This Privacy Policy explains how NAVLE Exam Prep ("we", "us") collects, uses, shares and protects personal information when you use navleexam.com (the "Service"). It applies to visitors, free-trial users, paid subscribers and email subscribers wherever they are located. We are the data controller for this information.
1. Information We Collect
1.1 Information you give us
- Account: name, email address, password (stored only as a one-way hash), chosen exam type, and your acceptance of our Terms (date and version).
- Study profile (optional): country, veterinary school, student or graduate status, graduation year, target exam and window, and how you heard about us. You can skip or edit this at any time.
- Purchases: plan bought, amount, date and Stripe transaction identifiers. Card details are collected and stored by Stripe, not by us.
- Content you create: notes, flashcards, bookmarks, messages to support and contact-form submissions.
- Email subscribers: if you sign up for the free daily question, your name, email and chosen exam.
- Referral programme: your referral code and the fact that someone registered with it. We do not ask you for other people's email addresses.
1.2 Information collected automatically
- Study activity: questions answered, answers chosen, time spent, scores and progress; this is the core of the Service.
- Technical data: IP address, approximate location derived from it, browser and device type, pages viewed, referring page, and timestamps. We log IP addresses at registration and login to prevent fraud and account sharing.
- Cookies and similar technologies: see section 6 and our Cookie Policy.
We do not collect sensitive categories of personal information (such as health, biometric or precise geolocation data), and we do not knowingly collect information from anyone under 18.
2. How and Why We Use Information
| Purpose | Examples | Legal basis (where required) |
|---|---|---|
| Provide the Service | Create your account, show questions, track progress, grant the access you paid for, respond to support requests | Performance of our contract with you |
| Payments | Process purchases through Stripe, grant access, keep tax and accounting records | Contract; legal obligation |
| Improve the Service | Understand which questions and topics are hard, fix errors, aggregate study-profile answers into reports (for example "where our students come from") | Legitimate interests |
| Communicate | Account, verification, receipt and security emails (required); study tips, offers and the free daily question (optional, with unsubscribe) | Contract; consent or legitimate interests for marketing |
| Security and fraud prevention | Detect account sharing, scraping, abuse of trials and promotions, bots. For this, each time you sign in we record the device type (for example "Phone, iPhone, Safari"), the approximate country of your IP address, and a device fingerprint: a one-way code computed in your browser from its screen, language, time zone and similar settings, used only to tell your devices apart for account security. | Legitimate interests; legal obligation |
| Analytics and advertising measurement | Google Analytics and the Reddit Pixel, loaded only after you accept cookies | Consent |
| Legal | Comply with law, enforce our Terms, respond to lawful requests | Legal obligation; legitimate interests |
We do not use your information for automated decisions that have legal or similarly significant effects on you.
3. Who We Share Information With
We do not sell personal information. We share it only with:
- Service providers who process it for us under contract: Stripe (payments), our web host (Namecheap), our email delivery provider, Google (Analytics, Ads conversion measurement, reCAPTCHA and, on blog pages, AdSense advertising) and Reddit (advertising measurement). Analytics and advertising-measurement tools run only if you accept cookies; see section 6 for how blog ads work.
- Legal and safety: when required by law, court order or to protect our rights, users or the public.
- Business transfers: if the business is sold or merged, your information may transfer to the new owner under this policy.
Under the California Consumer Privacy Act, loading advertising-measurement pixels can count as "sharing" personal information for cross-context behavioural advertising. We only do this with your consent, and you can withdraw it at any time; see "Your Privacy Choices" in section 6.
4. How Long We Keep Information
- Account and study data: while your account exists. If you delete your account, we erase or anonymise it within 30 days.
- Payment and tax records: 7 years, as required for accounting and tax law, even after account deletion (kept without your name or email where possible).
- Server, security and login logs: up to 12 months.
- Marketing and daily-question emails: until you unsubscribe; we keep a record of your unsubscribe request so we can honour it.
- Support and contact messages: up to 3 years.
5. Security
We use TLS encryption for all traffic, one-way password hashing, access controls, rate limiting and regular updates. No system is completely secure; if we learn of a breach affecting your personal information we will notify you and the relevant authorities as the law requires.
6. Cookies and Your Privacy Choices
Essential cookies (your login session, your cookie choice, Stripe's fraud-prevention cookies) are always used. Analytics (Google Analytics) and advertising-measurement (Reddit Pixel) cookies load only after you click "Accept" on our cookie banner. You can change your choice at any time on the Cookie Policy page, which also acts as our "Do Not Sell or Share My Personal Information" control. We honour Global Privacy Control (GPC) browser signals as an opt-out of sharing.
Advertising on blog pages. Some blog pages show ads served by Google AdSense (never inside articles, and not to paying students). Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. Ads are personalised only if you accepted cookies on our banner and your browser sends no GPC signal; otherwise Google is asked to show non-personalised ads, which still use cookies for frequency capping, fraud prevention and reporting. Visitors in the EEA, UK and Switzerland are also asked for consent by Google's own consent message. You can opt out of personalised advertising in Google Ads Settings or at www.aboutads.info, and read how Google uses data at policies.google.com/technologies/partner-sites.
7. Your Rights
Wherever you live, you can:
- Access the personal information we hold about you and receive a copy in a portable format;
- Correct it (name, email and study profile can be edited in Settings);
- Delete your account and data yourself in Settings, or by emailing us;
- Opt out of marketing emails (unsubscribe link in every email) and of analytics/advertising cookies (cookie settings);
- Object to or restrict certain processing, and withdraw consent where processing is based on consent.
To exercise a right that is not self-service, email support@navleexam.com. We will verify your identity (usually by replying to the email on your account) and respond within 30 days, or within 45 days as permitted for California requests. We will not discriminate against you for exercising your rights. An authorised agent may make a request on your behalf with written permission.
7.1 Residents of California and other US states
If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon or another state with a consumer privacy law, you have the rights listed above, including the right to know the categories of personal information we collect (listed in section 1), the purposes (section 2), the categories of third parties we share with (section 3), and the right to opt out of "sale" or "sharing" (we do not sell; sharing for advertising measurement is consent-based and can be switched off in section 6). We have not sold or shared personal information for money in the past 12 months. California residents may also request this information under Civil Code §1798.83.
7.2 Residents of the EU, EEA, UK and Switzerland
We process your data on the legal bases shown in section 2. You may lodge a complaint with your local supervisory authority. Your data is transferred to and processed in the United States; where required we rely on Standard Contractual Clauses with our providers.
7.3 Residents of India
Under the Digital Personal Data Protection Act, you may access, correct and erase your data and withdraw consent by the methods above. Our grievance contact is support@navleexam.com.
7.4 Residents of Canada
You may request access to and correction of your personal information and withdraw consent, subject to legal and contractual restrictions, by contacting us at the address above.
8. International Transfers
We are based in the United States and our providers store data in the United States and other countries. By using the Service you understand that your information will be processed there, where privacy laws may differ from those of your country.
9. Children
The Service is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18, and never from children under 13 (COPPA). If you believe a minor has given us information, email us and we will delete it.
10. Email Communications
- Service emails (verification, receipts, password resets, security notices) are required to run your account.
- Marketing emails and the free daily question are optional. Every one includes an unsubscribe link, and we process unsubscribes within 10 business days as US law (CAN-SPAM) requires.
11. Changes to This Policy
We may update this policy. The "Last updated" date shows the current version. For material changes we will email registered users or post a notice on the Service before the change takes effect.
12. Contact
NAVLE Exam Prep
Email: support@navleexam.com