DecipherU
Sign inStart practicing

GDPR

Bespoke Intermedia LLC. Effective September 1, 2026.

This page says what the what we keep page says, with the article numbers, for people in the European Economic Area, the United Kingdom and Switzerland.

Controller

Bespoke Intermedia LLC, a Florida limited liability company, is the controller for personal data collected through decipheru.com. We have no establishment in the EU and have not appointed an EU representative under Article 27 because our processing is occasional, does not involve special categories of data, and is unlikely to result in risk to your rights. Contact: privacy@decipheru.com.

Data we process

Account data (email, name, sign-in identifiers, through Clerk), and practice events: which answer you chose on each question, whether it was right, how long it took, and whether you changed your mind before submitting; how sure you said you were (sure, think so, guess); when you open the source document shown after a question; when you flag a question and the note you type; when a practice session starts and ends; the exam date you set; the exam outcome you report (passed or not, the score band if you give it, which domains felt weak, which attempt it was); your answers to the follow-up questions we send about 90 and 180 days after the exam; profile answers you give voluntarily (prior experience, current and target role, hours per week, country, exam language, materials used, how you heard about us); the channel that brought you here (search, a link, direct) and the type of device you use (phone, tablet, desktop). We process no special categories of data.

Legal bases (Article 6)

Running the tool and your account: Article 6(1)(b), performance of a contract. Working out which practice predicts passing, improving the questions, and keeping the site secure: Article 6(1)(f), legitimate interest; our interest is understanding exam readiness, and the balancing test favours it because the data is pseudonymous, never sold, and published only in aggregate, and because you can opt out at /privacy/opt-out. Analytics and marketing cookies, and the reminder and follow-up emails: Article 6(1)(a), consent, withdrawable at any time through the cookie banner or the unsubscribe link. Responding to legal requests: Article 6(1)(c).

Your rights (Articles 15 to 22)

You can ask for access (Article 15), rectification (16), erasure (17), restriction (18), a portable copy in JSON (20), and you can object to processing based on legitimate interest (21). The readiness reading is automated but has no legal or similarly significant effect, so Article 22 does not apply; you can still ask a person to review or explain it. Make a request at /data-request or by email; we answer within one month, extendable by two months for complex requests, and we tell you if we need the extension. You can complain to the supervisory authority where you live.

Processors (Article 28)

Each processor is bound by a data processing agreement.

  • Vercel: Hosting, edge compute, and page-level traffic analytics. United States. Required to run the site. Privacy policy.
  • Supabase: Postgres database hosting. United States (eu-central available on request). Required to run the site. Privacy policy.
  • Clerk: Authentication and identity. United States. Required to run the site. Privacy policy.
  • Stripe: Payment processing. United States with EU sub-processing. Required to run the site. Privacy policy.
  • Resend: Transactional email delivery. United States. Required to run the site. Privacy policy.
  • Anthropic: AI inference for scenario explanations and coaching. United States. Required to run the site. Privacy policy.
  • Sentry: Error monitoring. United States. Required to run the site. Privacy policy.
  • PostHog: Product analytics. United States with EU hosting available. Only with analytics consent. Privacy policy.
  • Microsoft Clarity: Session replay and heatmaps. United States. Only with analytics consent. Privacy policy.
  • Google Analytics: Web analytics. United States. Only with analytics consent. Privacy policy.
  • Meta (Facebook): Advertising pixel and Conversions API. United States. Only with marketing consent. Privacy policy.
  • LinkedIn: Advertising insight tag. United States. Only with marketing consent. Privacy policy.

Transfers (Chapter V)

Data is stored in the United States. Transfers rely on the standard contractual clauses in each processor's data processing agreement and, where the processor is certified, on the EU-US Data Privacy Framework and its UK extension. Supabase can host in eu-central and PostHog offers EU hosting; ask if you need your data kept in the EU.

Retention (Article 5(1)(e))

Practice events are kept for research for as long as the tool exists, because pass rates and forgetting curves only make sense over years; this is the purpose they were collected for. Account data is kept while the account exists. On an erasure request we delete the account and every event tied to it within 30 days. Published aggregates stay, because nobody can be identified from them.

Children

The site is for people 18 and over. We do not knowingly process data about anyone younger; tell us at privacy@decipheru.com and we will delete it.