The short version
This site sets no cookies at all. What it keeps, it keeps in your own browser’s local storage, and almost none of it ever reaches us.
There are no learner accounts yet: they open with the quiz bank and full access. The contact form and the notify form open your own email app, and nothing is sent until you press send. Analytics is stored on your device, is never transmitted, and does not run at all unless you switch it on.
The things we genuinely receive are emails you send us, and the server logs Google keeps because Google hosts the site.
Who is responsible for your data
The controller is FootliteCo, Copenhagen, Denmark.
For anything in this policy, including any request about your rights, write to info@footliteco.com. We aim to respond within two business days, and in any event within one month of a rights request.
We have not appointed a data protection officer. Privacy questions go to the address above.
Accounts
To create an account you give an email address and a password. Firebase Authentication, a Google service, holds them for us: the password only in a protected (hashed) form that we cannot read. It also records when the account was created and last used, and whether your email address is verified. We use your email address only to run your account, for example to send the verification and password-reset emails, which come from noreply@foolite-ffar-exams.firebaseapp.com.
The plans your account holds (which plan, when it started and when it ends) are kept in Google Cloud Firestore, under an account number rather than your email address. When we grant or end a plan by hand, we also log the plan, the date and the reason.
While you are signed in, Firebase keeps your session in your browser (in IndexedDB, under firebaseLocalStorageDb) so that you stay signed in; signing out removes it. To close your account and have this data deleted, email info@footliteco.com.
An earlier preview of sign-in kept the details you entered, including your password, as ordinary text in your own browser. It never sent them anywhere, and it has been removed. The next time you visit, the site deletes what it left behind (the ffar_mockUsers and ffar_session keys). You can also clear this site’s data in your browser at any time.
What is stored on your device
No HTTP cookies are set by this site. Everything below is browser local storage, under names beginning ffar_ or ffar-, and it stays on your device until you clear it.
- Quiz progress: which questions you have answered, flagged and scored in a practice or exam set.
- Course progress: which lessons you have visited in a module, and your answers to its checks.
- Exam simulator history: your scores by document for your last 20 papers, which the readiness table uses.
- Theme: whether you chose the dark or light theme.
- Video position: how far through a video you were, if you watch one.
- A storage version marker: which version of the storage format your browser holds.
- Your cookie choice: which categories you accepted, and the version of the categories you were shown.
- Analytics, only if you consent: a random identifier and a log of page views, clicks, video and quiz activity.
The cookie policy lists every key with its exact purpose and how long it lasts.
What actually reaches us
Email. If you write to info@footliteco.com we receive your message, your email address, and anything else you choose to put in it.
The contact form and the notify form open your own email app. They build a pre-addressed message and hand it to your mail client. Nothing is sent until you press send yourself, and the message then travels by email rather than through this site.
Server logs. Google, as our hosting provider, logs requests to the site. Those logs include your IP address, the page requested, the time and your browser’s user-agent string. We run no analytics server of our own, and no page-view data is transmitted to us.
Analytics: what it does and does not do
If, and only if, you consent to the analytics category, the site records events: page views, clicks, form interactions (the values you type are replaced with a placeholder), video and quiz activity, session start and end, and page-load timings. Each event carries a randomly generated identifier, your browser's user-agent string, whether you are on a mobile device, and the page that referred you.
All of it is written to your browser's local storage, and none of it is transmitted. There is no Google Analytics tag, no advertising pixel and no third-party analytics product on this site. Where an event happens to carry a field named as an email address, name, phone number or IP, that field is replaced with a short hash before it is stored; that is a simple obfuscation step, not a security measure.
Turning analytics off deletes the identifier and the stored event log. You can do that at any time from the cookie policy page, or from the cookie preferences link in the footer of every page.
Purposes and legal bases
Purposes of processing and the legal basis relied on for each
| What | Why | Legal basis |
|---|
| Essential browser storage: quiz and course progress, simulator history, theme, video position, storage version, consent record |
To deliver the features you asked for, and to remember the cookie choice you made |
Strictly necessary for the service you requested, so the storage itself does not require consent under the ePrivacy rules as implemented in Danish and UK law |
| Analytics storage, and the events kept in it |
To understand which pages are used and where people get stuck |
Your consent, Article 6(1)(a) UK and EU GDPR. You may withdraw it at any time |
| Your account: email address, password (hashed), sign-in records and the plans you hold |
To let you sign in and to give you the access you have |
Performance of a contract with you, Article 6(1)(b) UK and EU GDPR |
| Answering your email |
To deal with the support or general enquiry you sent |
Our legitimate interest in responding to people who contact us, Article 6(1)(f); or Article 6(1)(b) where your message concerns buying access |
| Hosting server logs kept by Google |
To serve the site and keep it available and secure |
Our legitimate interest in operating and protecting the site, Article 6(1)(f) |
| Price survey answers |
To decide what to charge. Four numbers and which quiz set prompted them: no account, no name, nothing that identifies you. To stop the same person submitting repeatedly we keep a one-way hash of the IP address for an hour, which cannot be turned back into an address |
Our legitimate interest in pricing the product sensibly, Article 6(1)(f) |
| Payments |
Not applicable yet: nothing is for sale |
Will be Article 6(1)(b), performance of a contract, once paid access launches. This policy will be updated first |
Where we rely on legitimate interests you have the right to object; see your rights, below.
