Privacy Policy

1. Who we are and how to contact us

MrPractice provides computer-delivered exam practice for individual learners. For privacy questions, data subject requests, or to contact our data protection contact, email hello@mrpractice.app. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been infringed.

2. Scope

This Policy applies to personal data processed through mrpractice.app and related learner Service features, including magic-link authentication, onboarding, diagnostics and mocks, speaking uploads, wallet and shop purchases, referral attribution, and affiliate-facing learner views where available.

It does not cover third-party websites or services that we do not control (for example, Paystack’s hosted checkout pages), which are governed by their own privacy notices.

3. Personal data we collect

We collect personal data that you provide directly, data generated when you use the Service, and limited data from payment and infrastructure providers acting on our instructions or as independent controllers for their own purposes.

• Account and authentication data: email address; magic-link tokens and related security metadata; session and JWT identifiers needed to keep you signed in.
• Profile and onboarding data: display name or similar identifiers you choose to provide; exam interests; target score; country/region and other profile fields you submit.
• Practice and assessment data: attempt records; answers; timing and progress; scores and review outputs; diagnostic and mock history; trends where enabled.
• Speaking and media data: audio recordings and related upload-session metadata (for example asset identifiers and duration) when you complete speaking tasks.
• Commercial data: shop selections; token and wallet balances; purchase confirmations; transaction references returned by our payment provider; refund or support correspondence related to billing.
• Referral and affiliate data: referral codes you enter or arrive with; attribution records; affiliate display information shown to you when linked.
• Technical and device data: IP address, browser type, device and operating-system information, approximate location derived from IP, pages viewed, referral URLs, and diagnostic logs needed to operate and secure the Service.
• Communications: messages you send to us (for example support emails) and related metadata.

4. How we collect personal data

We collect data when you request a magic link, complete onboarding, practise, upload speaking responses, browse authenticated pages, apply a referral code, initiate checkout, or contact us. We also receive payment status and limited transaction metadata from Paystack after you complete or abandon hosted checkout, and may receive technical logs from hosting, storage, and email delivery providers that process data on our behalf.

5. Purposes of processing

We process personal data only for specified, explicit, and legitimate purposes, including to:

• Create and secure your account, send magic-link emails, authenticate sessions, and prevent unauthorised access.
• Deliver diagnostics, mocks, results, review, speaking upload/confirm flows, and related learner features.
• Process token purchases, maintain wallet balances, fulfil shop orders, and resolve payment delivery issues.
• Operate referral attribution and affiliate-related learner features where applicable.
• Provide customer support and respond to privacy or account requests.
• Monitor reliability and security, debug faults, prevent fraud and abuse, and enforce our Terms of Service.
• Improve product quality and learning experience using aggregated or de-identified insights where feasible.
• Comply with legal obligations and defend legal claims.
• Send service-related notices (for example authentication, purchase confirmation, or material changes to this Policy). Marketing communications, if introduced, will be sent only where permitted by law and with a clear opt-out.

6. Lawful bases for processing

Depending on the activity and applicable law, we rely on one or more of the following lawful bases under the NDPA:

• Contract: processing necessary to provide the Service you request (account access, practice delivery, token fulfilment).
• Consent: where we ask for consent (for example certain optional profile fields or future non-essential cookies/analytics). You may withdraw consent where processing is consent-based, without affecting prior lawful processing.
• Legitimate interest: operating, securing, and improving the Service; preventing fraud and abuse; limited product analytics — balanced against your rights and freedoms.
• Legal obligation: retaining records or disclosing information where required by law, regulation, or competent authority.
• Vital interests or public interest: only where applicable and strictly necessary.

7. Payments

Purchases are processed through Paystack’s hosted checkout. MrPractice does not store full card numbers, CVV, or complete payment-instrument credentials on our servers. We retain payment confirmations, transaction references, amounts, currency, status, and wallet/token grant records so we can deliver what you bought and support billing inquiries.

