Skip to content
← Back to Learn in Curve

Privacy Policy - Learn in Curve

Last updated: 22 September 2026

1. Who We Are

Learn in Curve, operated by Sim Samaar Shened ("we", "us"), operates learnincurve.com, an AI-assisted revision platform for professional certifications designed to help users pass their exams, along with our associated newsletter and blog.

For the purposes of the UK General Data Protection Regulation (UK GDPR), Sim Samaar Shened is the individual data controller.

Contact: support@learnincurve.com

2. What We Collect, and Why

We collect only what is necessary to run the platform, process your purchases, and improve your studying experience. Where data collection is necessary for the contract (such as providing your email address to set up an account or receiving payment confirmation), failing to provide this data means we cannot deliver the Learn in Curve service to you.

  • Account & Profile Details: When you sign up, we collect your email address and a hashed password (or receive your name and email from Google if you use Google Sign-In). You may also choose to provide optional profile details (such as your target exam date). This is necessary to secure your account and personalize your dashboard experience.
  • Course Progress & Entitlements: We track your course enrollments, quiz answers, correctness, marks, mock exam submissions, and self-assessment scores. This data is essential to deliver core platform functionality and accurately track your exam readiness.
  • Purchases & Payments: When you buy a course unlock, payment is securely processed by Stripe. We receive only a payment confirmation and transaction reference. We never see or store your raw credit card details.
  • Newsletter & Blog Subscriptions: If you opt in, we collect your email address to send you course launch notices, product updates, and blog articles. You can withdraw your consent and unsubscribe at any time via the link in any email.
  • Homepage Guest Trial: If you use the free trial on the homepage without an account, we hash your IP address (SHA-256 with a server salt) to enforce our free usage limits. We do not keep raw IP addresses or guest chat transcripts in our database. Guest messages are processed by our AI provider strictly to generate a live reply for that session.
  • Free Mock Exams: The free mock exams need no account. When you finish one and unlock your breakdown, we collect the email address you give us, your answers to that exam, and basic campaign attribution (which link or search brought you to us). Your breakdown is shown to you on screen rather than emailed. We keep the address so we can tell you about our courses, and the attribution so we know which channels bring learners in. Our lawful basis for keeping it is legitimate interests. The marketing tick box on that form is separate and entirely optional: leave it unticked and we will not add you to our mailing list.
  • Job Applications: If you apply for a role via our Careers section, we process your submitted CV and cover note to assess your application.

3. Cookies and Analytics

We use strictly necessary cookies, and — only with your consent — product analytics cookies.

Strictly necessary. This includes Supabase's authentication session cookie, which securely keeps you signed in. Because it is strictly necessary for the service to function, UK/EU guidance does not require a prior consent choice for it.

Product analytics (consent-based). We use PostHog to understand how the platform is actually used — which lessons people complete, where they get stuck, and what to improve. PostHog only loads if you select Accept on our cookie banner. If you select Reject, or make no choice, no analytics script is loaded and no analytics cookie is set. You can change your mind at any time.

This includes session replay, which reconstructs the pages you moved through and where you clicked. All text and all typed input is masked in your browser before anything is sent, so your written exam answers and personal details are not captured. PostHog processes this data on its EU Cloud infrastructure.

Our full Cookie Policy explains each cookie, what it does, and how to change your choice.

Recorded without cookies. A small number of events are sent to PostHog from our servers rather than from your browser, so they do not involve a cookie and are not covered by the banner choice above. The one that concerns you most: when you submit a free mock exam, we record that submission and your score against your email address. This is how we know a mock exam turned into a sign-up. It is not advertising, and it is never shared with advertisers. Ask us and we will delete it.

Legal basis: consent (UK GDPR Art. 6(1)(a) and PECR reg. 6) for analytics cookies; legitimate interests for the server-side events described above; legitimate interests / contract performance for strictly necessary cookies.

