Privacy Notice
This notice describes what personal data apcourses.net collects, the lawful basis we rely on for each purpose, which companies process it on our behalf, where in the world it travels, and how you exercise your rights. It is written from what the site actually does. It does not describe things we do not do.
Last updated:
Two things on this page are still outstanding
The processing described below is complete and accurate. But the following are not yet settled, and we would rather show you the gap than fill it with something plausible:
- our EU and UK Article 27 representatives
- how long our server logs are kept
None of this blocks a request. Write to info@testprepeurope.com and we will answer within one month, as the GDPR requires.
1. Who is responsible for your data
The controller — the company that decides why and how your personal data is processed — is the entity below. It trades as TestPrep and operates apcourses.net.
- Legal entity
- TestPrep LLC.
- Registered office
- 777 NW 72nd Ave STE 1075, Miami, FL 33126, United States
- Türkiye office
- Acıbadem, Acıbadem Cd. No: 188 D:1, 34660 Üsküdar/İstanbul
- info@testprepeurope.com
- Phone
- +44 7862 610215
We are established outside the UK and the EEA
This is the most consequential fact on the page, so it comes first rather than last. TestPrep LLC. is a limited liability company registered in Florida, in the United States. It has an office in Istanbul, but no establishment in the United Kingdom or the European Economic Area.
Two things follow. Almost everything described below is an international transfer, covered in section 5. And because we offer services to people in the UK and the EEA from outside them, Article 27 of each regime asks us to designate a written representative there.
We have not designated one yet. We are not going to claim otherwise on a page whose entire purpose is to tell you the truth about your data. Until that changes, contact the controller directly at info@testprepeurope.com; a request loses none of its force for being sent to us rather than to a representative, and the one-month deadline applies either way. Current status: EU and UK Art. 27 representatives — TO BE COMPLETED.
2. What we collect, and how
Five things, and nothing else. We do not buy data, we do not enrich it from third-party sources, and we do not build advertising profiles.
a. When you ask us to contact you
The enquiry form collects your name, email address, phone number, the subject you are asking about and your message. It also records which page you submitted from, so we can answer in context. You type all of it yourself; none of it is inferred.
b. When you buy lessons
Payment is taken by Stripe. Stripe's checkout runs inside our page rather than redirecting you away, but your card details go to Stripe, never to us — we never see or store a card number. What reaches us is the outcome: which package, the amount charged in Euro, and Stripe's reference for the payment.
c. When you leave a comment
The name and comment you submit, held for moderation before anything appears publicly.
d. While you browse
Google Analytics 4 records the pages you visit and the broad technical characteristics of your visit — but only if you have said yes to it. See section 6. Separately, our server keeps a short-lived count of requests per IP address to stop the enquiry and comment forms, and the invitation-code check, being abused. That count is a number against an address; it is not a profile and it is not used to identify you.
e. When you create an account
An account is optional; you need one only for the student dashboard. To open one you give us your email address and a password, and, if you wish, your full name. The password passes through our server to Supabase's sign-in service, which keeps only a scrambled (hashed) form of it. We never store or log it.
Your account is a TestPrep account, not one for this site alone. Our exam-preparation sites share one sign-in system and one database, so the same email address and password also work on our other sites.
Signing in. The sign-in service records when you confirmed your email address and when you last signed in. For as long as you stay signed in, it also keeps a record of that session with your IP address and a description of your browser and device (its “user agent”). Signing out ends every session on your account, not only the one on the device in front of you.
Your account is personal and can be used in one session at a time. A new sign-in on any of our websites, from any device, closes all your other sessions, including one open on another of our websites in the same browser. If you are signed out during a test, your answers are saved and you continue where you left off after signing in again. Sharing your login, or downloading our content in bulk with automated tools (bots, scripts, scrapers), is not allowed and may lead to a warning, suspension or closure of the account.
Account security: to keep each account to one session at a time and to prevent account sharing and bulk copying of our content, when you sign in we record one-way hashed digests of your browser's user agent and of your network block (the first three parts of your IP address), your session identifier, the site you signed in on, and when a session was closed because of a sign-in on another of our sites or another device. A new sign-in to your account closes all your other sessions. We do not store your IP address or browser string themselves for this purpose and we do not use device fingerprinting. These records are deleted 90 days after last use. Legal basis: performance of our contract with you and our legitimate interest in keeping accounts secure.
