Privacy Policy

This Privacy Policy (also our privacy notice) describes how GREKMF ("we," "us," "our") collects, uses, discloses, and safeguards personal information when you visit grekmf.com orapp.grekmf.com, create an account, or use our GRE preparation platform (the "Service"). Please read this policy carefully. By using the Service, you consent to the practices described herein.

We take your privacy seriously. Our core commitment: we do not sell your personal data to third parties, and we collect only what is necessary to operate the Service, measure how it is used, and understand the effectiveness of our marketing.

1. Information We Collect

1.1 Information You Provide

• Account data: When you register, we collect your name and email address and a hashed password. We do not store plaintext passwords.
• Payment data: All payment processing is handled by Paddle.com Market Limited, our Merchant of Record. We receive only a transaction confirmation and a customer identifier from Paddle. We do not receive, store, or process full payment card numbers, bank account details, or other sensitive financial data.
• Communications: If you contact us by email, we retain the content of that communication to respond to your inquiry.

1.2 Information Collected Automatically

• Usage data: We log which questions you attempt, your answers, session timing, and navigation actions within the platform. This data is used exclusively to power the performance analytics features of the Service.
• Technical data: We collect standard server logs including IP address, browser type, operating system, referring URL, and timestamps. This information is used for security, debugging, and abuse prevention.
• Session cookies: We use session cookies to keep you authenticated between page loads on the app. These are strictly functional cookies; they expire when your session ends or you log out.
• Analytics and advertising data: We use Google Tag Manager, Google Analytics, and Google Ads tags to understand how visitors use our website and app, measure conversions (such as sign-ups, trial starts, and purchases), and evaluate the performance of our advertising. These tools may set cookies (for example, _ga, _gid, _gcl_au) and collect information such as pages visited, referral source, device type, and interactions with our marketing pages and product flows.

1.3 Information We Do Not Collect

We do not collect your phone number, physical address, date of birth, or government identification documents unless specifically required to resolve a billing or compliance matter.

2. How We Use Your Information

We use the information we collect to:

• Create and authenticate your account;
• Process your subscription purchase and manage access to the Service;
• Power the performance analytics, skill tracking, and study planner features;
• Send transactional emails (account creation confirmation, subscription confirmation, refund notifications) — we do not send marketing emails without your explicit opt-in;
• Detect and prevent fraud, unauthorized access, and violations of our Terms of Service;
• Investigate abuse reports, security incidents, and enforce rate limiting;
• Maintain and improve the reliability and performance of the Service;
• Measure website and product usage, understand conversion funnels, and evaluate marketing performance through Google Analytics and Google Ads;
• Comply with applicable legal obligations.

We do not use your personal data to train, fine-tune, or otherwise improve any external AI or machine-learning model. We do not sell, rent, license, or otherwise transfer your personal data to any third party for commercial purposes.

3. Legal Basis for Processing (EEA / UK Users)

If you are located in the European Economic Area or United Kingdom, our legal basis for collecting and using your personal information is:

• Contract performance: Processing your account data and usage data is necessary to provide the Service you have contracted for.
• Legitimate interests: Processing IP addresses, session logs, security data, and analytics data is necessary for our legitimate interest in preventing fraud, securing the platform, and understanding how the Service is used.
• Legal obligation: Retaining transaction records for applicable tax and accounting periods.
• Consent: Any optional communications (e.g., product update emails) are sent only with your explicit consent.

4. Sharing and Disclosure of Information

We share your personal information only in the following limited circumstances:

• Paddle (payment processing): We share your email address and order details with Paddle to facilitate payment processing and tax compliance. Paddle acts as the Merchant of Record for all transactions and is subject to its own privacy policy.
• Hosting and infrastructure providers: Our platform is hosted on third-party cloud infrastructure. These providers process data solely as processors on our instructions and are bound by data processing agreements.
• Google (analytics and advertising): We use Google Tag Manager to deploy Google Analytics and Google Ads measurement tags. Google may process usage and device data to provide aggregated analytics and conversion reporting. Google's use of this data is governed by Google's Privacy Policy.
• Institutional administrators: If you access the Service through an institutional seat code, your institution's designated administrator can see your account email, plan status, last-active date, and seat redemption date. They cannot see your answers, performance data, or session history.
• Law enforcement: We may disclose your information if required by a valid court order, subpoena, or other lawful legal process, or when we have a good-faith belief that disclosure is necessary to prevent harm, enforce our Terms, or protect the rights of GREKMF or others.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the successor entity, subject to a commitment to honor this Privacy Policy.

We do not sell your personal data or share it with third parties for data-brokering purposes. Analytics and advertising partners such as Google receive only the information needed to provide measurement services on our behalf.

5. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, all personal data associated with your account is permanently and irreversibly deleted, subject to the following exceptions:

• Transaction records are retained for the period required by applicable tax law (typically 5–7 years depending on jurisdiction);
• IP address logs and security audit records are retained for up to 12 months for fraud detection and security purposes;
• Data that has been aggregated and fully anonymized may be retained indefinitely for platform analytics.

Account deletion requires password verification and is processed as a soft-delete that immediately revokes access while retaining the email address and audit trail to prevent re-registration fraud. All substantive learning data is permanently removed at the time of deletion.

6. Cookies

We use the following categories of cookies and similar technologies:

• Essential cookies: A session cookie is set upon login to maintain your authenticated state on the app. It expires when you log out or close your browser.
• Preference storage: Small local storage values may be set to remember display preferences (e.g., font size, dark mode). These are stored locally in your browser and are not transmitted to our servers.
• Analytics and advertising cookies: Google Tag Manager may set cookies used by Google Analytics and Google Ads to measure traffic, attribute conversions, and understand how users interact with our marketing site (grekmf.com) and app (app.grekmf.com). Examples include _ga, _gid, and _gcl_au.

You can control or delete cookies through your browser settings. Disabling analytics cookies may limit our ability to measure site performance and advertising effectiveness, but will not affect core functionality of the Service.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

• TLS encryption for all data in transit;
• Bcrypt hashing for all passwords (passwords are never stored in recoverable form);
• Rate limiting, IP blocking, and anomalous-request detection to prevent automated attacks;
• Principle of least privilege for internal data access;
• Regular security reviews of code and infrastructure.

No method of electronic storage or transmission over the Internet is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that creates a material risk to your rights, we will notify affected users as required by applicable law.

8. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal data we hold about you;
• Correction: Request correction of inaccurate or incomplete data;
• Deletion: Request deletion of your account and personal data;
• Portability: Request your data in a structured, machine-readable format;
• Restriction: Request that we restrict processing of your data in certain circumstances;
• Objection: Object to processing based on our legitimate interests;
• Withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.

If you are in the EEA, you also have the right to lodge a complaint with your local data protection supervisory authority.

9. International Data Transfers

GREKMF is operated from servers that may be located outside your country of residence. By using the Service, you consent to the transfer of your information to jurisdictions that may have different data protection laws than your own. Where required by law, we implement appropriate safeguards (such as standard contractual clauses) for such transfers.

10. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will promptly delete that information. If you believe we may have inadvertently collected information from a child under 13, please contact us at [email protected].

11. Third-Party Links

The Service may contain links to third-party websites or resources. We are not responsible for the privacy practices or content of those third parties. This Privacy Policy applies solely to information collected by GREKMF. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page with a revised effective date. For material changes, we will provide notice to registered users via email or a prominent in-product notice. Your continued use of the Service following any such update constitutes your acceptance of the revised policy.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us at: [email protected].