Privacy Policy

Passcend ("we", "us", "our") is an online exam preparation platform for ISTQB certifications, operated at passcend.ai. We are not affiliated with or endorsed by ISTQB®.

If you have any questions about this policy, contact us at privacy@passcend.ai.

• Account data: name, email address, hashed password (if registered with email/password).
• OAuth data: name and email provided by Google or GitHub when you sign in via those providers. We do not receive your OAuth password.
• Exam data: your answers, scores, time taken, question difficulty history, and ability estimates generated by our Item Response Theory engine.
• Payment data: Stripe processes all payments. We store only your Stripe customer ID and purchase record — we never see or store your card details.
• Usage data: pages visited, exam sessions started, AI features used, and approximate timestamps of these actions.
• Security data: two-factor authentication setup status (we store a TOTP secret, encrypted at rest by Supabase).

• To provide and operate the platform (authenticate you, serve questions, track progress).
• To personalise your learning experience using our adaptive difficulty engine.
• To generate AI-powered hints, explanations, and exam summaries via Anthropic's Claude API.
• To process payments and manage your subscription tier via Stripe.
• To send transactional emails (password resets, purchase receipts) via Resend.
• To monitor errors and platform health via Sentry (error reports may include your user ID).
• To detect abuse and enforce rate limits.

We do not sell your data. We do not use your data for advertising.

When you use AI-powered features (hints, explanations, gap analysis, exam summaries), your question text and answer data is sent to Anthropic's API to generate a response. Anthropic's privacy policy applies to this processing. We do not send your name or email to Anthropic.

Your data is stored in a PostgreSQL database hosted on Supabase (US region). Data is encrypted in transit (TLS) and at rest. We use industry-standard security practices including hashed passwords (bcrypt) and optional two-factor authentication.

While we take reasonable steps to protect your data, no system is completely secure. Please use a strong, unique password and enable two-factor authentication.

We retain your account and exam data for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes (e.g. purchase records).

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Export your exam history (available via Settings → My Progress → Download CSV).

To exercise these rights, email privacy@passcend.ai.

We use a single session cookie to keep you logged in. We do not use tracking cookies or third-party advertising cookies.

Passcend is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this policy from time to time. We will notify registered users of material changes by email. The "last updated" date at the top of this page will always reflect the current version.