Privacy policy
Last updated: 29 October 2026. In force: October 2026.
Version in force: October 2026 (privacy-v2). This policy describes what the site actually does with your data.
1. Data controller
Wael Badri, an individual, publisher of QAcademy, cité des bureaux, Tunis, Tunisia. The controller is based and works from Tunisia. Contact: contact@qacademy.net. Requests about your data: privacy@qacademy.net.
2. Minimum age
You must be at least 16 to create an account. If you think an account was created by someone younger, write to us: we delete it.
3. Data we collect
- Level test: your answers and score, with no account or email. Your IP address is never kept in clear: only an irreversible encrypted fingerprint is used to limit abuse.
- Full analysis request: email address, first name (optional), language, where the visit came from (UTM parameters) and the history of your consent choices (text accepted, version, date).
- Waitlist (pricing page): email address, language, where the visit came from and the consent text accepted, with its version and date.
- Account: email address, password (stored only as a hash), first name, country, language, CTFL status, target exam date, progress (lessons, quizzes, mock exams, lab answers, visible to you alone).
- Purchases: offer, amount, currency, purchase and access end dates, Paddle transaction and customer identifiers. For a purchase made without an account, the payment email address, supplied by Paddle, is kept until the purchase is attached to an account. Card and billing data are processed by Paddle, never by QAcademy.
- Support: email address, topic, the page you wrote from, your message and our replies.
- Teams quote request: company, name, work email, team size, message. People invited to a team: email address and aggregated progress visible to the team manager (never their answers).
- Visit statistics: see section 6.
4. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Account and access to content | Create your account, activate and remove access, sign you in | Performance of the contract |
| Level test and analysis request | Calculate your score; email you the full analysis and revision plan | Consent (mandatory box in the form for sending the analysis) |
| Service emails | Sign-in codes, confirmations, purchase activation, support replies | Performance of the contract or pre-contractual steps |
| Tips and offer emails | Send you preparation tips, then an introduction to the paid preparation | Separate, optional consent (separate box, never pre-ticked), one-click withdrawal |
| Waitlist | Tell you when the full preparation opens | Separate, optional consent |
| Purchase | Process the order, invoice, refund, keep accounts | Performance of the contract; legal obligation |
| Support | Answer your messages | Performance of the contract or legitimate interest (answering requests) |
| Teams quote | Answer your request and manage licences | Pre-contractual steps, then performance of the contract |
| Visit statistics | Understand how the site is used and improve it | Legitimate interest (audience measurement); you can object |
| Security and abuse prevention | Limit the number of requests, protect accounts and the admin console | Legitimate interest |
5. Recipients and processors
Your data is neither sold nor rented. It is processed by:
- Vercel Inc. (United States): website hosting; server functions run in the Dublin region (Ireland).
- Supabase (European Union region, Ireland): database and authentication.
- Resend (United States): email delivery (email content and recipient address).
- PostHog (European Union region): visit statistics, see section 6.
- Paddle (Paddle.com Market Limited, United Kingdom, or the Paddle entity named on your receipt): reseller (Merchant of Record) that collects the payment and invoices. Paddle is the controller of the payment and billing data it collects: see its privacy policy.
- Cloudflare (United States): domain name, DNS and traffic security.
6. Visit statistics (PostHog)
The site uses PostHog (European Union region) to measure visits. This processing is not anonymous and is not subject to a consent banner; it relies on our legitimate interest in measuring and improving the site, and you can object to it (section 10). In practice:
- In your browser, PostHog sets a cookie and a local storage entry holding a random identifier, which recognises your browser from one visit to the next.
- What is recorded: page views and page exits, and a few specific actions (for example a click on a call-to-action button, a step of the level test, a visit to the pricing page), with the language, page type and campaign parameters (UTM) of your visit.
- What is not recorded: text typed into forms, session recordings, heatmaps. No event contains your email address or your name.
