legal
Privacy notice
Who is responsible for your data
Caddiesoft Norge AS, Norway, runs Examcurrent and is the data controller for the data described here, except payment data handled by Paddle (see below). Contact: support@examcurrent.com. Postal address: Grønnegata 85, 2317 Hamar, Norway. No data protection officer is appointed. Privacy questions go to support@examcurrent.com.
What we collect and why
| Data | Why we need it |
|---|---|
| Email address | To create your account, send sign-in links and send service emails about your access. |
| Sign-in sessions | To keep you signed in on your device. We store only a hash of the session token. The session cookie (ec_session) is HttpOnly and lasts 30 days. Expired sessions are deleted. |
| IP address hash (sign-in link requests) | When someone requests a sign-in link, we store a keyed hash of their IP address. It is used only to limit how many links can be requested. It is deleted together with the sign-in link record after one hour. |
| Purchases and entitlements | To record what you bought and which exam you may access. Receives the purchase details from Paddle. |
| Practice and exam attempts | To run timed sittings, show your results and readiness estimate, and check refund conditions. |
| Technical data | Basic server logs for security and to keep the site running, such as IP address and time of request. |
The site sets one cookie: the sign-in session cookie (ec_session). It is HttpOnly and lasts 30 days. No analytics or marketing cookies are used, and we use no advertising trackers.
Legal basis
- To provide your account and the product you bought: performance of a contract (GDPR Article 6(1)(b)).
- To keep accounting and tax records: legal obligation (Article 6(1)(c)).
- To keep the service secure and prevent abuse: legitimate interest (Article 6(1)(f)).
Who receives your data
- Neon stores our database. The database is in the EU (Frankfurt, Germany).
- Vercel hosts the website and runs the application code. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, and its Data Processing Addendum includes the EU Standard Contractual Clauses.
- Resend sends our emails, including sign-in links. Resend is certified under the EU-U.S. Data Privacy Framework, and its Data Processing Addendum includes the EU Standard Contractual Clauses.
- Paddle is the merchant of record. Paddle takes your payment, handles billing and tax, and tells us about each completed purchase. Paddle processes your payment and billing details as a separate controller under its own privacy notice.
We do not sell your data.
How long we keep it
- Account and attempt data: kept for 24 months after your last sign-in, then deleted. You can ask us to delete it sooner.
- Purchase and invoice records: kept for 5 years, as required by Norwegian bookkeeping rules.
- Sign-in links: expire after 15 minutes. The IP address hash is deleted with the sign-in link record after one hour.
- Sessions: expire after 30 days. Expired sessions are deleted.
- Server logs: the hosting provider (Vercel) keeps runtime logs for 1 day on our plan.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where the law allows;
- restrict or object to some processing;
- receive your data in a portable form;
- withdraw consent, where we rely on it.
To use a right, email support@examcurrent.com. We will reply within one month. You can complain to the Norwegian Data Protection Authority (Datatilsynet) or to the authority in your own country.
Keeping your data safe
We store only a hash of sign-in and session tokens, not the token itself. We limit who can access production data.
Children
Examcurrent is for adults preparing for professional certifications. We do not knowingly collect data from children.
Changes to this notice
We will post changes here and, for material changes, tell you by email.