Privacy policy

This policy explains what personal data TocoExam collects, why it collects it, how long it is kept, and what rights you have over it. TocoExam is operated by IT Nest Limited, a company registered in Hong Kong with its registered office at 99 Queen's Road Central, Office 3906, 39/F, The Center, Hong Kong. IT Nest Limited is the data controller for the purposes of this policy and can be reached at contact@itnest.agency.

What we collect

Account data. If you create an account we store your email address, the interface language you choose, the date the account was created, and the date you last signed in. We do not store a password, because TocoExam has none: signing in always uses a one-time code sent to your email.

Study data. When you take a test we store the attempt, the questions it contained, the answers you gave, whether each answer was correct, how long you spent, your score, and the rules the attempt was scored against. We derive per-topic progress, a practice streak and a readiness score from this data. If you use TocoExam without an account, this data is linked to an anonymous key rather than to you.

Technical data. We record the IP address and a coarse browser signature for each sign-in code request, each test start and each administrative action. This is used to enforce rate limits, to enforce the daily free-test allowance, and to investigate abuse. We do not use it to build a profile of you.

Payment data. If you buy access to an examination, payment is processed by Stripe. We never see or store your card number. We store the Stripe customer identifier, the identifiers of the purchase or subscription, which examination it opens, its status and the date it runs to, the country the price was shown for, and a record of each payment so we can show you your receipts.

Reports you send. If you report a problem with a question we store the question, the reason, any comment you wrote, and whether you were signed in.

Why we collect it

Account and study data exist to provide the service you asked for: to keep your progress, to rebuild your mistake bank, and to tell you whether you are ready. Our lawful basis for this is performance of a contract with you.

Technical data exists to keep the service working and to stop abuse of the free tier. Our lawful basis for this is our legitimate interest in operating a service that is not overwhelmed by automated traffic.

Payment data exists to take and manage payment. Our lawful basis is performance of a contract and compliance with tax and accounting obligations.

Analytics and advertising data are collected only if you consent, and only after you consent. Our lawful basis is your consent, which you may withdraw at any time from the cookie settings link in the footer.

Analytics with PostHog

With your consent we measure how the site is used with PostHog, acting as our processor. The data is received and stored in the European Union (PostHog's EU cloud). What is collected: usage events (pages opened, tests started and finished, purchases, lessons and letter practice), your user identifier and email address once you sign in, your role, interface language and country, and - again only with your consent - a recording of your session in which everything you type is masked before it leaves your browser. Payment pages are not recorded, and the events travel through our own domain.

Nothing of this is collected before you allow the analytics category, and it stops the moment you withdraw consent. Usage events are kept for up to 24 months, session recordings for up to 90 days; both are deleted with your account on request.

Cookies

Strictly necessary cookies keep you signed in, keep your current test attached to you, carry the security-check result, count your free tests for the day, and remember your cookie choice. These cannot be switched off because the service does not function without them.

Analytics cookies belong to PostHog and hold a random identifier that ties your visits together, so a return visit is not counted as a new person. Advertising cookies support advertising on free pages. Neither category loads anything until you allow it: the scripts are not present on the page before consent, not merely inactive.

Your cookie choice is stored in a cookie that lasts 180 days. You can change it at any time from the cookie settings link in the footer.

Who we share it with

We use a small number of processors, each for a single purpose: Cloudflare hosts the site and stores its data; Stripe processes payments; Resend delivers the sign-in code emails; Cloudflare Turnstile performs the human-verification check; PostHog stores the consented analytics described above, in the EU. We use DeepL and the Anthropic API to help draft content in the administrative interface, and these never receive learner data. We do not sell personal data, and we do not share it with anyone for their own marketing.

How long we keep it

Sign-in codes are deleted or invalidated within 10 minutes of being issued. Sessions expire after 30 days. Attempt and progress data is kept for as long as your account exists. Guest study data is kept for 12 months from the last activity and is then removed. Audit records of administrative actions are kept for 24 months. Invoice records are kept for as long as tax law requires.

Your rights

You can ask us for a copy of your data, for a correction, for deletion, for a restriction on how we use it, or to object to our use of it. You can delete your account yourself at any time from the settings page, which removes your account, attempts, answers, bookmarks and progress. To exercise any other right, write to contact@itnest.agency and we will respond within 30 days.

If you are in the European Economic Area or the United Kingdom you also have the right to complain to your local supervisory authority.

International transfers

TocoExam runs on Cloudflare's global network, so your data may be processed in a country other than your own. Where data leaves the European Economic Area or the United Kingdom, transfers rely on the standard contractual clauses adopted by the European Commission or an equivalent safeguard.

Children

TocoExam is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, write to contact@itnest.agency and we will delete it.

Security

Sessions are identified by a random token of which only a hash is stored, so a database copy does not yield working sessions. Sign-in codes are stored as keyed hashes. Administrative access requires both a role and a separate administrative password, and every administrative action is recorded with the account, address and time.

Changes

If we change this policy we will update the date at the top of this page. Where the change is material we will tell account holders by email before it takes effect.

Contact

IT Nest Limited, 99 Queen's Road Central, Office 3906, 39/F, The Center, Hong Kong. Email contact@itnest.agency.