Privacy Policy

The data controller for Laureo is Filippe Frulli, a sole trader established in Ireland, at Apartment C127, Newmarket Yards, D08C3XR, Dublin.

For anything in this policy — including a request to see or delete your data — write to filippefrulli.dev@gmail.com.

Worth stating first, because it is unusual and it shapes everything below.

• No analytics. There is no Google Analytics, no Plausible, no PostHog, no product analytics of any kind on this site.
• No tracking or advertising cookies, no pixels, no fingerprinting, no ad networks, and no third-party trackers. This is why you were not asked to accept cookies: the only cookies set are the ones that keep you signed in, which are strictly necessary and need no consent.
• No card details. Payments happen on Stripe’s own checkout page. Your card number never reaches our servers, and we could not store it if we wanted to.
• No selling or sharing. We do not sell your data, rent it, or hand it to advertisers or data brokers. There is no marketing list.

Account

Your email address, and either a password (stored only as a cryptographic hash — we cannot read it) or the fact that you signed in with Google. If you use Google, we receive your email address and account identifier from Google; we do not receive your Google password. We also store your preferred interface language and when the account was created.

Practice

Which questions you were served, the answer you chose, whether it was correct, and how long you took. From that we derive your streak, your accuracy, your per-topic weak points, and — for Pro users — the mistake bank.

This is the substance of the product rather than a by-product of it: without it there is no progress tracking and no way to serve you a question you have not already seen.

Purchases

Whether you hold Pro access and when it expires, plus the identifiers of the payment events we have already processed (so a repeated notification from Stripe cannot grant the same purchase twice). Stripe separately holds your name, billing email, billing country and payment details as the payment processor — see their privacy policy.

Technical

Our hosting and database providers keep short-lived operational logs — IP address, request time, error traces — as part of running and securing the service. We do not build profiles from them.

Under the GDPR, each purpose needs a legal basis. Ours are:

• Performance of a contract — running your account, serving questions, keeping your progress, and delivering and honouring a purchase. Without this data there is no service to provide.
• Legitimate interests — keeping the service secure, preventing abuse and fraud, and fixing faults. We have weighed this against your interests; the data involved is minimal and is not used to profile you.
• Legal obligation — retaining transaction and tax records for as long as tax law requires.

We do not rely on consent for any of this, because we do nothing optional with your data. There is no consent to withdraw and no marketing to unsubscribe from.

We use a small number of providers, each under a data processing agreement, each doing one job:

• Supabase — the database and the sign-in system. Your account and practice data live here, in a database hosted in the EU (Stockholm, Sweden).
• Stripe — payment processing.
• Vercel — website hosting and delivery.
• Google — only if you choose to sign in with Google, and only for that.

Your practice data stays in the EU. Some of these providers are US-headquartered and may process limited data (such as payment or operational log data) outside the EEA; where that happens it is covered by the European Commission’s Standard Contractual Clauses or an equivalent transfer mechanism.

We will also disclose data where the law requires it — a valid court order or legal obligation — and we will tell you if that happens unless we are prohibited from doing so.

Your account and practice data are kept for as long as your account exists. There is no automatic expiry, because a study history is only useful if it accumulates.

Deleting your account deletes it. You can do this yourself at any time from Settings; it takes effect immediately and removes your profile and practice history along with the account. It is not reversible and we cannot restore it afterwards.

Two things survive deletion, both narrowly: records of completed transactions, which tax law requires us to retain for a number of years, and the identifiers of processed payment events, which contain no personal data. Backups are cycled out on a rolling basis, so a deleted record may persist in a backup for a short period before being overwritten.

If you are in the EU or the UK, you have the right to:

• access the personal data we hold about you, and get a copy;
• correct it if it is wrong;
• erase it — which you can do yourself, immediately, from Settings;
• port it, receiving it in a structured, machine-readable format;
• restrict or object to processing based on legitimate interests.

Email filippefrulli.dev@gmail.com to exercise any of these. We will respond within one month. We will not charge you, and we will not make the service worse for you because you asked.

If you are unhappy with how we have handled your data, you can complain to your national data protection authority. You do not have to come to us first, though we would rather you did.

Laureo sets cookies for one purpose: keeping you signed in. They store your session so that you are not asked to log in on every page, and they are read only by us.

These are strictly necessary cookies. Under the ePrivacy rules they do not require a consent banner, which is why you have not seen one. Blocking them in your browser will prevent you from signing in. Signing out clears them, and so does deleting your account.

If you pay, Stripe sets its own cookies on its checkout page for fraud prevention. That happens on Stripe’s domain, under Stripe’s policy.

Laureo is intended for adults preparing for EU recruitment procedures and is not directed at children. You must be at least 16 to hold an account. If you believe a child has created one, tell us at filippefrulli.dev@gmail.com and we will delete it.

If we change how we handle your data we will update this page and move the effective date at the top. If a change is significant — a new processor, a new purpose, a new category of data — we will tell you by email before it takes effect. Related: Terms of Service and refund policy.