Exam security: When you start a practice test or work in the question bank, we store an irreversible digest of your IP address and browser details (not the address itself) so we can spot an account that is being shared; these digests are deleted after 90 days (Art. 6(1)(f) — our legitimate interest).
What the dashboard shows. Your study streak, badges and points, your AP mock exam results, any AP practice tests and AP question bank access you have, and the certificates you have earned. Your orders on this site, found by the email address you paid with, and how many lessons are left in a private-lesson package. Streaks, badges and points are earned on our other sites, for practice questions, mock exams and, for some badges, inviting friends. Your use of this site's AP practice tests and question banks is recorded against your account, along with session records and invitation records. If you use the same account on another TestPrep site, the streak, badges and points you earn there appear here too. And if you enrolled on a group course on our Turkish site with the same email address, the dashboard lists that enrolment.
The leaderboard. The dashboard shows the five students with the most points across all TestPrep sites, not only this one, and only signed-in students can see it. Each entry shows points and the number of questions answered. Your first name and surname initial appear only if you turn this on yourself; otherwise the entry shows your place number. Our other sites show their own leaderboards from the same points.
The leaderboard in your dashboard shows your points and place. Your name (first name and surname initial) appears only if you turn this on yourself; otherwise other students see only a number in place of your name.
Invitation links. The dashboard gives you a link to share with friends. New codes are random, so they cannot be guessed. Codes made earlier, from the first letters of a name and four digits, still work, and they are much easier to guess. The check that looks a code up allows only a limited number of tries from one address, which slows guessing down but does not stop it. Anyone who opens your link sees your first name, and nothing more, on the sign-up page. When someone signs up through it, we record that they joined through you. Your dashboard then shows how many friends have joined and how many of them have bought something since, never who they are. If only one friend has joined, though, the counts tell you whether that friend has bought something. Equally, if you signed up through a friend's link, their counts change when you buy something.
The record works on our other sites too. On some of them, a friend who joined through you gets a one-off 15% discount, and once they have bought something you get one as well. Inviting friends can also earn badges and points there.
Emails. We email you only about your account: a link to confirm your address when you sign up, and a link to reset your password when you ask for one. If the confirmation email fails to send, your address is passed to our team so that someone can help you sign in.
Checks against automated sign-ups. The sign-up form looks for signs of a bot: a hidden field that people never see, a form filled in within two seconds, and the shape of the name and email address. A sign-up that fails the check is dropped and no account is created, but our server log notes the reason and a partly hidden form of the email address, so that we can find and help a real person the check caught by mistake. The password-reset form limits how many requests one email address or one IP address can make in 15 minutes, so that nobody can flood an inbox with reset emails. It keeps that count in the server's memory only, where the addresses can stay until the server restarts.
3. Why we process it, and on what lawful basis
The GDPR requires a specific lawful basis for each purpose, not one blanket justification. Ours are below. Where we rely on legitimate interests we say what that interest is, so you can weigh it.
| Purpose | Data | Lawful basis (Art. 6) |
|---|---|---|
| Answering your enquiry and arranging lessons | Name, email, phone, message | Art. 6(1)(b) — steps taken at your request before entering a contract |
| Delivering and administering tuition you have bought | Contact details, purchase record | Art. 6(1)(b) — performance of the contract |
| Taking payment and keeping the payment record | Purchase details via Stripe | Art. 6(1)(b), and Art. 6(1)(c) for the retention that accounting law requires |
| Running your account: signing you in, and showing your streak, badges, points and results | Email address, password, name, sign-in records (times, IP address, browser), study progress | Art. 6(1)(b) — providing the account you asked for |
| Sending you account emails | Email address | Art. 6(1)(b) — part of providing the account |
| Showing you on the leaderboard | First name and surname initial, points, questions answered | Art. 6(1)(f) — our legitimate interest in encouraging regular practice through a little friendly competition |
| Invitation links, and the discounts they unlock on some of our other sites | First name, invitation code; for each friend who joins through you, the fact that they did and whether they have bought something since | Art. 6(1)(f) — our legitimate interest in letting students invite friends, see how many have joined, and reward both sides |
| Deleting accounts that go unused, and keeping a record of each deletion | Internal account number, email address, when the account was opened and last used, how many mock-exam attempts went with it | Art. 6(1)(f) — our legitimate interest in not keeping accounts nobody uses, and in being able to check that the clean-up deleted only the accounts it should |
| Publishing a comment you submitted | Name, comment text | Art. 6(1)(a) — consent, given by submitting it |
| Preventing abuse of the enquiry, comment, sign-up and password-reset forms and of the invitation-code check | IP address, and for password resets the email address, as short-lived counters; on sign-up, the checks described in section 2 and a log entry when one is dropped | Art. 6(1)(f) — our legitimate interest in forms that are not flooded with automated submissions, which also protects you from being impersonated |
| Measuring how the site is used | Analytics cookies and the events they carry | Art. 6(1)(a) — consent, and only after you give it |
You can object to anything resting on legitimate interests, and withdraw consent for anything resting on consent, at any time — section 10 explains how. Withdrawing consent does not affect processing already carried out.
