Privacy notice
Last updated 24 August 2026
Police Exam Workspace is run by one person. This notice says plainly what is collected, why, how long it is kept, and what you can ask for. It is written to meet the UK GDPR, and it is short because very little is collected.
Who is responsible
The data controller is A Large Company Ltd, registered in England & Wales, company no. 17290014, at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
For anything to do with your data, email alexander@alargecompany.com. A real person reads it.
What is collected, and why
| What | Why | Lawful basis |
|---|---|---|
| Your email address, given at checkout or when you create or use an account | To create and secure your account, link it to your purchase, send account and access emails, answer support emails, and issue refunds | Performance of our contract |
| Your sign-in information — a password verifier held by Supabase, or your Google account identifier, email, name, and profile picture if you choose Google | To confirm your identity and sign you in. We cannot see your password | Performance of our contract |
| Your account identity and purchase record — account identifier, Stripe order reference, entitlement, and a one-way hash of any access code | To let your account or code log you in, stop refunded access being reused, and keep the company's accounts | Contract, and legal obligation for accounting records |
How you first reached the site in that browser tab — utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, gbraid, wbraid, fbclid, msclkid, the external referring website's host name, and the first landing path |
To connect a completed sale to its source and measure which promotion led to sales. Query text other than these named fields is not kept | Legitimate interests in measuring sales and avoiding ineffective promotion |
| Your card details | Never collected or seen. Payment happens entirely on Stripe's own checkout page | — |
| Your study progress — what you've answered, what you've got wrong, your readiness estimate, and notes or mnemonics you type | To run the app and sync your progress across devices. Signed-in progress is stored on our systems; browser storage also keeps a local copy | Performance of our contract |
| Security records — IP address, browser information, sign-in time and service logs | To secure accounts, prevent abuse, diagnose faults and respond to incidents | Legitimate interests in protecting users and the service |
| Anonymous page-view counts | To see which pages people find useful. Cookieless and aggregated — no profile of you is built | Legitimate interests in understanding basic site use |
| Google Ads cookie-based conversion measurement — only if you press Accept on the cookie banner | To let Google Ads count that an accepted advert visit led to a sale | Consent, withdrawable at any time |
| Your email address for occasional updates, only if you tick the box at checkout | To send a welcome email, a quiet-account check-in if you haven't studied in a while, and a weekly progress email — each sent only with the consent you gave at checkout | Consent, withdrawable at any time |
An email address and account identifier are needed to create and secure an account. Without them, account sign-in and cross-device sync cannot work. Google sign-in is optional because email and access-code sign-in remain available.
Cookies
The site stores your sign-in session and a local copy of your study progress in your browser. This includes the Supabase session, the short-lived nie_sess access-token cookie, the one-year nie_auth access-code cookie where used, and nie2_state study data. Signed-in progress also goes to our systems so it can sync across devices. This storage is strictly necessary to provide the service and needs no consent. Signing out asks the browser to remove local paid study data and the paid app cache. If the browser blocks removal, clearing the site's browser data removes them.
The site stores the named first-visit source fields in sessionStorage. This first-party record stays in that browser tab and disappears when the tab session ends. If you buy, the valid fields go to Stripe with the checkout and into our private purchase record. Refusing Google Ads cookies does not stop this first-party sale-source record.
There are two non-essential cookies, and they are why you see a banner. If you press Accept, Google Ads stores a reference to the advert you clicked (_gcl_aw) and an identifier for the visit (_gcl_au), so that if you later buy, we can tell which advert paid for itself. Nothing is set until you accept, and pressing Decline leaves the site working exactly the same — there is no worse version for saying no.
Your answer is stored as nie_consent for twelve months, then the banner asks again. Vercel's page-view measurement does not use cookies. Google can still receive limited consent-status and request data when its tag loads with consent denied, so it is not described as anonymous.
You can change your mind at any time, as easily as you decided in the first place: reopen the cookie choice. The same link sits in the footer of every page.
Who else sees it
Only the services needed to run the site. Some act on our instructions; Google also handles authentication under its own terms if you choose it:
- Stripe — takes the payment and holds your email, receipt and the valid sale-source fields sent with checkout.
- Vercel — hosts the site and stores the purchase record, its valid sale-source fields, and signed-in study progress.
- Resend — sends your access-code email and, if you consented, the welcome, quiet-account and weekly-progress emails.
- Supabase — stores account identity, purchase entitlement and bounded study-activity totals for each exam, provides email and password sign-in, and stores a pseudonymised marketing-email record — whether the welcome, quiet-account and weekly-progress emails were sent, weekly progress snapshots, and your unsubscribe status — keyed by a code derived from your email, not your email itself.
- Google — if you choose “Continue with Google”, confirms your identity and shares your basic profile and email address with Supabase.
- Google Ads — only if you accept the cookie banner, and only to count that an advert led to a sale.
Your data is never sold, never rented, and never passed to another company for its own marketing. The Supabase database is in London, but providers and their subprocessors can process some data outside the UK. Depending on the provider and destination, transfers use UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum to the European Commission's standard contractual clauses. Email us for a copy of the applicable safeguard.
How long it is kept
- Your purchase record and email: for as long as your access is live, then for six years from the end of the financial year, because company law and HMRC require accounting records to be kept that long.
- Sale-source fields: in the browser tab until its session ends. If you buy, they stay with the purchase record for the same period.
- Marketing consent: until you withdraw it.
- Marketing email records: send history for twelve months; snapshots while your access is live; your unsubscribe record until you ask for its deletion.
- Account and study progress: while your access is live. After access ends, it is reviewed annually and deleted when it is no longer needed, or earlier when you ask, unless a legal duty requires limited records to remain.
- An account without purchase access: for twelve months after its last activity, unless you ask us to delete it sooner.
- Security logs: according to each hosting or authentication provider's operational retention period, then deleted or anonymised.
Your rights
You can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, ask us to restrict or stop using it, ask for it in a portable format, and object to how it is used. Where processing rests on your consent, you can withdraw that consent at any time without affecting what came before.
To stop marketing email, use the unsubscribe link in any message, or just reply saying stop. It is acted on straight away.
Email alexander@alargecompany.com for any of the above. There is no charge and a reply is due within one month.
We may ask you to confirm the signed-in email address or your Stripe receipt before we act on a request. This protects your account from another person.
Your right to object: you can object at any time to processing based on legitimate interests. Email us and explain which processing concerns you. We will stop unless there is a compelling lawful reason to continue.
Removing Police Exam Workspace from your Google Account stops future Google sign-in. It does not delete the account or records. Email us to request that separate deletion.
Complaints
If something has gone wrong, please raise it directly first — it is likely to be fixed faster. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.
Automated decisions
The app automatically analyses your answers to calculate a readiness estimate. This is profiling for study feedback, but it does not make legal or similarly significant decisions about you. The estimate is not used for advertising or pricing.
Changes
If this notice changes, the date at the top changes with it. Anything that materially affects you will be sent to you by email rather than quietly edited in.