Privacy Policy

Protecting your personal data matters to MapleTest. This policy describes the data we actually collect, how we use it, and your rights under UK data protection law.

1. Data Controller

MapleTest is the controller for the processing carried out on mapletest.app. Contact: contact@mapletest.app.

2. Data We Collect

We collect only the data needed to run the service:

• Identification data: your email address and internal technical identifiers (user ID). No other civil-status data is required.
• Progress data: scores, answers, correct and incorrect questions, learning statistics, and activity dates.
• Subscription and billing data: the plan you chose, its status, the period end date, and your customer identifier at the payment provider. MapleTest does not store any card or bank data.
• Technical and security data: logs needed for security (IP address, browser type, timestamps) and strictly necessary cookies.
• Audience measurement data: only if you consent, statistics about your use of the site (pages visited, session duration, device type, approximate location, traffic source) via Google Analytics and Google Ads. See Cookies below.

3. Purposes and Legal Bases

Your data is processed to:

• Provide the service and manage your account and subscription (performance of the contract).
• Improve the user experience, ensure security, and prevent fraud (legitimate interest).
• Measure audience and the performance of our advertising, so we know which pages and campaigns are useful (consent, which you can withdraw at any time).
• Meet our legal and accounting obligations, including invoicing.

4. Retention

Account data is kept for as long as you use the service and then archived for up to three years for evidentiary purposes. Billing data is kept for the period required by accounting rules. Technical logs are kept for a limited period suited to security needs.

5. Sharing and Location of Data

Access to your data is limited to authorised people and to the processors we need: authentication (Clerk), payment (Stripe), transactional email (Resend), hosting (Vercel), database hosting (Hetzner), and — only where you have consented — audience measurement and advertising performance (Google). Each is bound by confidentiality and compliance obligations. Data is hosted on servers located outside Canada (in the European Economic Area and the United States). While stored or processed abroad, personal information may be accessible to the courts, law enforcement, and national security authorities of that jurisdiction. Cross-border transfers are protected by contractual safeguards such as standard contractual clauses. We do not sell your data.

6. Cookies and Similar Technologies

Strictly necessary cookies. These are required to operate the site, such as session management and security (including authentication via Clerk). They cannot be switched off and do not require your consent.

Analytics and advertising cookies. With your consent we use Google Analytics 4 and Google Ads, both provided by Google LLC. A banner lets you accept or decline these non-essential cookies. No Google script is loaded before you accept.

Google Analytics 4

We use Google Analytics 4 to understand how the site is used and to improve the service. It collects:

• Pages visited and navigation paths
• Session duration and bounce rate
• Device type, browser, and operating system
• Country and city (without a precise IP address)
• Traffic source (search engine, direct link, and so on)

Purchase confirmation. If you accepted analytics cookies, the confirmation of a purchase is also sent to Google Analytics from our servers, using the same measurement identifiers as your browser, so that conversion statistics are reliable. Nothing is sent if you declined.

Google Ads

We use Google Ads conversion tracking (tag AW-17961965860) to measure how effective our advertising is — for example, whether a visit that started from an ad led to a subscription. The tag is only loaded after you accept. With your consent this may also be used for remarketing audiences.

Vercel Speed Insights

Our hosting provider Vercel collects anonymous performance measurements (page load times). This sets no cookies and involves no personal identifiers; we rely on legitimate interest to keep the site fast.

Consent and How to Withdraw It

In line with the GDPR, the French ePrivacy rules (CNIL cookie guidelines) and Canada's Anti-Spam Legislation (CASL), no Google script is loaded before you explicitly accept via the banner. If you decline, Google Analytics and Google Ads are not loaded at all: they store no cookies on your device and collect nothing. Your choice is stored for a maximum of 13 months, after which you will be asked again. You can change your mind at any time using the Cookie settings link in the footer, which reopens the consent banner; withdrawing consent stops collection immediately. You can also install the Google Analytics opt-out browser add-on.

Google may process this data in the United States. Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework. For more information, see Google's Privacy Policy.

What We Store on Your Device

Analytics and advertising entries are only created after you accept. Essential entries are always present, as the site cannot work without them.

7. Security

We apply technical and organisational measures to protect your data: encryption of exchanges, access control, security logging, regular backups, and minimisation of the data collected.

8. Your Rights

The operator is established in France, so the EU General Data Protection Regulation (GDPR) applies alongside Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). You have the rights of access, rectification, erasure, objection, restriction, and portability of your data, and you may withdraw consent at any time. You can manage email preferences from your profile. To exercise your rights, write to contact@mapletest.app. Proof of identity may be requested in case of reasonable doubt. If you believe we have not handled your data properly, you may lodge a complaint with the French data protection authority (CNIL) at cnil.fr, or, in Canada, with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca or your provincial privacy commissioner.

9. Updates

This policy may change over time. Any material change will be indicated on the site, and the most recent online version prevails. See also our Legal Notice.