4. Who else handles your data
These companies process data on our instructions. They are not free to use it for their own purposes.
| Processor | What for | What it receives |
|---|---|---|
| Stripe | Taking payment, and fraud checks on it | Card details, purchase amount and reference |
| Supabase | The database holding enquiries, comments and accounts, and the sign-in service | Everything you submit through a form; your account and progress; and the IP address and browser of each signed-in session |
| Resend | Delivering your enquiry to us, and sending account emails | The contents of the enquiry; your email address for account emails |
| Vercel | Hosting and serving the site | Request data, including IP address, as any web server receives; and our server logs. These hold a partly hidden email address when the bot check drops a sign-up or a confirmation email fails, and the full address when a password-reset email cannot be created or sent |
| Upstash | The abuse-prevention counter | IP address, briefly (Primary: London, United Kingdom (eu-west-2) · Read replica: Frankfurt, Germany (eu-central-1)) |
| Analytics — only with your consent | Page views and interaction events |
Enquiries, comments and accounts sit in a database that TestPrep's other exam-preparation sites also use, and our staff work with them through a shared admin panel. Only TestPrep's authorised staff can use it.
We do not sell personal data, we do not share it with data brokers, and no advertising network runs on this site.
5. Where your data goes
We are established in the United States and our processors are spread across several countries, so if you are in the UK or the EEA your data leaves it. That is not incidental to how the service works; it is how the service works, and you should know it before you decide to use us.
Transfers to the United States and to other countries outside the UK/EEA rely on the safeguards in Chapter V of the GDPR — in practice the standard contractual clauses that our processors incorporate into their terms, and, for those certified under it, the EU–US Data Privacy Framework. You may ask us which mechanism applies to a particular processor and we will tell you.
7. How long we keep it
| Record | Kept for |
|---|---|
| Enquiry submitted through the form | 24 months from last contact, then deleted automatically |
| Payment and invoice records | As long as accounting and tax law requires, then deleted |
| Your account: email address, name, password, invitation code, when you confirmed it and last signed in | With no purchase on it, deleted automatically after 90 days without use. With one, kept until you ask us to delete it. See below |
| Sign-in sessions: IP address and browser | Until you sign out, or until the account is deleted. Closing the browser or clearing cookies without signing out leaves the record in place |
| Streak, badges, points and invitation records | As long as the account exists, and deleted with it |
| Record of an account deleted for lack of use: its internal number, email address and dates | 2 years from deletion of the account, then erased |
| Sign-in cookie | Up to 400 days, or until you sign out |
| Session-security cookies | estate_dv up to 7 days; estate_dv_chk, estate_dv_ended and estate_dv_notice up to 15 minutes |
| Server logs (see section 4) | Not yet settled. See the top of this page |
| Published comment | Until you ask us to remove it |
| Analytics events | 14 months, then deleted automatically by Google |
| Your consent choice | 180 days, then we ask again |
| Abuse-prevention counters | The enquiry and comment counters, one hour; the invitation-code check, ten minutes. The password-reset limit counts the last 15 minutes, but it sits in the server's memory, and the addresses in it can stay there until the server restarts |
The reports your tutor writes after private lessons, the lesson and weekly summaries sent to your parent, and your part of a group course's weekly report are kept until your account is deleted, and are deleted with it. Summaries already sent by email stay in the recipient's inbox.