- Requests go through our own domain before being passed on to PostHog; your IP address is passed to PostHog, which uses it to infer an approximate location.
- If you are signed in, the statistics are attached to your account's internal identifier (never your email address).
- Some events are sent by our server (for example creation of an analysis request, email confirmed, purchase or refund processed). They carry the internal identifier of the request, account or transaction, offer, language and amount information, never your email address. When you submit the analysis request form, your browser's identifier is linked to the request's internal identifier.
7. Transfers outside the European Union
Your data is hosted in the European Union (Supabase, Ireland), but some providers are located in the United States: Vercel, Resend and Cloudflare. In addition, the controller accesses the data from Tunisia, a country for which there is no European Commission adequacy decision.
For the US providers, the transfer relies, depending on the provider, on the EU-US Data Privacy Framework (certified provider) or on the European Commission's standard contractual clauses. For access from Tunisia, we limit access to the controller alone, with stronger authentication for the admin console, over encrypted connections. You can ask us for more details at privacy@qacademy.net.
8. Retention periods
| Data | Period |
|---|---|
| Unconfirmed analysis request (link never opened) | Deleted after 30 days |
| Analysis access links | Valid 30 days, then deleted |
| Level test results | Anonymised after 12 months |
| Technical abuse-limiting data (fingerprints) | 1 day |
| Contacts without an account (confirmed) | 3 years after the last contact |
| Waitlist | Until the opening email or until you unsubscribe |
| Inactive accounts | Deleted after 3 years of inactivity; you can delete yours at any time |
| Purchases and invoices | 10 years (accounting obligations); when you delete your account, the purchase is no longer linked to you |
| Teams quote requests | 12 months |
| Support messages | 2 years after the last reply |
| Consent history | As long as the contact exists (proof of consent) |
| Visit statistics (PostHog) | According to the retention settings of our PostHog project |
9. Security
Encrypted connections (HTTPS); IP addresses and tokens kept as irreversible fingerprints; data access rules at database level (everyone sees only their own data); administrator access limited to the controller with two-step verification; no tracking pixel in our emails. No card data passes through our servers.
10. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (in particular to visit statistics and to direct marketing), and the right to withdraw your consent at any time, without affecting what happened before. To exercise them: privacy@qacademy.net. We answer within one month.
- When signed in, you can export your data and delete your account yourself from the "My data" page.
- Every tips email contains a one-click unsubscribe link.
- To object to visit statistics, write to us or block this site's cookies and local storage in your browser.
You may also lodge a complaint with the data protection authority of your country of residence (in France: the CNIL, cnil.fr).
11. Cookies and browser storage
Strictly necessary for the site to work (no consent required):
- Account session cookies (Supabase), when you are signed in.
qa_device: recognises this device after a sign-in confirmed by email, so that no code is asked again, 30 days (removed if you change your password).qa_signin: links the confirmation code to the password entered on this device, 10 minutes.qa_analysis: gives you access to your analysis after opening the link received by email, 2 hours;qa_analysis_pending: 15 minutes, while the opening of the link is confirmed.qa_attempts: attaches your test attempts to your account when you create one, 30 days.qa_ab: a random number from 0 to 99 (no identifier or personal data) to show one version of the pricing page, 90 days, only while a display test is running.- Tab session storage (cleared when the tab closes): campaign parameters (UTM) of your arrival, memory that a message was shown, your answers to the diagnostic while it is in progress (to resume it if you reload the page; deleted when you submit the test; never sent before the end), and, after a payment without an account, the payment email address to pre-fill the activation form.
Audience measurement (set without a banner, basis: legitimate interest, objection possible): the PostHog cookie and local storage described in section 6.
Payment: when you open the payment window, Paddle's script is loaded from its servers and Paddle may use its own trackers, according to its privacy policy.
No cookie is used to remember the language. Our emails contain no tracking pixel.
12. Changes
We update this policy if our processing changes. In case of a significant change, the new version is shown to you at your next sign-in.