Privacy Policy

1. Who is responsible

Winkly Limited operates DrivePrepKit at driveprepkit.com and is responsible for the personal information described in this policy. This policy covers our website, accounts, learning tools and related support. It does not cover how third-party websites or services process information independently.

You can contact us about privacy or your information using the email or mailing address below.

2. Information we collect

Account and authentication information includes your email address, display name, account identifier, language and study preferences, sign-in records and the version of the terms and privacy policy you accept. For email-and-password accounts, we store a password hash rather than your password in readable form.

Learning information includes practice sessions, submitted answers, scores, progress, saved or flagged questions and access entitlements. Guest study activity may be associated with a guest session and merged into your account when you sign in. We also record service events associated with sessions and checkout to understand and operate the learning and purchase flow; these records are not necessarily anonymous.

If you buy access, we process the product purchased, amount, currency, taxes, order details, customer, payment, subscription and refund references, and status. We also retain payment-provider event records, which may contain billing information. Stripe's hosted checkout collects payment card details; our application does not store your full payment card number or card security code.

We process messages and information you choose to send when asking for support. Technical and security information may include request times, browser or device information, IP-related security records and error or audit records needed to operate and protect the service.

3. Google sign-in and Google user data

If you choose Google sign-in, Google and Firebase Authentication authenticate you. The sign-in process can provide your Google account identifier, email address and verification status, and basic profile information such as your display name or profile picture. Our account system uses a verified Firebase identity token to create or connect your account and establish a local session. We store your email address, display name and Firebase project/user identifier binding. We do not store your Google profile picture or Google API access or refresh tokens in our application database, and do not request access to Gmail messages, Google Drive files or Google Contacts.

We use Google sign-in information only to provide account access, maintain account security and support your use of DrivePrepKit. Authentication information is also processed by Google/Firebase as part of signing you in. We share this information only with providers needed to operate these functions, when required by law, or for security and abuse prevention. We do not sell Google user data, use it for advertising or use it to train AI models.

DrivePrepKit's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where applicable.

4. Why we use information

We use information to create and authenticate accounts, remember preferences, deliver and score practice sessions, save progress, provide purchased access, process billing, answer support requests, prevent misuse and investigate service errors. We also use limited public-page measurements, where configured, to understand use of the website.

Where a legal basis is required, we rely on performance of our agreement for requested services, legitimate interests in security and reliable operation where those interests do not override your rights, compliance with legal obligations, and consent where required. If processing depends on consent, you may withdraw it without affecting earlier lawful processing.

5. Cookies, local storage and analytics

We use necessary cookies and browser storage for sign-in, session security and preferences. Google/Firebase may use browser storage during authentication. Blocking or clearing these technologies can sign you out or prevent account features from working.

When configured, Google Analytics or Plausible may measure visits to public pages. Our analytics integration limits page-view events to public routes and omits URL query strings and fragments, account identifiers, submitted answers and payment details from those events. It does not intentionally send page-view events from private account, learning or administration pages. Analytics providers may receive technical information such as IP addresses and browser details when your browser connects to them; Google Analytics may use cookies.

You can manage cookies and site storage through your browser and use available browser privacy controls. These controls may affect functionality. Contact us with questions about analytics or to exercise any applicable right to object.

We use service providers for hosting and database operations, authentication, payment processing, service emails and, where configured, analytics. Google/Firebase provides Google authentication; Stripe processes payments when paid checkout is enabled and receives your account email and user/order references to associate checkout with your purchase. Providers receive the information needed for their functions and may also process some information under their own policies.

We may disclose information when necessary to comply with law or a valid legal request, protect users and the service, investigate fraud or security incidents, or establish and defend legal rights. If ownership or operation of the service changes, information may be transferred subject to applicable law and the commitments in this policy; any transfer of Google user data must also comply with Google's applicable policy. We do not sell your personal information.

Stripe Privacy Policy

7. Storage, security and retention

Information may be processed in the United States and other countries where we or our service providers operate. Their privacy laws may differ from those where you live. Where required, we use appropriate safeguards for international transfers.

We use access controls, protected sessions and other technical and organizational measures designed to protect personal information. No internet service or storage system can be guaranteed completely secure.

We retain information as needed to provide your account and learning history, meet legal and accounting obligations, resolve disputes and protect the service. Retention depends on the type of information and why it is needed; we do not promise one fixed period for all records. When information is no longer needed, we delete it or de-identify it. Backups and records required for legal, payment or security purposes may remain for as long as those purposes require.

8. Your choices, access and deletion

Depending on applicable law, you may request access to, correction, deletion or a copy of your personal information, object to or restrict certain uses, or withdraw consent. Email [email protected] from your account email, describe the request and identify your account. We may need proportionate verification before acting. Do not send passwords, payment card numbers or identity documents unless we specifically arrange a secure method where necessary.

To request account and associated learning-data deletion, state that clearly in your message. We will assess and act on requests under applicable law, explain any information we must retain and provide information about available remedies. Requests are handled through our contact address rather than a self-service deletion or export tool. You may also raise a concern with your relevant privacy regulator.

You can revoke DrivePrepKit's Google connection in your Google Account settings. Revoking the connection stops future authorized access through that connection; it does not automatically delete information already stored in your DrivePrepKit account or cancel a subscription. Contact us separately for deletion or billing cancellation.

9. Children and young learners

DrivePrepKit is a driver-knowledge study service and is not directed at young children. Use of an account requires the legal capacity or parent or guardian authorization described in our User Agreement. If you believe a child has provided personal information without the authorization required by law, contact us so we can investigate and take appropriate action, including deletion where required.

10. Policy updates and contact

We may update this policy to reflect changes to the service, data practices or legal requirements. We will update the date on this page and give additional notice or seek consent when required, including before using Google user data for a new purpose that requires consent.

For privacy questions or requests, contact Winkly Limited using the details below.