Privacy Policy

Who is responsible

The controller is the person named below. For any privacy request, write to support@onsetprep.com. onSET Prep is operated from Brazil.

Visiting the website

Our hosting provider Vercel Inc. (USA) processes technical data about each request, such as IP address, browser and device, requested page, referrer, and time, to deliver and secure the site. Logs are kept only as long as operation and security require. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Your account

Sign-in and accounts are provided by Clerk, Inc. (USA). We process your email address, your name if you give it, your sign-in method, and session data to run your account and unlock what you bought. If you buy without signing in, we create the account with the email address you enter at Stripe checkout, or add the purchase to the existing account with that address. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Learning progress

When you are signed in, we store your progress in our database at Neon, Inc. (USA): texts and lessons you completed, scores, time per text, which gaps were right, wrong, or blank, the grammar areas behind them, your review queue, and your settings. We use this for progress, reports, and mistake review, not for advertising. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Payments

Payments are processed by Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA). Card details go directly to Stripe; we never see them. We receive your name, email address, country, the product, amount, payment status, and a receipt link, and we keep a record of each purchase to grant and verify access. Legal basis: performance of a contract and legal retention duties (Art. 6(1)(b) and (c) GDPR).

Emails

We send transactional emails, such as your purchase confirmation, through Resend, Inc. (USA). Legal basis: performance of a contract.

If you ask for the three follow-up emails after a free sample, we store your email address, language, the recommended lesson, and when you signed up, confirmed, and were emailed. We only write after you confirm (double opt-in), and every email has an unsubscribe link. After you unsubscribe, we keep the address as a do-not-email record so we never write again. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

If you contact us through the help form, we receive your email address, your message, the page you were on, and, if you are signed in, your account ID. We answer by email. Legal basis: our legitimate interest in answering you, or the contract if you are a customer.

Analytics and advertising

In the EU/EEA, the UK, Switzerland, and whenever we cannot tell your location, the following services only run after you agree in the cookie banner (Art. 6(1)(a) GDPR). In other countries they run by default; you can switch them off at any time under “Privacy and optional analytics” on the About page.

• PostHog (PostHog, Inc., USA): page views, the referring website and campaign tags (without full addresses), and clearly defined product actions, such as starting a text or finishing a simulation. When optional analytics is allowed, we may also record sessions to find usability problems: page structure, clicks and scrolling. All inputs and visible text are masked before transmission; URL parameters and network bodies and headers are not recorded. Sign-in, sign-up, account, internal and payment pages and support forms are excluded. We do not send names, email addresses, typed answers or payment details in analytics events or session recordings.
• Google Tag Manager and Google Ads (Google Ireland Ltd. / Google LLC, USA): Tag Manager loads the Google services; Google Ads measures with Google Consent Mode whether ads lead to visits and purchases.
• Meta Pixel and Conversions API (Meta Platforms Ireland Ltd.), only if we switch them on: measure whether ads lead to visits and purchases; for purchases this can include a hashed email address, IP address, and browser details.
• RB2B (USA), on marketing pages only: may identify the company whose network a visit comes from and, for visits from the USA, publicly listed business contacts. The training app does not load RB2B.

Cookies and local storage

• onset_consent: your cookie choice (30 days).
• onset_attr: which page or campaign brought you here, used to attribute purchases (30 days).
• Clerk cookies (for example __client, __session, __client_uat): keep you signed in.
• onset-theme and onset-lang in local storage: your color scheme and language.
• Cookies from the analytics and advertising services above (for example ph_*, _gcl_*, _fbp, _reb2b*), only under the rules described above.

Transfers outside the EU

We operate onSET Prep from Brazil, and several providers are based in the USA. Where required, transfers rely on adequacy decisions such as the EU–US Data Privacy Framework or on the EU Standard Contractual Clauses.

How long we keep data

• Account and learning progress: while your account exists; deleted when you delete your account or ask us to.
• Purchase records: as long as tax and commercial law require.
• Follow-up emails: until you unsubscribe; afterwards only the do-not-email record.
• Support messages: as long as we need them to handle your request.

Your rights

Under the GDPR you can request access, correction, deletion, restriction of processing, and data portability, and you can object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. You can also complain to a data protection supervisory authority, in particular in your country of residence.

In Brazil, the LGPD gives you similar rights, including confirmation of processing, access, correction, anonymization or deletion, portability, and information about sharing; you can complain to the ANPD.

For any request: support@onsetprep.com.

Age

onSET Prep is intended for learners aged 16 and over. Younger learners need the consent of a parent or guardian.

Changes

We update this policy when our processing changes. The date at the top shows the current version.