your account data is transferred to the United States as part of normal operation of the service. For those transfers we rely on an appropriate safeguard, namely the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses (together with any additional measures required), so that your data continues to receive a level of protection consistent with UK and EU data-protection law. You can ask us which mechanism applies to a given transfer.

We apply the same baseline of protection to every user, wherever you are located, rather than a lower standard for users outside the UK and EEA. Where your local law gives you additional rights, those continue to apply.

Cookies and local storage

See the Cookie Policy for the full detail. In short, we use only essential storage: your session (so you stay signed in) and your study progress and preferences. We do not use advertising, profiling or third-party tracking cookies.

How long we keep it

We keep your account data for as long as your account is active. You can request deletion at any time from Account settings; once actioned, we delete your account data within 60 days, and deletion is permanent. If your account stays inactive for 24 months, we will contact you and then delete the account if it remains inactive. We keep transaction and accounting records for 6 years, as required by UK tax law, even after an account is closed. Data held only on your device remains until you clear it.

Your rights

Subject to the UK GDPR and, where it applies, the EU GDPR, you can ask us to give you access to your data, correct it, erase it, receive a portable copy of it, restrict or object to some processing, and withdraw consent where processing depends on it. You will not be subject to a decision producing legal or similarly significant effects based solely on automated processing. Contact us using the details above to exercise any of these. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

Children

This app is aimed at adults preparing for a professional legal qualifying assessment, and is not directed at children. We do not knowingly collect personal data from children. If we learn a child's personal data has been collected without appropriate consent, we will delete it.

Security, stated honestly

We use row level security so an account can only read and write its own rows, encrypt data in transit, and apply a per-account watermark to learning pages as a deterrent against copying. These are real, specific controls, stated plainly. No online service can honestly claim to be fully secure, and we do not make that claim; we take reasonable and appropriate technical and organisational measures. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the ICO, and you where required, within the timescales the law requires.

Changes to this policy

We may update this policy as the service changes. Material changes will be shown here with an updated date, and, where the change is significant, we will take reasonable steps to bring it to your attention.

This marketing site

This site (the pages you are reading now, separate from the study application) also makes a single lookup of your approximate country, from your IP address, to a third-party geolocation service, so the right currency (GBP or PKR) can be shown on our pricing pages by default; if that lookup is unavailable, your browser's timezone is used as a fallback. See the Cookie Policy for how the result of that lookup is stored. This site does not set advertising or tracking cookies, and we do not sell personal data.