Paystack processes payment data under its own terms and privacy notice. We encourage you to review Paystack’s documentation when you pay.

8. Cookies, local storage, and similar technologies

We use essential storage technologies required for the Service to function, including session credentials and preferences needed for authentication and navigation. We may also store referral codes or related attribution identifiers in local browser storage so a referral can be applied after sign-in.

If we introduce non-essential analytics or advertising cookies, we will update this Policy and, where required, obtain consent or provide appropriate controls before doing so.

9. How we share personal data

We do not sell your personal data. We share personal data only as needed to operate the Service or as required by law, including with:

• Service providers / processors: hosting, storage (including speaking upload storage), email delivery, security, and payment infrastructure providers that process data on our instructions under appropriate contractual safeguards.
• Payment provider: Paystack, for checkout and payment confirmation.
• Affiliates (limited): if you use a referral code, we may process attribution data needed to credit the referring affiliate according to our commercial arrangements; learner-facing views may show limited affiliate display information.
• Professional advisers and authorities: where reasonably necessary for legal compliance, dispute resolution, or to protect rights, safety, and security.
• Business transfers: if we undergo a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be transferred as part of that transaction subject to continued confidentiality and applicable law.

10. International transfers

Your data may be processed in Nigeria and in other countries where we or our service providers operate. Where personal data is transferred outside Nigeria, we take steps required by the NDPA and GAID to ensure an adequate level of protection, which may include contractual safeguards, reliance on adequacy decisions or permitted derogations, and vendor due diligence.

11. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including to provide the Service, maintain wallet and purchase records, resolve disputes, enforce agreements, and meet legal, tax, or accounting requirements.

Typical retention practices include: account and practice history while your account remains active and for a reasonable period thereafter; speaking audio and attempt artefacts for as long as needed for review, grading workflows, quality, and dispute handling; payment and wallet records for periods required by financial and consumer rules; and security logs for shorter operational windows unless needed for investigations. When data is no longer required, we delete or irreversibly anonymise it where practicable.

12. Security

We implement technical and organisational measures appropriate to the risk, which may include encryption in transit, access controls, least-privilege internal access, secure token-based authentication, and monitoring for abuse. No method of transmission or storage is completely secure; you are responsible for protecting access to your email inbox used for magic links and for not sharing authentication links.

13. Your rights

Subject to the NDPA and applicable exceptions, you may have the right to:

• Be informed about how your personal data is processed (including through this Policy).
• Access personal data we hold about you.
• Request rectification of inaccurate or incomplete personal data.
• Request erasure of personal data in certain circumstances.
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on consent.
• Request data portability where technically feasible and legally applicable.
• Lodge a complaint with the NDPC.

To exercise these rights, email hello@mrpractice.app with sufficient detail for us to verify your identity and respond. We will respond within the timelines required by applicable law. Some requests may be refused or limited where the law permits (for example where retention is required for legal compliance or to establish, exercise, or defend legal claims).

14. Children

The Service is directed at individuals who can lawfully enter into these arrangements and prepare for exams as individual learners. We do not knowingly collect personal data from children under 13 (or under the minimum age required in your jurisdiction for such services without parental authority). If you believe a child has provided personal data to us, contact hello@mrpractice.app and we will take appropriate steps to delete it where required.

15. Automated decision-making

We use automated systems to score practice attempts, generate review outputs, and operate product features. These processes support exam preparation and do not constitute legal or similarly significant decisions about you outside the Service. Official IELTS results are issued only by authorised test organisations, not by MrPractice.

16. Third-party links

The Service may contain links to third-party sites or services. Their privacy practices are outside our control. You should review their policies before providing personal data to them.

17. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of the page will change when we do. Material changes will be indicated by updating this page and, where appropriate, by additional notice (for example email or in-product notice). Continued use of the Service after the effective date of changes constitutes acceptance of the updated Policy to the extent permitted by law.

18. Contact

Privacy requests and questions: hello@mrpractice.app. Website: https://mrpractice.app.