Privacy Policy

This policy explains how PsychPanda (“PsychPanda”, “we”, “us”) collects and uses your personal data when you use our website and question bank (the “Service”), and the rights you have. We are the data controller for that personal data. You can contact us at bookings@psychpanda.com.

1. The data we collect

• Account data — your name, email address, and a securely hashed password.
• Payment data — when you buy a pass, our payment provider Stripe collects and processes your card details. We receive confirmation of payment, the amount, and a customer reference; we do not receive or store your full card number.
• Usage data — the questions you attempt, the answers you give, your scores, streaks and progress over time, questions you flag, and any feedback you submit.
• Technical data — IP address, device and browser type, and similar information generated automatically when you use the Service, together with essential cookies (see section 3).
• Correspondence — messages you send us by email or through the site.

2. How we use your data, and our legal bases

• To provide the Service — creating and securing your account, showing content, saving your progress and analytics, and providing support. Legal basis: performance of our contract with you.
• To take payment and prevent fraud — processing your purchase and keeping records. Legal basis: performance of our contract, and our legitimate interest in preventing fraud.
• To operate, secure and improve the Service — diagnosing problems, understanding which content and features are useful, and improving question quality. Legal basis: our legitimate interests in running and improving a reliable service, balanced against your rights.
• To communicate with you — sending service messages such as email confirmation, receipts, and important notices. Legal basis: performance of our contract and our legitimate interests. We do not send marketing email without your consent.
• To meet legal obligations — for example keeping financial records. Legal basis: compliance with a legal obligation.

3. Cookies and similar technologies

We use a small number of strictly necessary cookies and equivalent local storage to keep you signed in and to keep the Service secure. These are required for the Service to work and are set on the basis of our legitimate interest in providing it. We do not use advertising cookies or sell tracking data.

4. Who we share your data with

We share personal data only with service providers who process it on our behalf, under contract, so we can run the Service:

• Supabase — database, authentication and file hosting.
• Vercel — website and application hosting.
• Stripe — payment processing.
• Resend — sending transactional email (such as confirmation and receipts).

We may also disclose data if required by law, to establish or defend legal claims, or as part of a business sale or reorganisation. We do not sell your personal data.

5. International transfers

Some of our providers process data outside the UK. Where they do, we rely on an adequacy decision or on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, so that your data receives an equivalent level of protection.

6. How long we keep it

We keep your account and usage data for as long as your account is open. If you ask us to delete your account, or after a prolonged period of inactivity, we delete or anonymise your personal data, except where we need to keep certain records (for example transaction records for accounting and tax) for the period required by law.

7. How we protect your data

We use encryption in transit, hashed passwords, access controls and reputable infrastructure providers. No online service can be completely secure, but we take reasonable steps to protect your data and to notify you and the regulator of a serious breach where the law requires.

8. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate data, or complete incomplete data;
• ask us to delete your data, or to restrict how we use it, in certain circumstances;
• object to processing that we carry out on the basis of legitimate interests;
• ask us to provide certain data to you, or another provider, in a portable format;
• withdraw any consent you have given, without affecting processing that already took place.

To exercise any of these rights, email bookings@psychpanda.com. We will respond within one month.

9. Children

The Service is intended for adults preparing for postgraduate medical examinations and is not directed at children under 18.

10. Changes to this policy

We may update this policy from time to time. If we make a significant change we will take reasonable steps to tell you. The date at the top of this page shows when it was last updated.

11. Contact and complaints

If you have a question or concern about how we handle your data, contact us first at bookings@psychpanda.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.