Privacy notice

Who is responsible for your information

ORE Q Bank is operated by [OPERATOR LEGAL NAME], based in [COUNTRY], at [BUSINESS OR CONTACT ADDRESS]. The operator is responsible for deciding how your personal information is used.

For privacy requests and support, email support@oreqbank.com. Operator registration details and any required data-protection representative: [TO BE COMPLETED, IF APPLICABLE].

Information we collect

• Account information: your name, email address, password hash, email-confirmation status, and access permissions. Passwords are stored as hashes, not readable passwords.
• Study activity: sessions, selected answers, scores, progress, question flags, and reports you submit, including optional comments.
• Security and technical information: session identifiers, email-link verification records, request times, IP addresses used to prevent abuse, and access or error logs. Browser and request information can appear in those logs.
• Support messages: your email address, correspondence, and information you choose to send us. Do not send passwords, reset links, card details, or identifiable patient information.
• Payment testing: for the designated sandbox tester only, checkout references, Stripe customer and subscription identifiers, payment status, paid-access periods, and processed event identifiers. Card details are entered on Stripe’s hosted page and are not stored by ORE Q Bank.

Why we use this information

We use account and study information to sign you in, save your work, show progress, and provide the access associated with your account. We use security information to prevent misuse and protect accounts. We use support messages and question reports to answer requests and investigate problems. Account emails deliver password-reset links, optional verification, and email-change confirmations.

Where the GDPR applies, the proposed bases for these activities are providing the service you request and our legitimate interests in securing and supporting it. Any processing required by law would rely on the relevant legal obligation. [OPERATOR TO CONFIRM THE APPLICABLE LEGAL BASES AND LEGITIMATE-INTEREST ASSESSMENT.]

Registration requires a name, email, and password; without them we cannot create an account. Question-report comments are optional. The application does not currently include advertising or marketing analytics. Study scores are calculated automatically; they are not used to make decisions with legal or similarly significant effects.

Service providers and international transfers

• Hosting: account records, study history, and the question bank are stored on the application server. Provider and server country: [HOSTING PROVIDER AND LOCATION].
• Cloudflare: website traffic protection and forwarding support emails to our inbox. It handles connection information and forwarded messages.
• Brevo: delivery of account emails, including the recipient address, message, and delivery information.
• Google: Gmail receives support correspondence. Google Drive stores backups encrypted on our server before upload.
• Stripe: hosted sandbox checkout and subscription management for the designated tester. Stripe keeps its own records separately from our application.

Provider processing countries, retention settings, contractual entities, data-processing agreements, and any applicable international-transfer safeguards: [TO BE CONFIRMED FOR EACH PROVIDER]. Provider privacy links explain their practices; they do not confirm which contracts or transfer safeguards the operator has put in place.

How long information is kept

• Account and study records: kept while your account exists. Deleting your account removes its live study history, answers, progress, flags, reports, access records, and application billing references.
• Sign-in sessions: the browser cookie lasts up to seven days from sign-in. Server session records expire after seven days without use. Signing out removes the current session; signing out everywhere invalidates all sessions.
• Account email links: reset and email-change links are valid for 30 minutes; optional verification links for 24 hours. Expiry prevents use but does not itself delete the database record. Records are removed when used, replaced, or when the account is deleted.
• Abuse-prevention counters: expire automatically at the end of their configured window, currently no longer than 24 hours.
• Backups: target a one-week recovery history on the server and encrypted offsite storage. Removal depends on successful scheduled pruning and the retained recovery history, so copies can remain longer than a week. Individual records are not removed from existing backups when an account is deleted. A final maximum retention period and preservation of deletions during recovery remain launch requirements.
• Logs and correspondence: website access and error logs currently use daily rotation with 14 retained copies; application and system logs do not yet have a fixed age limit. Final log, support-email, and provider-message retention periods: [TO BE SET AND ENFORCED]. Deleting an account does not automatically delete support correspondence or provider logs.

Your controls and privacy requests

In Account management, you can change your email, sign out everywhere, or permanently delete your account. Use password reset if you cannot sign in. Email changes require your current password and confirmation through the new inbox.

Email support@oreqbank.com with the subject “Privacy request” to request access to your information, a copy, a correction, deletion, restriction, or portability, or to object to processing. Include your account email and describe your request. We may ask for proportionate information to verify that the account is yours; never send your password or reset link.

These rights depend on the law and circumstances. Where the GDPR applies, requests are normally answered within one month. If a permitted extension is needed, we will explain it within that first month. You can complain to the relevant data-protection authority. Operator’s supervisory authority and complaint link: [TO BE COMPLETED AFTER COUNTRY IS CONFIRMED].

Browser storage and changes to this notice

See Cookies and sessions for sign-in cookies, theme preferences, and temporary exam-answer storage. We will update this page and its date when practices change. Operator details and the remaining placeholders must be completed before this draft can be treated as a final notice.