Skip to main content
CSEC Prep

Privacy Policy

Last updated: 21 July 2026

1. Who we are

This Privacy Policy explains how JSRM Trading, a business registered in Trinidad and Tobago ("we", "us", "our"), collects and uses personal information when you use the CSEC Prep website and learning service (the "Service").

If you have questions about this policy, contact us through our contact form at /contact-us.

2. Information we collect

We collect information you provide and information generated when you use the Service:

  • Account details: name, email address, password (stored securely by our auth provider), and optional profile information such as an avatar.
  • Learning data: lesson progress, scores, streaks, badges, league placement, review activity, and in-app preferences.
  • Billing-related data: which subjects you have access to, subscription status, and Paddle customer or transaction identifiers linked to your account. Card and bank details are collected by Paddle, not stored on our servers.
  • Support messages: content you send through contact or bug-report forms, including optional attachments.
  • Referral and social features: friend connections, referral codes, and waitlist information when those features are in use.
  • Technical data: IP address, browser type, device information, and server logs used for security, rate limiting, and troubleshooting.
  • Optional analytics: if enabled, privacy-oriented usage analytics (Umami) with no advertising profiles.
  • Error monitoring: if configured, anonymized crash and error reports (Sentry) to help us fix bugs.

3. How we use information

We use personal information to:

  • Create and manage your account and authenticate you.
  • Deliver lessons, track progress, and operate gamification features (streaks, leagues, badges).
  • Process subscriptions and enforce access to paid subjects.
  • Send transactional emails such as verification, password reset, and account notices.
  • Respond to support requests and improve the Service.
  • Protect against abuse, fraud, and security incidents (including CAPTCHA verification via Cloudflare Turnstile).
  • Comply with legal obligations and enforce our Terms of Service.

4. Legal bases

Where applicable privacy law requires a legal basis, we rely on: performance of our contract with you (providing the Service you signed up for); your consent (for example, optional analytics where required); and our legitimate interests in operating, securing, and improving the Service, balanced against your rights.

5. Children and students

CSEC Prep is designed for secondary-school students preparing for CSEC examinations. Many users are under 18.

If you are under 18, you should use the Service with the knowledge and permission of a parent or guardian. A parent or guardian may create or manage an account on behalf of a student, including using their own email at checkout when paying for subscriptions.

We do not knowingly collect personal information from children under 13 without appropriate parental consent. If you believe we have collected information from a child without consent, please contact us and we will take appropriate steps to delete it.

Parents and guardians may contact us to request access to, correction of, or deletion of a minor's account information.

6. Third-party services

We use trusted providers who process data on our behalf:

  • Paddle — payment processing and subscription management (merchant of record for purchases).
  • Resend — transactional and contact-form email delivery.
  • Supabase — profile image storage.
  • Cloudflare Turnstile — bot protection on public forms.
  • Google — optional sign-in with Google; Google profile data used only to create or update your account.
  • Optional: Umami (analytics), Sentry (error monitoring), and DeepSeek (teacher-facing AI summaries when that feature is enabled).

7. Data retention and deletion

We keep account and learning data while your account is active. You may delete your account from in-app settings where available, or request deletion by contacting us.

Some records may be retained after deletion where required for legal, tax, accounting, fraud prevention, or dispute resolution purposes — for example, anonymized or detached affiliate payout history. Avatar files in storage are removed when your account is deleted.

Server logs and security records are retained for a limited period appropriate for security and operations.

8. Security

We use technical and organizational measures to protect personal information, including encryption in transit (HTTPS), access controls, and rate limiting. No method of transmission or storage is completely secure; please use a strong, unique password and keep it confidential.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, or restrict use of your personal information, or to object to certain processing. To exercise these rights, contact us via /contact-us. We will respond within a reasonable time.

If you are not satisfied with our response, you may have the right to lodge a complaint with a data protection authority in your country.

10. International transfers

Our service providers may process data in countries other than Trinidad and Tobago. Where required, we take steps to ensure appropriate safeguards for cross-border transfers.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may also be communicated by email or in-app notice where appropriate.

12. Contact

For privacy questions or requests, contact JSRM Trading via the contact form at /contact-us.