Skip to content
SecLern
Start free

Home · Legal

Privacy Policy

Last updated 2026-10-23

This policy explains what personal data SecLern collects, why, who handles it, and your rights. We aim to collect the least we need.

1. Who is responsible

The operator named at the bottom of this page is the controller of your personal data under UK GDPR and EU GDPR.

2. What we collect and why

  • Account data: your email address, display name and sign-in provider. We use it to create your account and keep your progress. Legal basis: contract.
  • Passwords: if you sign up with email, we store only a salted Argon2id hash of your password. The breached-password check sends just the first 5 characters of a SHA-1 hash to Have I Been Pwned, and the links we email you work once.
  • Study data: progress, answers, notes, flashcards, settings and exam dates. Most of it stays on your device. When you sign in, it syncs to your account. Legal basis: contract.
  • Billing data: plan, status, dates and a customer reference. Card details go straight to Stripe and we never see or store them. Legal basis: contract and legal obligation (tax records).
  • Support messages: what you send us and our replies. Legal basis: legitimate interests and contract.
  • Support access to your account: the site operator is the only person who can open an account in the support

panel. When you contact us, they can see your account details, plan and study progress to answer your question, and every such action is written to an internal audit log. Legal basis: legitimate interests (providing the service you asked for).

  • Product analytics: anonymous usage events such as which screens are used. Legal basis: legitimate interests. See Cookies.
  • Error reports: technical details when something breaks, so we can fix it. Legal basis: legitimate interests.
  • Emails: receipts, trial reminders and payment notices are service messages. Study reminders and progress emails only go to you if you opt in.

3. AI features and Ping

When you use Ping or an AI recap, the text you send and the lesson context needed to answer it are sent to our AI providers, OpenRouter and DeepSeek, which process it for us to return an answer. We do not send your name or email with the request. Do not put sensitive personal data into prompts. AI output is labeled in the app.

4. Who else handles your data (processors)

We use these providers to run the service. Each acts on our instructions under a data processing agreement.

  • Cloudflare: hosting, content delivery, security and the database. Also Cloudflare Web Analytics, which is cookieless.
  • Stripe: payments, invoices and refunds. Where Managed Payments is on, Stripe is also the merchant of record for your purchase and an independent controller of the data it needs for that.
  • Resend: sending service and transactional email.
  • OpenRouter and DeepSeek: AI model providers for Ping and recaps.
  • PostHog (EU region): product analytics, configured without cookies.
  • Sentry: error monitoring.

We do not sell your personal data and we do not use it for advertising. The same list is on the processors page.

5. International transfers

We are in the UK and some providers process data in the United States or elsewhere. Where data leaves the UK or EEA we rely on adequacy decisions, the UK International Data Transfer Addendum or EU Standard Contractual Clauses, as the provider supports.

6. How long we keep it

Account and study data is kept while your account is open. Support audit entries (who opened your account, what they did and why) are kept for 12 months and then deleted. When you delete your account we delete your server-side study data. We keep billing and tax records for as long as the law requires (six years for UK accounting records). Backups and logs expire on their normal schedule. Anonymous analytics are kept in aggregate.

7. Your rights

Under UK and EU GDPR you can ask to access, correct, delete, restrict or receive a copy of your data, to object to processing based on legitimate interests, and to withdraw consent where we rely on it. Export and deletion are self-service in Profile. For anything else, email us at the address below. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

8. Age

SecLern is for people aged 16 and over. If you believe a younger child has an account, tell us and we will delete it.

9. Changes

If we change how we use personal data, we update this page and tell you in the app or by email before material changes apply.

10. Contact

Privacy questions and requests: use the contact details below.