Privacy policy

This policy explains what personal data GAMSAT Pro (“we”) collects, why, who processes it for us, how long we keep it and your rights. The controller is the operator of GAMSAT Pro (legal entity to be confirmed) [to be confirmed: legal entity name, registered address and, if required, EU/UK representative]. Contact us at support@gamsatpro.com.

Summary

• We collect what we need to run your account, your practice and your payments. With consent, we also measure which of our ads lead to product use and purchases.
• We do not sell personal data and we do not use advertising or cross-site tracking cookies.
• Payments are processed by Polar, our merchant of record. Card details go to Polar and its payment processor, never to us.
• Website analytics provide aggregate usage figures. Optional product analytics help us understand signup, practice and purchase journeys when you allow them.

What we collect and why

Your account

Accounts use Neon Auth. You sign in with an email code, or with Google if enabled. Neon stores your email address, and your name and profile image if you sign in with Google, plus sign-in records needed for security. Inside our app your learner id is your Neon Auth user id. Legal basis: performance of our contract with you.

Onboarding answers

When you start, we ask whether and when you have sat GAMSAT, optional self-reported section scores, and the sitting you are aiming for. We use them to set up your practice (for example the countdown and the exam pass), and in aggregate to understand how our practice compares with the real exam. Self-reported scores are optional. Legal basis: contract, and our legitimate interest in improving the product.

Practice and writing data

We store your answers, hints and solutions viewed, confidence, timing, flags, timed-block results, and the essays and revisions you write, so you can resume work, review answers and feedback, and see your progress and timing metrics. Essays you submit for feedback are sent to an AI model provider to generate qualitative feedback (see “Who processes data for us”). Legal basis: contract. We do not retain a separate essay research archive or use your essays as public examples or model-training material without a separate explicit opt-in. Please avoid including identifying or sensitive personal information about yourself or others in essays.

Ratings after practice units

After a practice unit you may optionally rate its difficulty compared with the real exam (1–5), its realism (1–5), optionally the difficulty of each question, and leave a free-text comment. Together with the separate account-free calibration study described below, these ratings help us calibrate question difficulty. They are stored against your learner id, seen only by our team, and reported only as anonymous totals. Individual ratings are deleted automatically 24 months after you submit them; after that we keep only anonymous per-unit totals. You can ask us to delete them at any time. Legal basis: legitimate interest in checking that our questions are realistic, which you can object to.

The calibration study (/calibrate)

Our blind difficulty study does not use accounts, but its token and optional answers can still be personal data. It sets one cookie holding a random token (we store only a hash of it), and records what you choose to tell us (an optional display name, the year you sat GAMSAT, optional self-reported scores) with your answers, times and ratings. The same 24-month rule applies: individual responses are deleted 24 months after submission and folded into anonymous per-item totals, and you can delete your responses yourself from the study's thank-you page. We do not store IP addresses for the study; rate limits use salted hashes that are discarded within a day.

Payments

Payments are processed by Polar (Polar Software, Inc., polar.sh) as our merchant of record: Polar is the seller of record for your purchase, takes the payment through its hosted checkout and customer portal, calculates and collects VAT or GST, and issues your receipts and invoices. Polar (and the card processor it uses) collects your name, email address, billing country or address, any tax id you enter and your card or other payment details, and processes them under its own privacy policy, including as controller for its own payment, fraud-prevention and legal-compliance activities. We never see or store your card details. We share with Polar your learner id, so your purchase is linked to your account, and your email address to prefill checkout. We store your Polar customer id and your subscription or pass status, currency, amount and expiry date, so we can give you access and handle support. Legal basis: contract, and legal obligations for tax and accounting records.

Early-access email list

If you join the email list, we store your email address, the consent wording you agreed to and when, the page you signed up from and your selected currency. We use it to send early-access news, launch offers and occasional preparation tips. Legal basis: consent, which you can withdraw at any time by unsubscribing or emailing us. We keep the active mailing-list entry until you unsubscribe, ask us to delete it, or 12 months after public launch, whichever comes first. A minimal suppression record may be retained to honour an opt-out. No campaign email provider has been selected yet; we will update this notice before using one. You can unsubscribe by emailing our support address.

Website analytics

Vercel Web Analytics is used to count page views and see which pages and referrers are useful. It sets no cookies and stores nothing on your device. Visitors are counted using a hash of the request that is discarded after a day, so it cannot follow you across days or websites. We see aggregate figures only (pages, referrers, country, device and browser type). Legal basis: legitimate interest in understanding how the site is used.