How long things are kept
- Browser storage stays on your device until you clear it. Nothing there expires by itself.
- Analytics events, if you consent to them, are pruned to the most recent 90 days whenever the site writes new ones, and are deleted outright when you withdraw consent.
- Your account is kept until you ask us to close it; we then delete it and the plans it holds. A log entry for a plan we granted or ended by hand is kept as a record of that decision.
- Email correspondence stays in our mailbox for as long as it is useful as support history. We have not set a fixed deletion schedule for it and will not pretend otherwise: ask us, and we will delete your correspondence.
- Hosting server logs are kept by Google under Google’s own retention periods for Firebase Hosting. We neither control those periods nor hold a copy of the logs.
Who processes data for us
Google (Firebase Hosting) serves every page, script, stylesheet and image on this site, and so handles every request you make to it, including your IP address. It is our processor for running the site.
Google Cloud Functions in Google’s europe-west1 region deliver the paid questions and course content and check the plans your account holds. Firebase Authentication and Google Cloud Firestore, also Google services, hold your account and your plans, as described under “Accounts” above.
A payment processor is not yet integrated. There is no payment provider, no checkout and no card form anywhere on this site. When one is added we will name it here before it goes live, and we will not handle your card details ourselves.
The typefaces and icons are served from this site itself. The one other address your browser contacts is www.gstatic.com, from which every page loads Google’s Firebase code, so that the site can tell whether you are signed in. That request discloses your IP address, the page you are on and your user-agent string to Google. It sets no cookie on this site.
We do not sell personal data, and we do not share it with anyone for advertising or marketing.
International transfers
The site is served from Google’s global network, so a request from you may be answered by a server outside the EU and the UK, and Google’s log of that request may be processed in the United States. The same is true of the Firebase code your browser fetches from Google, and of your account and plan records, which Google may process in the United States.
For these transfers we rely on the safeguards Google publishes: it states that it relies on the European Commission’s Standard Contractual Clauses and on its certification under the EU–US Data Privacy Framework. We have no separate transfer mechanism of our own, because we operate no servers of our own. If you would like the current details, ask us at info@footliteco.com.
Automated decision-making
There is none. Quiz scoring is a straightforward count of correct answers and produces no decision about you with legal or similarly significant effects. We do not profile visitors and we do not build audience segments.
Your rights
Under the UK and EU GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy of it.
- Rectification of anything inaccurate or incomplete.
- Erasure of your data, in the circumstances the law provides for.
- Restriction of processing while a dispute about accuracy or legitimate interests is resolved.
- Portability of data you gave us that we process by consent or under a contract, in a machine-readable form.
- Object to processing based on our legitimate interests, on grounds relating to your particular situation. You may object to direct marketing at any time; we send none.
- Withdraw consent to analytics whenever you like, as easily as you gave it, without affecting what was lawful before you withdrew it. Use the cookie preferences link in the footer of any page, or the button on the cookie policy page.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. As above, we make no such decisions.
- Complain to a supervisory authority.
How to exercise them: email info@footliteco.com. There is no charge, and we will not ask for more identification than we need to be satisfied it is you. If we cannot identify you from what you send, we will say so rather than guess.
One honest limitation. Most of what this site keeps about you (your preview account, your quiz progress, your analytics events) has never left your device, so we hold no copy and cannot produce, correct or delete it for you. You control all of it directly through your browser's site-data settings, and the cookie preferences control deletes the analytics part for you.
Complaining to a supervisory authority
If you think we have handled your data badly, please tell us first so we have a chance to put it right. You do not have to, and you may complain to a regulator instead.
As we are established in Denmark, the lead authority is Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk). If you are in the United Kingdom you may complain to the Information Commissioner's Office (ico.org.uk). If you are elsewhere in the EU or EEA, you may complain to your own national authority.
Children
This site prepares adults for a professional licensing exam. It is not designed for or directed at children, and we do not knowingly collect personal data from them.
Changes to this policy
The date at the top of this page is the date it last changed. When a change is significant (a new processor, a payment provider, server-backed accounts, or a new category of storage), we will update this page before the change goes live, and where it affects the categories you consented to, the cookie banner will ask you again.