Last updated: September 2026
XenAI Limited ("we", "us", "our") operates the CSCS Mock Test app (the "Service"). This Privacy Policy explains how we collect, use, and protect your personal information.
Account Information
When you register, we collect your email address and an optional display name. If you sign in with Google, we receive your email and name from Google's OAuth service.
Usage Data
We collect information about how you use the Service, including quiz results, practice session data, study progress, and feature interactions. This helps us personalise your learning experience.
Payment Information
Stripe processes payments. We do not store your card details. We receive confirmation of successful payments and the plan purchased.
Technical Data
We may collect your IP address, browser type, device information, and cookies to operate and improve the Service. Optional analytics and advertising technologies load only after you consent (see Section 5).
Security and Fraud Prevention
When you register, sign in or start a payment, we record the IP address and device information (browser and operating system) used. We use these records to protect accounts, to detect and prevent fraud, and to respond to payment disputes. Our lawful basis for this is our legitimate interests under UK GDPR.
•
To provide and personalise the Service
•
To track your learning progress and generate analytics
•
To process payments and manage your subscription
•
To send password reset emails and important account notices
•
To improve our question bank and app features
•
To detect and prevent fraud or abuse
We do not sell your personal data. We share data only with:
•
Stripe - for payment processing
•
OpenAI - for AI-powered explanations (question text only, no personal data)
•
Google - for sign-in (if you use Google Sign-In), and, when you consent, for analytics (Google Analytics) and advertising (Google AdSense)
•
Microsoft - when you consent, for analytics (Microsoft Clarity)
•
Service providers who assist in operating our platform, under confidentiality agreements
We retain your account data for as long as your account is active. You may delete your account at any time from the Settings page, which permanently removes your account and usage data. Records of sign-ins, payments and fraud checks, including the IP address and device information described in Section 1, are kept for 25 months after an account is deleted, so that we can investigate fraud and respond to payment disputes. Where optional analytics or advertising tools are used with your consent, data held by those providers is retained according to their own policies.
We use a small number of strictly necessary cookies and similar technologies (including browser local storage) to operate the Service, for example to keep you signed in. These are always active because the Service cannot work without them.
We also use optional cookies that load only if you agree to them through our cookie banner. Until you choose, they are blocked by default (Google Consent Mode is set to "denied"). You can change your choice at any time using the "Cookie settings" link in the footer.
Strictly necessary (always on)
•
Sign-in and session: keeps you signed in and secures your session.
•
Payments: Stripe is used at the checkout to process payments securely.
Analytics (optional, off until you consent)
•
Google Analytics 4: helps us understand how the Service is used.
•
Microsoft Clarity: usage and session-quality insights that help us improve the Service.
Advertising (optional, off until you consent)
•
Google AdSense: Google's advertising tag. We do not currently display adverts, so advertising cookies are set only after you consent and only once advertising is enabled on the Service.
You can review or change your choices at any time using the "Cookie settings" link in the footer.
Under UK GDPR you have the right to:
•
Access the personal data we hold about you
•
Request correction of inaccurate data
•
Request deletion of your data
•
Object to processing
•
Data portability
To exercise any right, email us at support@cscsmocktest.uk
We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords, and access controls. No system is 100% secure; please use a strong, unique password.
The Service is not intended for users under 13. We do not knowingly collect data from children.
We may update this policy and will notify you by updating the "Last updated" date. Continued use constitutes acceptance.
Email: support@cscsmocktest.uk
