Privacy Policy
Last updated: 19 October 2026.
This policy explains how PassBritain (https://passbritain.co.uk) collects and uses your personal data, and your rights under the UK GDPR and the Data Protection Act 2018.
1. Who we are
The data controller is the sole trader below.
James Hoy, a sole trader trading as PassBritain.
378 Godstone Road, Whyteleafe, CR3 0BA, United Kingdom
Not VAT registered.
2. What data we collect
| Data | Where it comes from |
|---|---|
| Your email address | You, when you sign up, sign in or join the newsletter |
| Account and subscription status (plan, start/end dates, renewal and cancellation status, Stripe customer reference, immediate-access consent timestamp) | Created when you buy, with information from Stripe |
| Sign-in tokens and session data (magic-link tokens, session cookie) | Created when you sign in |
| Study and usage data (tests taken, answers, scores, progress, flashcard and daily question activity) | Created when you use the service |
| Technical data (IP address, browser and device type, dates and times of requests, error logs) | Collected automatically by our hosting provider |
| Messages you send us | You, when you email us |
| Transaction records (amount, date, plan, billing country, last four card digits as provided by Stripe) | Stripe |
Card details: payments are handled by Stripe. Your full card details go directly to Stripe and are never stored by us.
We do not collect special category data (such as health or ethnicity), and we do not ask about your immigration status.
3. Why we use your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, sending sign-in links, giving you access, saving your progress, taking payments and managing your subscription | Contract – we need it to provide the service you bought |
| Sending service emails (receipts, order confirmation, renewal and price-change notices) | Contract, and legal obligation where the law requires the notice |
| Keeping the site secure, preventing fraud, account sharing and abuse, and fixing errors | Legitimate interests – protecting our service and our users |
| Answering your questions and handling complaints | Legitimate interests (or contract where it relates to your purchase) |
| Keeping financial records for tax and accounting | Legal obligation |
| Marketing emails (only if we ever send them, including the newsletter) | Consent – we will ask first, and you can unsubscribe at any time |
We do not sell your data and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share your data with
We use trusted service providers (processors) who act on our instructions:
| Provider | What they do |
|---|---|
| Stripe | Payment processing and subscription billing |
| Resend | Sending sign-in links and service emails |
| Vercel | Website hosting (processes technical data such as IP addresses) |
| Neon | Database hosting (stores account, subscription and progress data) |
Stripe may also act as an independent controller for some data, for example to meet its own legal and fraud-prevention duties. See Stripe’s privacy policy at https://stripe.com/privacy.
We may also share data if the law requires it (for example, with HMRC), or with professional advisers such as an accountant.
5. International transfers
Some of our providers (including Vercel and Resend, and possibly Stripe and Neon) are based in, or may process data in, the USA or other countries outside the UK. When data is transferred outside the UK, we make sure it is protected by:
- UK “adequacy” regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), or
- the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, included in the provider’s data processing terms.
You can ask us for more details at hello@passbritain.co.uk.
6. How long we keep your data
| Data | How long |
|---|---|
| Account, subscription and progress data | While your account is active, then deleted within 30 days of you closing it. If your account has had no paid access and no sign-in for 24 months, we will delete it. |
| Magic-link sign-in tokens | Expire after 20 minutes or once used, then deleted |
| Session cookies | Until you sign out or the session expires after 90 days |
| Technical logs | Kept by our hosting provider for a short period, normally no more than 30 days |
| Payment and transaction records | 6 years after the end of the tax year they relate to, for HMRC |
| Emails and complaints | Up to 2 years after the matter is resolved |
7. Your rights
You have the right to:
- access a copy of your personal data
- rectification – ask us to correct inaccurate data
- erasure – ask us to delete your data
- restriction – ask us to limit how we use your data
- object – to our use of your data based on legitimate interests, and to direct marketing at any time
- data portability – receive data you gave us in a common, machine-readable format
- withdraw consent – where we rely on consent, at any time (this does not affect anything we did before)
Some rights have limits. For example, we must keep transaction records for tax purposes even if you ask us to delete your account.
How to use your rights: email hello@passbritain.co.uk from the email address on your account. We may ask you to confirm your identity. It is free. We will respond within one month. If your request is complex, we may extend this by up to two more months and will tell you why.
8. Complaints
If you are unhappy with how we use your data, please contact us first at hello@passbritain.co.uk and we will try to resolve it.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: https://ico.org.uk or 0303 123 1113.
9. Cookies
We only use essential cookies needed to sign you in and keep you signed in (session cookies) and to keep the site secure. These do not need your consent because the service cannot work without them. In demo mode we may also set a cookie to remember a simulated purchase.
We do not use advertising, analytics or tracking cookies. If we add analytics or other non-essential cookies in future, we will update this policy and ask for your consent first where the law requires it.
10. Social media
We promote PassBritain with short quiz videos on social media. If you interact with us on those platforms (for example by liking, commenting or messaging), the platform’s own privacy policy applies to that data. If you contact us there, we will only use your details to reply.
11. Children
PassBritain is intended for adults aged 18 and over. We do not knowingly collect data from children. If you think a child has given us their data, contact us and we will delete it.
12. Security
We take reasonable steps to protect your data, including encrypted connections (HTTPS), passwordless sign-in links that expire, and access controls on our systems. No system is completely secure, so please keep your email account safe.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make important changes, we will tell you by email or on the site.
14. Contact
About us / contact
James Hoy, a sole trader trading as PassBritain.
378 Godstone Road, Whyteleafe, CR3 0BA, United Kingdom
Not VAT registered.
Government information about the Life in the UK test is on GOV.UK: https://www.gov.uk/life-in-the-uk-test. PassBritain does not give immigration advice.