4. Who We Share Data With

We do not sell your personal data to anyone, under any circumstances. We share data strictly with trusted infrastructure providers necessary to operate the service:

  • Supabase: Our database and authentication provider (hosted in the EU - Ireland), which securely stores your account, progress, and mock exam data.
  • Google (OAuth): Used only if you choose "Continue with Google" for account creation and sign-in.
  • Stripe: Our payment processor, which directly handles your card details when you make a purchase.
  • PostHog: Our product analytics provider (EU Cloud). With your consent to analytics cookies it receives page views, in-app interactions, masked session replays, and technical error diagnostics when something on the site fails. Separately, and without cookies, our servers send it the free mock exam events described in section 3, which include your email address and your score.
  • Resend: Our email provider, which delivers the email we send you: sign-in and confirmation emails, purchase confirmations, free mock exam results, replies to anything you send us, and the newsletter if you opted in. It processes your email address and the contents of those messages.
  • Google (Gemini API): Our AI service provider, used exclusively for the homepage guest trial and AI grading of written answers in mock exams. Relevant text from your written mock exam answers and the marking rubric are sent to Gemini to generate grading feedback. We use Google's Enterprise Gemini API; your messages and mock exam answers are used strictly to generate real-time feedback and are not used by Google to train their foundational AI models.

5. International Transfers

Your core personal data and learning progress are stored in our primary database hosted in the EU (Ireland). When utilizing the Gemini API for exam marking or guest trials, data may be processed securely outside the UK/EU. We ensure our third-party providers rely on appropriate legal safeguards—such as Standard Contractual Clauses or certified data protection frameworks—before any processing takes place.

6. How Long We Keep Your Data

  • Account, Progress, and Exam Data: Kept securely for as long as your account remains active so you can review previous attempts and track your learning.
  • Guest Trial IP Hashes: Kept for 30 days from last use, then automatically deleted. These exist solely to prevent abuse of the free public trial.
  • Analytics Events (PostHog): Only collected if you consented. Your IP address is discarded at the point of collection and never stored. Events are currently retained for up to 7 years under our PostHog plan. Deleted sooner on request.
  • Session Replays (PostHog): Only collected if you consented. Kept for 30 days, then automatically deleted. Replays are masked in your browser before they are sent, so they never contain text you typed. Deleted sooner on request.
  • Newsletters: Kept until you unsubscribe.
  • Account Deletion: You can delete your account yourself at any time from Account in the dashboard menu. Deletion is immediate and permanent: your progress, mock attempts and scores, practice history, certificates, Sly conversations, course access and marketing sign-ups are erased, and your login is removed. You can also email support@learnincurve.com and we will process the request manually within 30 days. Our payment provider keeps its own record of any transaction, because UK tax law requires us to be able to account for payments received.

7. Your Rights

Under UK GDPR, you have the following rights regarding your data:

  • Access: The right to request copies of the personal data we hold about you.
  • Correction: The right to request that we correct any inaccurate or incomplete data.
  • Deletion: The right to ask us to erase your personal data ("right to be forgotten").
  • Restriction: The right to ask us to restrict how we process your data.
  • Portability: The right to receive your data in a portable, standard digital format.
  • Objection: The right to object to processing based on legitimate interests.
  • Automated Decision Rights: The right to request a human review or explanation regarding automated AI feedback (for example, if you believe a mock exam written answer was graded inaccurately by the AI system).
  • Complaint: The right to complain to the UK Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.

To exercise any of these rights, contact us at support@learnincurve.com.

8. Links to Other Websites

Our platform, blog, or newsletter may contain links to external third-party websites or services that are not owned or controlled by Learn in Curve. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We encourage you to review the privacy policy of every site you visit.

9. Children's Privacy

This service is intended for working professionals studying for professional certifications. Our Terms of Service require you to be at least 18 to create an account. This service is not directed at, or intended for, anyone under 18, and we do not knowingly collect personal data from anyone under that age.

10. Security

We rely on the enterprise-grade infrastructure security of Supabase and Stripe (both holding industry certifications such as SOC 2 and PCI-DSS compliance) rather than storing sensitive financial data ourselves. Row-Level Security (RLS) is enabled on every database table holding personal information, ensuring that users can access only their own individual data rows.

11. Changes to This Policy

We will update the "Last updated" date at the top of this page whenever updates occur. For material changes (such as adding a new third-party processor or collecting a new category of data), we will actively notify registered users via email.

12. Contact Us

If you have any questions, concerns, or data rights requests regarding this Privacy Policy, please email: support@learnincurve.com

Privacy Policy | Learn in Curve