Privacy Policy

We collect:

• Account data — your email address, and your name if you sign in with Google.
• Usage data — your practice attempts, mock-exam results and progress, so we can show your stats and readiness.
• Billing data — your purchase history, the access pass you hold and a Stripe customer reference. We do not store your card details; all payments are handled by Stripe.
• Technical data — basic logs needed to operate and secure the Service.

To provide and personalise the Service, track your progress, process your purchases, communicate with you about your account, measure how people find us, and keep the Service secure and working.

We send study tips and offers on our passes only if you agree. When you sign up with email and password there is an unticked box, "Email me study tips and offers"; if you sign up with Google we ask once on your first page. If you leave it unticked, you get no marketing email.

If you agree, we use your email address (and your first name, if we have it) to send study tips, reminders to come back, announcements of new papers and offers on HKSI Prep passes. We record that you agreed and when.

You can withdraw consent at any time, free of charge: click the unsubscribe link in any of those emails, change the setting on our email preferences page or email us. We stop as soon as you tell us. We do not sell or give your personal data to anyone else for their marketing.

Service emails are not marketing and are sent to every account holder: password resets, your welcome and receipt emails, the email confirming your pass is active, and the notice that your pass is about to end.

We share data only with service providers that help us run HKSI Prep:

• Stripe — payment processing and billing.
• Supabase — database hosting (outside Hong Kong; the region is shown in our database settings).
• Vercel — application hosting, and anonymous page-view statistics that do not use cookies.
• Resend — sending account and service emails, and marketing emails if you opted in.
• Google— optional "Sign in with Google", and Google Ads conversion measurement (see Cookies).

We do not sell your personal data.

We use a secure, essential cookie to keep you logged in, and a cookie that remembers which LE paper you are studying.

We also use the Google tag (gtag.js) for Google Ads conversion measurement. It sets cookies that tell us whether a visit that came from one of our ads led to a sign-up or a purchase. You can block these cookies in your browser settings, or manage ad personalisation at adssettings.google.com.

We keep your data while your account is active. If you delete your account, we delete or anonymise your personal data, except where we must retain limited records (e.g. payment records) to meet legal obligations.

Under the Personal Data (Privacy) Ordinance you may request access to, or correction of, your personal data. You may also opt out of direct marketing at any time (see section 3) and ask us to delete your account. Contact us using the details below.

We use industry-standard measures (encryption in transit, hashed passwords, access controls). No system is perfectly secure, but we work to protect your data.

Privacy questions or data access and correction requests: email support@hksiprep.hk.