Privacy Policy

Last updated: 28 July 2026

This policy explains what personal data TMUABoost ("we") collects, why, and your rights over it. We are the data controller. It is written to reflect the UK GDPR and the Data Protection Act 2018.

1Who to contact

Data controller: TMUABoost. For any privacy question or to exercise your rights, email tmuaboost@gmail.com.

2What we collect

Category	Examples
Account	Name, email, and a securely hashed password.
Study data	Your target band, exam date, answers, scores, timings, and progress.
Payment	Handled by Stripe. We receive confirmation and limited details (such as the last four digits and billing country); we do not store your full card number.
Technical	IP address, device and browser type, and cookie identifiers.

3Why we use it, and our lawful basis

To provide the service (accounts, practice, predicted scores), performance of our contract with you.
To take payment, performance of our contract and compliance with legal obligations.
To improve the service and keep it secure, our legitimate interests.
To send marketing or study-tip emails, your consent, which you can withdraw at any time.
To meet legal and accounting obligations, compliance with the law.

4Cookies

We use essential cookies to run the site and keep you signed in. We do not use advertising or third-party analytics cookies. You can manage cookies through your browser settings.

5Who we share it with

We do not sell your data. We share it only with service providers who process it on our behalf under contract, such as:

Stripe, payment processing;
Supabase, account, database, and authentication emails;
Vercel, hosting and running the service.

We may also disclose data where required by law.

6International transfers

Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or Standard Contractual Clauses.

7How long we keep it

We keep your account and study data while your account is active and for up to 12 months afterwards, and payment records for as long as tax and accounting law requires (usually 6 years). Then we delete or anonymise it.

8Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, or object to our use of your data, to data portability, and to withdraw consent at any time. To exercise any of these, email tmuaboost@gmail.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and hashed passwords. No system is perfectly secure, but we take reasonable steps to keep your information safe.

10Younger users

The service is intended for users aged 16 and over. We do not knowingly collect data from children below that age.

11Changes

We may update this policy. We will post the new version here and, for significant changes, let you know by email or in the app.

12Contact

Email tmuaboost@gmail.com with any questions about your data.