Privacy Policy

1. Scope

This Policy applies when you visit ATSA Practice Tests, create or use an account, use free or paid training features, make a purchase, receive service or account follow-up communications, or interact with our online services.

2. Information we collect

Depending on how you use the Service, we may collect:

• Account information: first name, last name, email address, account identifiers, account creation date and securely hashed password information.
• Training information: modules used, session dates and times, answers, scores, accuracy, response times, progress, review data, history and other performance information needed to provide the training and Performance Center.
• Access information: free-demo usage, access status, activation and expiration information, and records used to determine which features your account can use.
• Payment records: PayPal order and capture references, payment status, amount, currency, timestamps and access-grant references. We do not store your full payment-card number or card security code in our application database.
• Email delivery information: the type of service or account follow-up email sent, recipient address, delivery-provider reference, delivery status, timestamps and limited error information used to prevent duplicate messages and troubleshoot delivery.
• Analytics information: pages viewed, navigation and interaction information, referral or traffic-source information, and technical information such as browser, device and approximate geographic information collected through Google Analytics.
• Technical and security information: session cookies, request information and security data used for authentication, fraud prevention and rate limiting. For example, technical identifiers derived from IP address and account email may be hashed and used to prevent repeated login abuse.

3. How we use information

We use personal information to:

• create and authenticate your account;
• provide free-demo and paid access;
• save training sessions, calculate performance information and show progress over time;
• create, verify and reconcile payments;
• understand website traffic, page usage and navigation patterns so we can measure and improve the Service;
• send transactional service communications such as account welcome messages, purchase confirmations, password-reset and security notices, and reminders about the expiration of paid access;
• send a limited account follow-up offer when a free/demo account has been created but complete paid access has not been activated;
• prevent fraud, account abuse, unauthorized access and security incidents;
• maintain, troubleshoot and improve the Service;
• respond to support, account and legal requests;
• comply with legal, accounting and regulatory obligations.

Where privacy law requires a legal basis, processing may rely on performance of our contract with you, legitimate interests in operating, measuring and securing the Service, compliance with legal obligations, or consent where consent is specifically required.

5. Cookies, analytics and browser storage

We use essential technical storage necessary for the Service to function. This includes a secure authentication session cookie used to keep you signed in. If you choose the "keep me signed in" option, the authentication session may remain valid for up to 30 days unless it expires or is cleared earlier.

We also use Google Analytics to understand how visitors reach and use the Service. Google Analytics may use cookies or similar browser technologies to measure page views, navigation, traffic sources and technical usage information. Where applicable law requires consent for analytics technologies, we will handle their use subject to those requirements.

The training interface may also use browser storage or temporary client-side state to support session functionality and performance features. Essential authentication storage is required for signed-in functionality and is distinct from analytics technologies.

6. Service providers and sharing

We do not sell personal information. We may share information only as reasonably necessary to operate the Service, including with:

• Cloudflare, which provides infrastructure, hosting, database and security services used by the application;
• PayPal, which processes payments and payment-related information;
• Resend, which delivers transactional account, payment, security, access and limited account follow-up emails on our behalf;
• Google Analytics, which provides website traffic and usage measurement services;
• professional advisers, authorities or other recipients when required by law, necessary to protect rights or security, or needed to address fraud or misuse;
• a successor or purchaser in connection with a legitimate merger, acquisition, restructuring or sale of the Service, subject to applicable privacy law.

7. International processing

Our service providers may operate infrastructure or process information in more than one country. As a result, information may be transferred to or processed outside the country where you live. Where applicable law requires safeguards for international transfers, we rely on appropriate provider and legal mechanisms.

8. Data retention

We retain information for as long as reasonably necessary to provide the Service, maintain account and training history, secure the platform, resolve disputes, prevent fraud and meet legal or accounting obligations.

Authentication sessions and password-reset links expire automatically according to their configured duration. Other records, including payment, access and email-delivery records, may need to be kept longer where required for transaction verification, accounting, security, legal compliance or dispute handling. Analytics retention is also subject to the settings and retention controls configured with our analytics provider.

9. Security

We use technical and organizational measures designed to protect account information, including secure session cookies, password hashing, one-time expiring password-reset links, login rate limiting, access controls and payment verification. No internet service can guarantee absolute security, but we work to reduce reasonably foreseeable risks.

10. Your privacy rights

Depending on the law that applies to you, you may have rights to request access to personal information, correction, deletion, restriction, objection, portability, or withdrawal of consent where processing is based on consent.

Some information may need to be retained where required by law, for transaction records, fraud prevention, security, dispute resolution or other legitimate legal purposes. Exercising privacy rights does not affect any non-waivable consumer rights.

11. Third-party websites

The Service may link to third-party websites or services. Their privacy practices are governed by their own policies, not this Privacy Policy.

12. Changes to this Policy

We may update this Privacy Policy when our services, providers, legal requirements or data practices change. The updated Policy will display a revised "Last updated" date.

13. Contact

For a privacy request or question about this Policy, contact us through the customer-support channel associated with your account or purchase communications. We may need to verify your identity before completing certain privacy requests.