Privacy Policy

1. Who we are

YKI Test Prep (https://ykitestprep.com) is a free Finnish language exam preparation service. For questions about this policy or your personal data, contact us at ykitestprep@gmail.com.

2. What data we collect and why

Account data

If you create an account we store your email address and a hashed password via Supabase Auth. This is required to provide sign-in, saved progress, and secure access to your practice history. Legal basis: contract (providing the service you signed up for).

Practice progress

When you are signed in, your practice sessions and vocabulary progress are saved to your account so you can pick up where you left off. Legal basis: contract.

Contact messages

When you submit the contact form we store your name, email address, and message so we can respond to you. Legal basis: legitimate interest (responding to your enquiry).

Page views

With your consent, we record pseudonymous page view data to understand which sections of the site are used most. This may include a randomly generated analytics identifier stored in your browser and basic information such as the page visited and time of visit. Legal basis: consent.

Advertising data

If we show ads on the site, Google AdSense and its partners may use cookies or similar technologies to deliver ads, measure performance, limit repeated ads, and, where you have given consent, personalise advertising. Legal basis: consent.

Third-Party Advertising and Cookies. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our sites and/or other sites on the Internet. Users may opt out of personalized advertising by visiting Google Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info.

3. Cookies

We use cookies and similar technologies in four broad categories: necessary, preferences, statistics, and marketing. Necessary cookies keep the site working. Preference cookies remember settings such as study-related state. Statistics cookies help us understand how the site is used. Marketing cookies are only used if you consent to advertising features such as Google AdSense. The full, auto-updated list of cookies in use is shown below. You can change your preferences at any time via the Cookie settings link in the site footer.

4. Who we share data with

We use Supabase (supabase.com) as our backend and database provider. Your account data and progress are stored on Supabase infrastructure. Supabase is GDPR-compliant and acts as a data processor on our behalf under a Data Processing Agreement.

We also use Cookiebot to manage cookie consent and consent mode, and Google services such as Google Analytics and Google AdSense. If ads are enabled, Google and its partners may process limited device, browser, and cookie data to serve and measure ads in line with the choices you make in the consent banner.

We do not sell your personal data. We only share data with service providers where necessary to run, measure, secure, or monetise the service in line with this policy and applicable law.

5. How long we keep your data

• Account data: for as long as your account is active. You can delete your account at any time from the Account page.
• Practice progress: deleted when your account is deleted.
• Contact messages: up to 2 years, then deleted.
• Page view data: retained for as long as reasonably needed for reporting and product improvement.
• Advertising and consent records: kept in line with our consent platform settings, legal obligations, and advertising provider requirements.

6. Your rights

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to stop processing your data in certain circumstances
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email us at ykitestprep@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

7. Data security

All data is transmitted over HTTPS. Passwords are never stored in plain text — Supabase Auth uses bcrypt hashing. Access to the database is restricted by row-level security policies.

8. Children

YKI Test Prep is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. The date at the top of this page will always reflect the most recent version. Continued use of the site after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or requests: ykitestprep@gmail.com