Accounts that go unused are deleted
Once a day our system deletes accounts that are more than 90 days old and have not been used for 90 days, together with their study and test records. Confirmed email addresses receive a warning at least 14 days beforehand. Use includes signing in, using the site or dashboard while signed in, starting a mock exam, answering a practice question or adding to your streak on any TestPrep site. Using the account after the warning stops deletion. Accounts whose email address was never confirmed receive no email and are deleted only after the same 14-day waiting period.
An account is never deleted this way if it holds a purchase, access or credits granted to it, an instalment plan, a certificate or a place in a live lesson, or if it belongs to a member of our staff. Those accounts stay until you ask us to delete them. You can ask us to delete any account at any time.
Each automatic deletion leaves a short record behind: the account's internal number, its email address, when it was opened, when it was last used, and how many mock-exam attempts went with it. It is our check that the clean-up deleted only what it should. The record is kept for 2 years from deletion of the account, then erased.
For an account deleted this way, we keep a record of the deletion (the email address; the dates the account was opened, last used and deleted; the number of practice tests deleted with it) for 2 years, then erase it.
We also use this record to stop a new account opened with the same email address from getting the free trial again (the free practice test and the question bank's sample questions). Anything you buy is not affected. Our legal basis is our legitimate interest in offering the free trial once per person.
8. Students under 18
Most of our students are school age, and we expect a parent or guardian to make the arrangements. If you are under 18, please have a parent or guardian contact us rather than submitting the form yourself. The sign-up form does not ask your age. If you are under 18, open an account only with a parent's or guardian's knowledge and agreement. If we learn that we hold data about a child without that involvement, we delete it.
9. Security
The site is served over HTTPS. Enquiries, comments and accounts sit in an access-controlled database, where a signed-in student can read only their own records and can change nothing but the name and phone number on their own profile. Reading has two exceptions, described in section 2: the leaderboard, which other signed-in students see, and the first name shown to anyone who opens an invitation link. The sign-up form gives the same check-your-email response whether or not an address already has an account. Passwords are kept only in hashed form, card details never touch our systems, and the number of people who can read an enquiry or an account is small and limited to those who need to. No system is beyond compromise; if one that affects your data occurs, we will tell you and the relevant supervisory authority as the GDPR requires.
10. Your rights
Under the UK and EU GDPR you can ask us to do all of the following. You do not need a reason, and exercising a right costs nothing.
| Right | What it means here |
|---|---|
| Access (Art. 15) | A copy of what we hold about you |
| Rectification (Art. 16) | Correction of anything wrong or incomplete, including the name on your account (the dashboard does not yet let you change it yourself) |
| Erasure (Art. 17) | Deletion, including of your whole account — except where tax or accounting law requires us to keep a payment record |
| Restriction (Art. 18) | We hold it but stop using it while a dispute is open |
| Portability (Art. 20) | Your data in a machine-readable form, or sent to another provider |
| Objection (Art. 21) | An objection to anything we base on legitimate interests, such as appearing on the leaderboard |
| Withdraw consent (Art. 7) | Turn analytics off again, or ask us to unpublish a comment |
We answer within one month. There is no profiling on this site. The one automatic decision is the sign-up check in section 2, which drops a sign-up that looks automated; it has no legal or similarly significant effect on you, so Art. 22 does not arise. If you signed up and never received a confirmation email, write to us and we will look into it.
11. How to ask, and how to complain
Email is the fastest route and the one we monitor. Tell us what you want and enough detail to find your record.
- Phone+44 7862 610215
- WhatsAppMessage us
- Written request777 NW 72nd Ave STE 1075, Miami, FL 33126, United States
If you are not satisfied with our answer
You can complain to a data protection supervisory authority. In the United Kingdom that is the Information Commissioner's Office. In the EEA it is the authority for the country where you live, where you work, or where the problem happened — your choice. Complaining to them does not stop you also raising it with us, and we would rather you did both.
12. Changes to this notice
When the facts change — a new processor, a different retention period, an Article 27 representative appointed — we change this page. The date at the top is the day this site was last published, set automatically, so it can move without this notice changing. If a change materially affects how we use data you have already given us, we will tell you rather than relying on you to re-read this page.
The Turkish site apozelders.org publishes its own notice under Türkiye's KVKK, which asks different questions of us. Neither page overrides the other; each covers the site it is published on.