Home30 June 2026 · v1.1

Privacy Policy (United Kingdom)

CogniHex Limited · contact@cognihex.com · ExamAlly · Document version 1.1 · Effective date 30 June 2026

Company details: CogniHex Limited is registered in England and Wales with company number 16595626. Its registered office is recorded at Companies House and can be viewed on the public register. VAT registration is pending; a VAT number will be displayed once confirmed. Legal enquiries: contact@cognihex.com. Product support: support@cognihex.com.

This Privacy Policy explains how CogniHex Limited collects and uses personal data in connection with ExamAlly. It forms part of the legal information made available alongside the Terms of Service and Cookie Policy.

1. Personal data we collect

  • Account data: email address, account ID, authentication details, settings, preferences, and consent records.
  • Learning data: practice attempts, answers, scores, timings, progress, saved-question and flashcard selections, deck names, report-issue messages, and in-app analytics.
  • Billing data: purchase status, Stripe identifiers, plan/access period, discount information, and limited payment metadata (not full card numbers).
  • Support data: messages and records needed to respond or investigate abuse.
  • Technical and security data: IP address, device/browser information, logs, session events, and audit events.
  • Website analytics (with consent): Google Analytics 4 data. Google Analytics 4 does not log or store individual IP addresses according to Google’s GA4 documentation. GA4 may use IP-derived information transiently for approximate location and related analytics signals. ExamAlly does not send account email, internal user ID, or learner profile data to GA4.

2. Why we use personal data

  • Provide ExamAlly (accounts, practice tools, progress, support, purchases).
  • Contract and billing (Stripe, purchase confirmation, fraud prevention, accounting).
  • Security and abuse prevention.
  • Improve the Service (aggregate use, bug fixes, performance).
  • Legal compliance.

3. Lawful bases

  • Contract, legitimate interests, legal obligation, and consent (non-essential cookies/analytics and future marketing if introduced).

4. Children and young users

ExamAlly is intended for students aged 16 and over. Users under 16 may use the Service only with parent or guardian approval and supervision. Users under 13 must not create an account unless a parent or guardian has approved and supervised their use.

5. AI and learner data

ExamAlly does not use third-party AI providers for live tutoring, marking, or personalised feedback to learners, and learner personal data is not sent to third-party AI providers for those purposes. CogniHex may use AI tools internally for content creation and quality review. See the AI and Content Transparency Policy.

6. Processors (who we share with)

  • Google Cloud Platform/Firebase: hosting, authentication, database, logging, and related infrastructure.
  • Stripe: payment processing when you purchase Premium access.
  • Google Analytics 4: website analytics where you have given analytics cookie consent.
  • Resend: transactional emails (welcome and purchase confirmation) when email is enabled.
  • Performance tracing: OpenTelemetry or similar backend tracing where configured for reliability monitoring.
  • Professional advisers, regulators, or law enforcement where necessary.

7. International transfers

Some providers may process data outside the UK. Where safeguards are required, CogniHex relies on lawful mechanisms such as UK International Data Transfer Agreements, the UK Addendum to Standard Contractual Clauses, or processor terms providing appropriate safeguards.

8. Retention

  • Active account data is retained while the account is active.
  • After account closure, learning data is retained for up to 36 months, then deleted or anonymised unless law requires longer.
  • Purchase, tax, and legal records may be retained longer where required by law.
  • Backups may retain data for a limited additional period before rotation.

9. Your rights

You may request access, correction, deletion, restriction, portability, or objection where applicable. Contact contact@cognihex.com. You may also use the in-app data export in your profile where available. You may complain to the ICO.

10. Cookies

See the Cookie Policy. Change analytics consent via Cookie preferences in the footer.

Contact

CogniHex Limited
contact@cognihex.com (legal and privacy)
support@cognihex.com (product support)