Privacy Notice

1. Who we are

This service ("PMO-CP Exam Prep") is operated by Emrah Özdemir, an individual sole trader (the "Seller", "we", "us"). Contact: emrahozdemir.is@gmail.com. We act as the data controller for personal data processed in connection with this service.

2. Categories of personal data we collect

• Account data: name, email address, hashed password, authentication identifiers.
• Usage data: quiz results, study progress, AI generation history, ratings you submit.
• Support data: messages you send us by email.
• Technical data: IP address, browser/device identifiers, log data, cookies.
• Payment-related data: for order or bank-transfer requests we collect your name, email, optional phone number, and (for bank transfers) a reference code. We do not store any card or billing-card data.

3. Purposes and legal basis

• Creating and managing your account — performance of contract.
• Providing the study and quiz service — performance of contract.
• Processing subscriptions and renewals — performance of contract / legal obligation.
• Security, fraud prevention, abuse detection — legitimate interests.
• Customer support and service communications — legitimate interests / contract.
• Product improvement and analytics — legitimate interests.

4. Who we share data with

• Banking partners — when you pay by bank transfer, your bank and ours process the transaction; we only see what they share on the transfer record.
• Hosting and backend providers (Lovable Cloud / Supabase) — hosting, database, and authentication services.
• AI providers (Google, OpenAI via Lovable AI Gateway) — to generate quiz questions on demand.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

5. Data retention

We retain account and usage data for as long as your account is active. If you delete your account or request erasure, we delete or anonymise your personal data within 30 days, except where we are required to keep it for legal, tax, or fraud-prevention purposes.

6. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent. To exercise these rights, email emrahozdemir.is@gmail.com. You also have the right to lodge a complaint with your local data protection authority.

7. Security

We apply appropriate technical and organisational measures including encryption in transit (HTTPS), access controls, and Row-Level Security on our database to protect your personal data.

8. Cookies

We use essential cookies for authentication and session management. We do not use marketing or advertising cookies. Your browser settings let you manage cookie preferences.

9. International transfers

Our service providers may process data outside your country of residence. Where data is transferred outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

10. Changes

We may update this notice from time to time. Material changes will be communicated via the service or by email.