Privacy policy
Last updated 7 October 2026
- We collect what we need to run your account: your name, email, password (encrypted), practice results and billing status.
- Stripe handles payments. We never see your full card number.
- We use one essential login cookie and no advertising or tracking cookies.
- You can ask us to see, correct or delete your data at any time.
1. Who is responsible for your data
[Your LLC's legal name], [Registered address of the LLC], operates Jumpseat Academy and is the controller of your personal data. Contact us about privacy at privacy@jumpseat.academy.
2. What we collect
| Data | Why we need it | Legal basis (GDPR) |
|---|---|---|
| Name, email, password (stored only as a secure hash) | To create and secure your account and sign you in | Contract |
| Practice results and reports | To show your scores, history and progress | Contract |
| Plan, subscription status, payment records (amount, date, Stripe IDs) | To give you the right access, handle refunds and keep tax records | Contract; legal obligation |
| IP address and timestamps of logins and failed attempts | To protect accounts from password guessing and abuse. Kept for 24 hours. | Legitimate interest (security) |
| Email address and whether you opened your free attempts | To send preparation tips and offers about our paid plans (you can unsubscribe at any time) | Legitimate interest / consent where required |
| Support emails you send us | To answer you | Legitimate interest |
Your email is also printed faintly on the guides you open, to discourage sharing. We don't collect special-category data, and we don't sell your data.
3. Services we use
We share data only with providers that help us run the service, under data processing agreements:
- Stripe: payments and billing. Stripe processes your card details directly.
- Resend: sending account and preparation emails.
- Vercel: website hosting.
- [Database provider, e.g. Neon]: storing account and practice data.
Some of these providers are based in the United States. Where data leaves the EU or UK, it's protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
4. Cookies
We use one essential cookie, jsa_session, to keep you signed in. It's required for the site to work, so it doesn't need consent. We don't use analytics, advertising or tracking cookies. If we add them in future, we'll ask for your consent first and update this policy.
5. Emails
We send emails you need, like password resets and important account notices. If you have a free account, we also send a short series of preparation tips and offers about our paid plans. Every one of those emails has an unsubscribe link, and you can turn them off in Account. They stop automatically when you subscribe.
6. How long we keep data
- Account and practice data: while your account is open. We delete it within 30 days of you asking us to close your account.
- Payment records: as long as tax and accounting law requires, which can be up to 10 years.
- Security logs (IP addresses for rate limiting): 24 hours.
7. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- have your data deleted;
- restrict or object to how we use it, including for marketing at any time;
- receive your data in a portable format;
- withdraw consent where we rely on it.
Email privacy@jumpseat.academy to use any of these rights. We reply within one month. You can also complain to the data protection authority in your country.
8. Security
Passwords are stored only as secure hashes, connections are encrypted with HTTPS, login attempts are rate limited, and access to our systems is restricted to people who need it.
9. Children
The service isn't intended for anyone under 16, and we don't knowingly collect their data.
10. Changes
If we make significant changes to this policy, we'll email you. The date at the top shows the latest version.