Privacy & Cookie Policy
At sub90ESAT, published by Silicon Nomad Ltd, we treat candidate privacy with the highest academic integrity. We never sell your data, use zero third-party marketing cookies, and store all examination telemetry under strict UK GDPR standards.
Zero Ad Trackers
No Meta Pixel, Google Remarketing, or advertising cookies. Strictly privacy-first.
UK Data Residency
Supabase PostgreSQL database hosted securely in AWS London (eu-west-2).
PCI-DSS Level 1
Stripe tokenized billing. We never see or store full credit or debit card numbers.
Candidate Rights
Full UK GDPR rights: right to access, export, or erase all your practice telemetry.
1Data Controller & Contact Information
The Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) is:
For any data protection inquiries, subject access requests (SARs), or questions about how we process your exam telemetry, please reach out directly to our dedicated privacy contact at privacy@sub90esat.com.
2Lawful Bases for Processing (UK GDPR Article 6)
Under UK GDPR Article 6, we only process your personal data where we have a lawful, transparent basis to do so:
Performance of a Contract
Necessary to fulfill our service to you: creating your student account, authenticating your login, delivering timed mock exams, scoring 27-question modules, calculating split stopwatch telemetry, and providing access to your paid passes.
Legitimate Interests
Necessary for our legitimate academic and operational interests: analyzing aggregated candidate error rates to refine topic lessons, identifying common distractor traps, monitoring infrastructure performance, preventing fraud or automated scraping, and securing our software.
Legal Obligation
Necessary to comply with legal and regulatory duties: retaining transaction invoices, VAT records, and payment receipts in accordance with HM Revenue & Customs (HMRC) statutory accounting obligations.
3Information We Collect & How It Is Used
We collect only the minimum data required to deliver our high-speed exam preparation experience:
Account & Identification Data
Your email address, hashed/salted authentication credentials (managed via Supabase Auth), optional display name, account role (Student or Teacher), and subscription status (Free Diagnostic, Intensive Monthly, or Season Pass).
Exam Telemetry & Split Stopwatch Times
To train you for the 90-second exam limit, we record high-resolution pacing telemetry: total time taken per question, split stopwatch ticks, pace zone transitions (e.g. On-Pace <90s vs Overtime >90s), question flags, chosen answer options (A–H), and dry-wipe scratchpad interactions.
Distractor Traps & Mistake Bank History
We track which of the 8 canonical distractor traps (e.g. algebraic sign trap, unit mismatch, fence-post indexing) a candidate triggers. This telemetry populates your personalized Mistake Bank and feeds the Sub-90 AI Coach debrief.
Payment & Billing Data
All payment processing is handled exclusively by Stripe Payments Europe Ltd. Silicon Nomad Ltd never receives, stores, or processes full credit card numbers or CVC codes. We receive only tokenized transaction receipts, billing country, and subscription status to activate your account.
4Third-Party Data Processors & Sub-Processors
We partner with industry-leading, privacy-compliant infrastructure providers to host and operate sub90ESAT. All partners process data under strict Data Processing Agreements (DPAs) compliant with UK GDPR:
| Processor | Role & Service | Location & Residency | Compliance Standard |
|---|---|---|---|
| Supabase Inc. | Relational PostgreSQL database, Row-Level Security, Auth session management | AWS EU London (eu-west-2) | SOC 2 Type II, AES-256 encryption at rest, TLS 1.3 in transit |
| Stripe Payments Europe Ltd. | Payment checkout gateway, invoice billing, subscription lifecycle management | United Kingdom & European Union | PCI-DSS Level 1 Service Provider (Highest industry certification) |
| Vercel Inc. | Edge content delivery network, Next.js serverless application hosting & analytics | Global Edge CDN with UK Edge nodes | SOC 2 Type II, ISO 27001, Cookie-less anonymized telemetry |
| Google Cloud (Gemini AI API) | Sub-90 AI Coach Socratic hints & post-diagnostic pacing analysis | Secure Google Cloud data centers | Anonymized question metadata only. Zero personal candidate identity transmitted. |
5Cookie & Local Storage Policy
Our Clean Privacy Promise: Zero Third-Party Advertising Cookies
We despise intrusive tracking. sub90ESAT does not use Facebook Pixels, TikTok tracking tags, Google Ads remarketing beacons, or any third-party behavioral profiling trackers. We use only strictly necessary session tokens and local browser storage keys required for platform functionality.
Storage Keys & Their Purpose:
6Your Candidate Rights Under UK GDPR
As a user in the United Kingdom or European Economic Area, you enjoy comprehensive statutory rights under UK GDPR:
1. Right of Access (Subject Access Request)
You have the right to request a complete copy of all personal data and practice telemetry we hold about you.
2. Right to Rectification
You have the right to request correction of any inaccurate or incomplete personal information in your account.
3. Right to Erasure (“Right to be Forgotten”)
You have the right to request permanent deletion of your account, telemetry records, and mistake bank entries.
4. Right to Data Portability
You have the right to obtain your practice scores, stopwatch telemetry, and study history in a structured, commonly used JSON format.
5. Right to Restrict Processing
You have the right to request that we temporarily freeze or restrict processing of your data while a dispute is resolved.
6. Right to Object
You have the right to object to processing based on our legitimate interests at any time.
To exercise any of these rights, email privacy@sub90esat.com. We respond to all verified statutory requests within one calendar month, free of charge.
7Right to Lodge a Complaint with the UK ICO
If you believe that Silicon Nomad Ltd has processed your personal data in violation of UK data protection laws, we ask that you contact us first at privacy@sub90esat.com so we can resolve the issue immediately.
However, you always have the statutory right to lodge a formal complaint with the UK supervisory authority:
8Data Retention & Security Architecture
We retain candidate telemetry and study records for as long as your account remains active or until you request deletion. Upon account deletion, all personal telemetry is permanently purged from our database or irreversibly anonymized for aggregate benchmark statistics.
In compliance with UK tax laws (HMRC), invoice and payment transaction records are retained for six (6) years following the financial year in which the transaction occurred.
Our infrastructure employs defense-in-depth security: strict PostgreSQL Row-Level Security (RLS) ensuring students can only ever view their own telemetry, TLS 1.3 encryption across all network transfers, AES-256 database volume encryption, and zero client-side answer key leakage architectures.
Read our Terms of Service
Review our fair cancellation policy, UK Consumer Contracts Regulations 2013 disclosures, and pass pricing.