Privacy Policy

1. What we collect

• Your account: your name, your email address and your password, which is stored encrypted.
• Your practice: the answers and submissions you make, your scores, your progress, your streaks and your study activity.
• Your Writing and Speaking: the text you type and the audio you record so that it can be evaluated.
• Payments: Square, our payment provider, processes them securely. We are told that you paid, but your full card number is never stored by us.
• Technical information: your IP address and the rough location it points to (city and country); your browser, operating system and type of device; your screen size, language and time-zone settings; when you sign in; and how you reached the site (the page that referred you and any campaign tags in the link). We use this to keep the Service secure, to learn where our learners come from, and to make the Service better.

2. What we use it for

• Setting up and running your account, and providing the Service;
• Marking your practice, writing feedback and keeping track of your progress;
• Taking payments and giving you access to the plans you buy;
• Sending the account emails you need (for example, to verify your address or reset your password);
• Keeping the Service secure, stopping abuse, and improving it.

3. Automated evaluation

For Smart Evaluation of your Writing and Speaking, your submission may be passed to an outside AI processing provider, which sends back an estimated score and feedback. Only what the evaluation needs is shared. Your submissions are never sold, and they are never used to identify you in public.

4. Who we share data with

A small number of trusted providers receive limited data because they help us run the Service:

• Square, which processes payments;
• the companies that host the platform and deliver our account emails;
• an AI evaluation provider, which produces the feedback on your Writing and Speaking.

Some of these providers may handle data outside Canada. We never sell your personal information to anyone.

5. How long we keep it

Your information stays with us while your account is active and for as long as we need it to provide the Service. When you ask us to delete your account, we remove your personal information, apart from the limited records (payment records, for example) that the law requires us to keep.

6. How we protect it

Reasonable technical and organizational safeguards protect your information, among them encryption in transit and hashed passwords. No way of sending or storing data is perfectly secure, but we work to keep yours safe and deal quickly with any problem.

7. Your rights

At any time you can ask us, by email, for access to your personal information or for it to be corrected or deleted. Your account details can also be changed from your settings.

8. Cookies, analytics and recordings

Essential cookies keep you signed in and keep the Service secure. We do not use cookies that track you for advertising.

To see how the Service is used, we run our own first-party analytics. It relies on a cookie holding a random visitor identifier, kept for 13 months, and records the pages you open and how long you spend on each, your IP address and the approximate city it points to, your browser and type of device, and the page that sent you to us. This data is processed on our own servers, never goes to advertising networks, and serves only to understand and improve the Service. You can ask for it to be deleted through the contact page.

So that we can find the places where the Service is confusing or broken, we also record how a page is used: the buttons pressed, the pointer's movements, how far you scrolled, how long you worked on an answer before submitting it, and when you reached a limit or an error. A recording is a wireframe of the interaction — it never contains what is on the page, the text you type, your answers, your email address or anything you search for. Recordings are deleted automatically after 30 days, can be seen only by our own staff, and are never shared. Through the contact page you can ask us to leave your account out of recordings, or to delete the ones that exist.

The sign-in, sign-up, password-reset and checkout pages are never recorded. While you write an answer we also count how many characters were typed and how many were pasted, and how fast you typed, so that a teacher or our staff can tell a real attempt from a pasted one; this measurement keeps only those counts, never the text. In a mock exam we note how often you left the exam tab and for how long. A person looks at these figures, and they are never used to block or penalise you automatically.

Your browser holds a random identifier that lets us recognise that browser when it returns. It is not a fingerprint of your device, and clearing the site's data removes it. We use it to spot several accounts sharing one free allowance. To protect your account we also keep a record of failed sign-in attempts and password resets, and we compare the network an address belongs to with public lists of VPN, proxy and hosting ranges. Our staff see the result as a signal; it is never used on its own to refuse you access.

The emails we send carry a tiny image, and their links are rewritten; together they tell us whether an email was opened and which link was clicked, so that we know an important notice reached you. If your mail app blocks images, the open is not counted, and that is fine.

On the pricing and payment pages we use the same page steps to notice when a payment seems to be going wrong — the card form not accepting a card, your bank declining it, an Apple Pay or Google Pay window closing before it finished, or a long pause on the card form. When that happens we may show a short help message on the page, and, if you gave us your email address and did not complete the purchase, send you one email about 45 minutes later with the same help and a link back to your order (at most one such email in 7 days; the link in it turns them off). Your card details go straight to our payment processor, Square, and we never see or read them. No device fingerprinting is used. Some visitors, chosen at random, are not shown these messages, so that we can tell whether they help.

How long each kind of record is kept: interaction recordings, 30 days; sign-in records, analytics events and email delivery records, 12 months; your practice work and scores, for as long as your account exists. Through the contact page you can ask for a copy of everything we hold about you, or for it to be deleted, and we reply within 30 days.

9. Children

The Service is meant for adults preparing for one of the tests we cover and is not aimed at children. We do not knowingly collect children's information.

10. Updates to this policy

This policy may change from time to time. Whenever it does, the “Last updated” date at the top changes with it.

11. Contact

Send any privacy question or request to support@examstep.ca.