Vercel Speed Insights measures page loading speed, responsiveness and visual stability across the website and application to help us improve performance.

With your consent, we also use PostHog to understand signup, onboarding, practice and purchase funnels. PostHog stores a pseudonymous browser identifier in local storage and links it to your internal account ID when you sign in. We send named page categories and actions, such as reading guides, trying sample questions, completing onboarding or opening checkout, with limited properties such as public content IDs, scroll milestones, plan and currency. On the homepage, we also recognise a fixed list of our campaign and ad labels to measure which ads lead to product use and purchases. These PostHog events do not include advertising click identifiers and are not sent to advertising platforms. We do not send email addresses, sign-in codes, practice answers, essays, full URLs or query strings, and session recording is disabled. Your initial payment confirmation is measured from our payment provider when analytics was allowed at checkout; renewals are excluded. Legal basis: consent. Use “Analytics preferences” at the bottom of any page to decline or withdraw consent for future browser tracking. Declining does not affect your access. Browser Do Not Track is respected. Analytics can be incomplete when people decline or use blockers.

With your separate permission, Google Ads measures completed signups after onboarding. The Google tag may use advertising cookies, click identifiers and page information to attribute a signup to an ad. We send a random conversion identifier to prevent duplicates, plus a nominal value of EUR 1; this is not a payment. We do not send your email, account ID, practice answers or essays in the conversion event. Personalised advertising is disabled. You can decline or withdraw this permission in “Analytics preferences”; Do Not Track is respected.

Cookies and local storage

Cookies needed for the site to work include: sign-in cookies used by Neon Auth, the calibration-study token, and gp_currency, which remembers the currency you picked on the pricing page. The gp_analytics cookie remembers your optional analytics choice for one year. PostHog's analytics identifier is stored locally only after you allow analytics. The gp_ads cookie remembers your separate advertising-measurement choice for one year. Google advertising cookies are enabled only when you allow that measurement.

Security and abuse prevention

Our hosting provider processes IP addresses in server logs for security. For rate limiting we store only salted hashes of addresses, deleted within a day.

Who processes data for us

• PostHog: optional product analytics for users who consent.
• Vercel: website and application hosting, web analytics and performance monitoring.
• Neon: our Postgres database, accounts and sign-in.
• Polar: merchant of record for payments (checkout, VAT/GST, receipts, invoices and the customer portal).
• OpenRouter and the AI model provider it routes to: generating writing feedback from your essay text. We send the essay, task and rubric, plus an opaque hashed user tag for abuse monitoring; we do not attach your account name or email. The essay itself may contain personal information you choose to write. [to be confirmed: confirm provider data-retention settings]
• Email: Neon Auth sends sign-in codes through the configured transactional email service. No provider is selected for early-access campaigns; we will name it here before sending campaigns.

Some of these providers process data outside the UK, EU or Australia, mainly in the United States. Where that happens we rely on the safeguards they offer, such as the EU Standard Contractual Clauses, the UK Addendum and the EU–US Data Privacy Framework [to be confirmed: confirm for each provider].

How long we keep data

• Account, onboarding and practice data: while your account is open, then removed from active systems within 30 days of a verified closure request. This includes essay drafts, revisions and feedback. Requests are handled manually via support.
• Ratings and calibration responses: 24 months after submission, then only anonymous totals.
• Payment records: the minimum records required for tax and accounting, normally six years after the relevant accounting period, or longer where legally required. Polar keeps its own records. These records do not require retaining your essays or answers.
• Early-access mailing-list entries: until withdrawal or 12 months after public launch, whichever is earlier; minimal opt-out records as needed.
• Backups: deleted data can remain in restricted backups until they expire; we reapply deletions if a backup is restored. [to be confirmed: confirm the configured backup expiry before launch].

Your rights

Depending on where you live (for example under the GDPR in Ireland and the EU, the UK GDPR, or the Australian Privacy Principles), you can ask to access, correct, delete or export your data, object to or restrict some processing, and withdraw consent. Email support@gamsatpro.com. You can also complain to your data-protection authority, such as the Data Protection Commission (Ireland), the ICO (UK) or the OAIC (Australia).

Children

GAMSAT Pro is for people preparing for graduate-entry admission tests and is not intended for anyone under 18.

Changes

We will update this page when our practices change and, for significant changes, tell signed-in users before they take effect. See also our terms of service.

GAMSAT Pro is an independent product. It is not affiliated with or endorsed by ACER (the Australian Council for Educational Research), which owns the GAMSAT trademark.