Privacy, explained
without the guesswork.

Information needed for your account.

Your email address, account identifier and verification records support sign-in codes, secure access and essential account messages. Signed-in question-bank attempts and results support Premium My Progress. Guest mini-tests and Workbook chapter checks are separate from that account history.

Marketing preferences and consent records document your optional choice and help honour withdrawals. Checkout references and access records support test checkout and payment administration. Live sales are currently closed.

Account processing supports the service you request; optional marketing and analytics depend on separate consent. Security and essential administration may involve legitimate interests, and future live transactions may require records for legal obligations. The final controller details and processing arrangements must be completed before live sales open.

Request totals are not visitor journeys.

Both stored anonymous counters and optional analytics events are retained for up to 90 days. Withdrawing consent stops future optional collection; contact us to discuss existing information.

Essential access. Device-local learning.

Essential cookies or browser storage remember your privacy choice and maintain secure account sessions. Device-related session controls help protect account access. These functions are separate from optional public-page analytics.

Some free practice results and revision tools use local browser storage. They remain associated with that browser or device and are not automatically imported into account-based question-bank history. Clearing browser storage can remove device-local results and preferences.

Use Cookie settings in the footer to review optional analytics permission. Blocking essential storage may prevent sign-in or requested account features from working.

Signing in is not permission to send offers.

Verification codes and essential account notices are separate from promotional messages. Optional study tips, product news and offers require the marketing choice made during verification. We record that choice and related consent information so withdrawals can be respected.

Withdraw consent through the unsubscribe option in a promotional email, or email contact@belgiumtheory.com. Withdrawal does not cancel account access. A minimal suppression or consent record may be needed to prevent further unwanted messages and demonstrate that your request was honoured.

The services behind the platform.

The platform uses Cloudflare infrastructure for hosting and application storage, Supabase for email-based authentication, Brevo for transactional email delivery and Stripe for hosted checkout. Their roles relate to the relevant service functions; not every provider receives every category of information.

Checkout takes place on Stripe’s hosted payment interface. Our application uses checkout references and access records rather than asking you to email card details. Never send payment-card information through our contact email.

Account and study information is kept while needed to provide the account, address a request or fulfil an applicable legal obligation. Payment and consent records can have different requirements from analytics. The 90-day period above applies to application analytics, not to every provider’s records.

Provider processing locations, international-transfer safeguards and the final retention schedule must be confirmed during the live-sales launch review. We do not claim that all processing stays within Belgium or the EU.

Ask a question. Exercise a choice.

Depending on the information and applicable law, you may request access, correction, deletion, restriction or a portable copy of your personal information. You can withdraw consent and raise an objection where processing relies on legitimate interests. Some records may need to be retained for legal obligations or to protect legitimate rights.

Email contact@belgiumtheory.com from your account address and describe your request. We may need a proportionate way to verify account ownership. Do not send sign-in codes, identity-document scans or card details unless a specific, appropriate verification process has been agreed.

You can also raise concerns with your relevant data-protection authority. This notice explains the service; it is not a guarantee of legal compliance or a substitute for the final business-specific privacy review.