Privacy Policy
1. Who we are
Crack The UCAT is a UCAT question bank operated by Crack The UCAT Ltd, a company registered in England and Wales (company number 17036097).
We are the data controller for the personal information described in this policy. This means we decide what information is collected and what it is used for, and we are responsible for looking after it.
We are registered with the Information Commissioner's Office (ICO), registration number 00014734848.
To contact us about your information, email contact@cracktheucat.com. We will reply to general questions within five working days, and to formal requests about your rights within one month.
2. What this policy covers
This policy explains what personal information we collect when you use the Crack The UCAT website and question bank, why we collect it, how long we keep it, who we share it with, and what control you have over it.
It applies to anyone who creates an account, purchases access, or contacts us. It does not cover any other website we link to, as those sites have their own privacy policies.
3. What information we collect
We collect as little as possible.
Information you give us
- Your email address, used to log in, recover your account, and receive service messages.
- A username, which you choose. You do not have to use your real name.
- Your password. This is stored using one way encryption, so we cannot see it. If you forget it, we can reset it but never retrieve it.
- Your accessibility and display preferences, such as timing, theme, and font settings. Some of these features are still in development, and any preference you set will be saved and applied once that feature is live.
- Anything you write to us, including support messages, feedback on questions, and emails.
Information created when you use the question bank
- Questions you attempt, the answers you give, and whether they were correct.
- Time taken per question.
- Scores, mock results, and progress over time.
- Which sections and subtypes you practise, and where your weak areas are.
- Lessons viewed and features used.
Information collected automatically
- Your IP address.
- Device type, browser, and operating system.
- Pages visited and how long you spend on them.
- Cookie data (see section 10).
Payment information
We do not collect or store your card details. Payments are handled by PayPal, who process your card information directly under their own privacy policy. We receive only confirmation that a payment succeeded, along with the amount, date, and a transaction reference.
4. Why we use your information, and our legal basis
We must have a lawful basis for everything we do with your information. This is the full list.
| What we do | Why | Lawful basis |
|---|---|---|
| Create and manage your account | So you can log in and use the question bank | Contract |
| Save your practice history and scores | So your progress and statistics work | Contract |
| Analyse your performance to show weak areas | So the platform can tell you what to work on | Contract |
| Apply your accessibility and display settings | To make the platform usable for you | Contract |
| Take payment and issue receipts | To complete your purchase | Contract |
| Keep financial records | Required by HMRC | Legal obligation |
| Provide support and answer your questions | To help you when something goes wrong | Legitimate interests |
| Review how questions perform across all users to improve question quality, difficulty ratings, and weak-area targeting | So the question bank improves over time | Legitimate interests |
| Prevent account sharing, fraud, and misuse | To protect our content and other users | Legitimate interests |
| Send you marketing emails about our products | To tell you about new features and releases | Consent |
We look at how each question performs across all users, such as how many people answer it correctly, how long it takes, and which wrong answers are chosen most often. This shows us which questions are unclear or mis-rated and helps the platform target your weak areas more accurately. This analysis uses combined data across all users, and nothing that identifies you is published.
Where we rely on legitimate interests, we have checked that our interest does not override your rights. You can ask us to explain this and you can object (see section 9).
Where we rely on consent, you can withdraw it at any time. Every marketing email has an unsubscribe link, and withdrawing consent will never affect your access to the question bank.
5. Younger users
Most people preparing for the UCAT are 16 to 18, so we assume our users include under 18s.
We do not ask your age. We have chosen not to collect date of birth or age because we do not need it, and collecting it would mean holding more information about you than necessary.
The ICO's Age Appropriate Design Code sets rules for online services used by under 18s, and it applies to us. Since we do not ask your age, we apply its protections to every account:
- We collect only what we need to run your account, which is an email address and a username.
- We do not require your real name.
- We do not profile you for advertising, sell your data, or share it with advertisers.
- Your practice data is used only to help you improve and to improve the question bank.
- Privacy settings default to the most protective option.
- We write this policy in plain language.
We only send marketing emails to people who have opted in, and you can unsubscribe at any time.
If you have purchased access for someone else, or have a concern about an account, email contact@cracktheucat.com. Because we do not collect names or ages, we will need the account's email address to identify it, and we may need to verify that you are entitled to make the request.
6. Who we share your information with
We do not sell your personal information, and we do not share it with advertisers.
We share it with a small number of service providers who help us run the platform. Each is bound by a contract requiring them to protect your data and use it only on our instructions.
| Who | What they do | What they receive |
|---|---|---|
| Hosting provider | Hosts the website and database | Your account and practice data, stored securely |
| PayPal | Processes payments | Your email address and payment details |
| Email platform | Sends account and marketing emails | Your email address and username |
| Analytics provider (if used) | Reports how the site is used | Anonymised or pseudonymised usage data |
We may also disclose information if legally required to, for example in response to a court order, or where there is a safeguarding concern involving risk to a young person.
7. Where your information is stored
Our systems are hosted in the United Kingdom.
Some service providers may process data outside the UK. Where that happens, we make sure the transfer is protected by an approved safeguard, such as UK International Data Transfer Agreement clauses or an adequacy decision. You can ask us for details for any particular provider.
8. How long we keep your information
| Type of information | How long we keep it |
|---|---|
| Account details, preferences, and practice data | While your account is active, then 12 months after your last login |
| Deleted accounts | Removed from live systems within 30 days, and from backups within 90 days |
| Payment and invoice records | 7 years, as required by HMRC |
| Marketing contact details | Until you unsubscribe, then removed within 30 days apart from a record of your email address kept only so we do not contact you again |
| Support and feedback emails | 2 years |
| Combined question performance statistics | Indefinitely. Once combined across all users, this contains nothing that identifies you |
You can ask us to delete your account and data sooner (see section 9).
9. Your rights
Under UK GDPR you have the following rights, and exercising any of them is free.
- Access: ask for a copy of the personal information we hold about you.
- Correction: ask us to fix anything wrong or incomplete.
- Deletion: ask us to delete your information. We may need to keep payment records for tax, but everything else can go.
- Restriction: ask us to pause using your information while a dispute is resolved.
- Portability: ask for your information in a machine readable format.
- Objection: object to processing we carry out under legitimate interests.
- Withdraw consent: unsubscribe from marketing at any time.
To exercise any of these, email contact@cracktheucat.com. We will respond within one month. Because we hold so little about you, the email address on your account is the main way we can identify it, so please contact us from that address where possible.
10. Cookies
Cookies are small files stored on your device.
Essential cookies keep you logged in, remember your accessibility and display settings, and keep the site secure. These are necessary for the platform to work and are set without asking, because you cannot use the site without them.
When you first visit, you will see a short banner confirming that we use essential cookies. Selecting Accept records your choice, using a cookie, so the banner does not appear again. We do not currently use analytics or advertising cookies; if that changes, we will update this policy and ask for your consent separately where required.
You can clear or block cookies at any time through your browser settings.
11. How we protect your information
- All data sent between your device and our servers is encrypted in transit.
- Passwords are stored using one way encryption and cannot be read by anyone.
- Access to the live database is restricted to named people who need it.
- Anyone working on the platform signs confidentiality and data protection terms before being given access.
- We keep backups so your progress is not lost.
No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will tell you and report it to the ICO within 72 hours of becoming aware of it.
12. Changes to this policy
If we change this policy, we will update the version number and date at the top. If a change materially affects how we use your information, we will email you before it takes effect.
13. How to complain
If you are unhappy with how we have handled your information, please contact us first at contact@cracktheucat.com so we can put it right.
You also have the right to complain to the Information Commissioner's Office at any time: