Legal

Privacy

QEBoys.com (part of UniGenius) is run by Uni Admissions Prep Ltd, trading as UniGenius, which sells every course and licence on this site. This page explains what the product stores and why.

Who controls the data?

Uni Admissions Prep Ltd is the data controller for data collected on this site: Uni Admissions Prep Ltd, trading as UniGenius (company 17325935, registered in England and Wales), registered office 28 Denton Close, Barnet EN5 3AP, United Kingdom. Contact support@unigenius.co.uk for privacy questions or requests, and for product support.

Accounts and purchases

When you create an account, we store your email address, the account timestamps and the exam surface where you signed up. If you set a password, we store a one-way password hash rather than the password. If you use Google sign-in, we also store the Google account identifier and any name or profile-photo URL Google provides. A signed-in session is represented by an HttpOnly cookie.

If you buy a course for your child and give their email address, we keep it with that purchase and send it one email with the link that moves the course to their own account. We use it for nothing else, and we remove it from the purchase once they accept the link or you delete your account.

If you buy access, we store the purchase, product, amount, currency, status, buyer email and the Stripe checkout, payment and customer identifiers needed to grant access, handle refunds and support the transaction. Checkout may also collect your billing address and VAT ID so Stripe can determine the tax treatment and put it on your receipt. Stripe processes payment details; UniGenius does not receive your full card number.

Learning and saved results

Anonymous learning uses a signed session cookie. A diagnostic run can store its platform, selected modules, questions, responses, timing and computed result before an account is required. If you choose to save an ESAT result, the run is linked to your account and its associated attempts are linked to the same account.

Saving a result uses a short-lived, HttpOnly claim cookie. It expires after 10 minutes, is restricted to the ESAT API path, and is cleared after the handoff. The server stores a hash of the receipt rather than the receipt value. Optional product measurement is recorded only after you accept its consent prompt; that record contains the consent version and time plus an activation event with no direct contact fields, but it can be linked to the diagnostic run.

Reminders, cookies and analytics

If you request a deadline reminder, we store your email address, the reminder requested, the consent wording version and signup time in private storage. Deadline-reminder messages are not currently sent. The UCAT and LNAT programme-interest forms additionally store the role and £199 price-interest response you select, alongside the consent version and signup time; they do not create an account, charge you or grant course access. The former application-programme enquiry, which is closed, stored the selected role, exam route and proposed tier with the email, consent version and signup time; those stored enquiries are kept under the same rules and no automatic customer message is sent about them. It never created an account, charged you or granted programme access. If you opt in to ESAT prep updates after the diagnostic, your address is added to the UniGenius Resend list for occasional updates. You can unsubscribe from those updates at any time. We do not sell personal data.

Guest and standard signed-in account session cookies expire after 180 days. A checkout-created authenticated session expires after 30 days. Learning diagnostic session cookies expire after 30 days, and the Google sign-in state cookie expires after 10 minutes. Expiry stops a cookie being accepted. Session and claim records are not currently removed by an automatic cleanup job. UCAT calibration attempt records are a separate ephemeral store: they expire within 30 minutes and are purged opportunistically when that route is used; consented UCAT measurement events are retained for up to 90 days and then purged by the same cleanup. Account, purchase, diagnostic and reminder records do not currently have an automatic deletion schedule. Vercel Analytics is separate from the consent-gated product measurement described above and may process analytics data when enabled on the deployment.

When you arrive from an ad or a link with campaign tags, or on your first visit from another website, we keep where you came from in a first-party cookie for 90 days: the campaign tags, the referring site and, for a Google ad, Google's click id. When you create an account or buy, we copy it onto that account or purchase and into the payment record so we can tell which ads and links lead to sign-ups and sales. We may send Google the click id, the time and the value of a sign-up or purchase that came from a Google ad, so it can count the conversion; we send no name or email address. If you allowed measurement, we may also tell Google Analytics that a purchase happened, with its value, the product, the campaign tags and an id made from the purchase, never your name, email or device. Browsers that send Global Privacy Control or Do Not Track get no such cookie, and turning measurement off below removes it.

Optional measurement

Each course site asks once whether it may count your visit. Only if you allow it, it records which pages of the course you reach (for example the price page, the buy button, opening checkout and a completed purchase), with the product, the price shown, the screen size class (phone, tablet or computer) and the free page that led there. It stores no name, email, answers or device identifier, and it is not used for advertising. Do Not Track and Global Privacy Control turn it off. You can change your choice here at any time.

On ESATGenius and LNATGenius the question also asks to link your visit to your account if you sign up or buy. If you allow it, we keep a random cookie for 30 days and record the kind of site that sent you (for example a search engine, a forum or one of our own emails, never the address or what you searched), the course page you started on, which free tasks you started or finished, and, if you go on to sign up or buy, that account and order. This tells us which pages and free tasks lead to real customers. The visit record is deleted after 90 days and the link on your account and orders after 12 months. Turning measurement off ends the link straight away on every site where you are signed in. Your orders and payments are kept either way, as the law requires.

Service providers

Vercel hosts the site, may process request and analytics data, and stores reminder leads in private blob storage. Supabase hosts the application database, including support messages received at our published support address. Google handles optional sign-in and returns the verified account identity. Stripe handles checkout and payment processing. In the iPhone app, Apple handles Sign in with Apple and App Store purchases. Resend sends ESAT updates, password-reset and paid-course welcome email when those features are enabled, and receives support email sent to the live UniGenius support address for routing into our support inbox. OpenRouter passes messages to Mia, our AI tutor, and written answers sent for AI marking to DeepSeek's models; it receives the message or answer and the question it is about, never your name or email address. ElevenLabs makes our spoken lesson audio and, if you bought the IELTS Writing and Speaking System with audio and record a Speaking answer, transcribes that recording: it receives the recording only, never your name or email address. We do not store recordings: each is held in memory while it is transcribed and deleted when the transcript returns. We keep the transcript as your answer until you delete it or your account, and each recording's length and timing counts, used to count your monthly minutes, until you delete your account.

The database (Supabase) and the site's servers (Vercel) run in the eastern United States, Resend sends email from Ireland, and OpenRouter is a United States company. Supabase, Vercel and Resend work under their data processing agreements; OpenRouter under its published terms and privacy policy.

Access and deletion

You can delete your account yourself: sign in, open your account page (or Account in the iPhone app) and choose Delete account. This deletes your account, progress, answers, saved results, reminders, devices, sign-in identities, email preferences and the interest forms you sent with that address, and signs you out on every device. It also removes the address from our email list and, if you use Sign in with Apple, revokes that sign-in with Apple. We keep the payment records the law requires (product, amount, currency, dates and payment references) with no link to your name, email or account, support emails you sent us, the owner security log, and, if you unsubscribed, a record that the address must not be emailed.

You can also ask us to access, correct or delete account, learning, reminder or other personal data, and you can withdraw reminder or measurement consent. Email support@unigenius.co.uk and include the address concerned and the request you want us to handle.