1. Who is responsible
The controller of your personal information is Buk Capital LLC, Pennsylvania, United States. Privacy questions and requests: support@que-bank.com. PO Box 600, Creamery, PA 19430
2. What we collect
- Account information: first and last name, email address, password (stored hashed by Supabase), selected exam, and access dates.
- Purchase information: Stripe processes your payment and shares with us the purchase status, amount, currency, customer and checkout identifiers, and the payment method type. We never receive full card numbers.
- Quiz activity: questions answered, answers chosen, time spent, scores, mock-exam results, and the analytics we compute from them.
- Support messages: what you send us through the support form or by email, and our replies.
- Device and technical data: IP address, browser and device type, pages requested, request identifiers and error reports, collected by our hosting, security and monitoring tools.
- Analytics data (with your consent): Google Analytics collects traffic sources, pages visited, approximate location, device information, campaign performance, campaign identifiers such as UTM parameters, and plan, course, cart, signup and checkout interaction events, not passwords or full card numbers.
- Marketing attribution: UTM parameters and the referring page from the link you arrived on, stored in your browser and attached to your purchase so we know which campaigns work.
3. How we use it
We use personal information to create and secure your account, deliver the exam access you bought, save your progress and show you analytics, process payments and refunds, send transactional email, answer support requests, detect fraud and abuse, fix errors, measure which pages and campaigns work, and meet legal obligations. We do not use your data for automated decisions with legal effects, and we do not send marketing email.
4. Lawful bases (GDPR / UK GDPR)
Where European or UK data protection law applies we rely on: contract (account, access, purchases, support); legitimate interests (security, fraud prevention, error monitoring, understanding how the service is used, in ways you would reasonably expect); consent (Google Analytics cookies, which you can withdraw at any time through Cookie settings in the footer); and legal obligation (tax, accounting and responding to lawful requests).
5. Who processes data for us
We share personal information only with the providers below, under contracts that limit their use of it to providing their service to us. We also disclose information when the law requires it, to protect QueBank or its users, or to a successor if the business is sold.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication, database and account storage | United States |
| Stripe | Payment processing, receipts, fraud screening | United States |
| Klarna | Optional payment method you choose at checkout; acts as an independent controller under its own privacy policy | United States / EU |
| Vercel (including Vercel BotID, Vercel Analytics and Speed Insights) | Hosting, server logs, bot detection on checkout and password-reset requests, and cookieless aggregate page-view and performance measurement | United States |
| Resend | Transactional email (receipts, verification, password reset, support replies) | United States |
| Sentry | Error monitoring and masked session replay | United States |
| Google Analytics (GA4) | Site analytics, only after you accept analytics cookies | United States |
Vercel Analytics and Speed Insights set no cookies and do not identify you across sites; they count page views and measure load performance in aggregate.
6. We do not sell your data
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We run no ad networks or retargeting pixels. When you accept analytics cookies, Google Analytics receives usage data described above under Google's terms; Google may use it to maintain and improve its own services as described in its privacy policy. You can decline or withdraw at any time, and we honor the Global Privacy Control signal as a decline. See Do Not Sell or Share.
7. How long we keep it
| Data | Retention |
|---|---|
| Account data (name, email, exam selection) | Life of the account, then deleted within 90 days after a deletion request |
| Quiz history, answers, scores, analytics | Kept with the account; deleted with it |
| Payment records (Stripe IDs, amount, date) | 7 years, for tax, accounting and dispute obligations |
| Support messages | 3 years from the last message |
| Sentry error events and masked replays | 30 days |
| Server and security logs | Up to 90 days |
| Google Analytics data | 14 months (our Google Analytics retention setting) |
We may keep a minimal record for longer where needed to enforce our Terms, resolve a dispute, or comply with a legal hold.
8. Children
QueBank is not directed to children under 13 and we do not knowingly collect their personal information (COPPA). If we learn that an under-13 child has an account, we delete it. Learners aged 13 to 17 may use QueBank only through access purchased by a parent or legal guardian who accepts the Terms and supervises use; that guardian can exercise the rights below on the student's behalf. Report a concern to support@que-bank.com.
9. Your rights and choices
Wherever you live, you can ask us to access the personal information we hold about you, correct it, delete it, export it in a portable format, object to processing based on legitimate interests, and withdraw consent to analytics. Name and password can be changed in Settings. For everything else, email support@que-bank.com from your account address or use the support form with the "Privacy request" category. We respond within 30 days (45 days for California requests) and may ask you to confirm you control the account email before acting. Deletion details are on the Data Deletion page.
10. California residents (CCPA / CPRA)
In the last 12 months we collected the categories below for the business purposes in section 3. We disclosed them to the service providers in section 5. We did not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that require a "limit" right.
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, email, account ID, IP address | You; your device |
| Commercial information | Purchases, refund status, Stripe customer and checkout IDs | You; Stripe |
| Internet or network activity | Pages viewed, quiz actions, device and browser data, analytics events (with consent) | Your device; analytics providers |
| Education information | Exam track, questions answered, scores, study progress | You |
| Inferences | Topic strengths and weaknesses derived from your quiz history, used only to show you analytics | Derived by us |
You have the right to know, delete, correct, and opt out of sale or sharing, and the right not to be discriminated against for exercising them. We will not deny service, charge a different price, or lower quality because you made a request. To submit a request, email support@que-bank.com or use the support form; we verify requests by matching the account email and, where needed, a recent purchase detail. An authorized agent may submit a request with your signed permission, and we may still ask you to confirm it directly. We respond within 45 days and tell you if we need 45 more. Opt-out preference signals such as Global Privacy Control are honored automatically: analytics stays off in a browser that sends one.
11. EU, UK and Swiss residents
QueBank is hosted in the United States, so your data is transferred there. Our processors rely on the EU Standard Contractual Clauses and the UK Addendum (and, where certified, the EU-US Data Privacy Framework) for those transfers. You have the right to lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office, in addition to contacting us. We do not target EU or UK residents specifically, but we honor these rights when you use the service there.
12. Other US states
Residents of Virginia, Colorado, Connecticut, Nevada and other states with consumer privacy laws have similar rights of access, correction, deletion, portability and opt-out, exercised through the same contact channel; if we decline a request you may appeal by replying to our decision email, and we do not sell personal information within the meaning of Nevada law.
13. Security
All traffic is encrypted with HTTPS. Passwords are hashed and checked against known-breach lists. Access to exam content is verified server-side on every request. Payment data never touches our servers. Sentry session replay masks all text and blocks media. See the Security page for details and how to report a vulnerability. No system is perfectly secure; if a breach affects your data we will notify you as the law requires.
14. Changes
When we change this policy we update the date at the top; for material changes we also notify account holders by email or a notice on the site before the change takes effect.
15. Contact
support@que-bank.com. PO Box 600, Creamery, PA 19430