Privacy Policy & Data Protection Notice

1. Data Controller Information (GDPR & LOPDGDD)

In accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and Spanish Organic Law 3/2018 of December 5 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), BenchCert (“we”, “us”, or “the Platform”), operated from Spain (European Union) under creator handle @prsm.sh, acts as the Data Controller for personal data processed through this platform.

Jurisdiction: Kingdom of Spain (European Union) • Data Protection Contact: benchcertsupport@gmail.com

2. Categories of Personal Data Collected & Purpose

We adhere strictly to the GDPR principle of data minimization (Article 5(1)(c) GDPR). When you register an account and use BenchCert, we collect only the following records:

• Account Identity Data: Your email address, unique user identifier (UUID), and encrypted authentication credentials managed via Supabase Auth (Legal basis: Performance of a contract — Art. 6(1)(b) GDPR).
• Exam Performance Telemetry (exam_attempts): Question identifiers, selected answers, correctness outcomes, domain tags, and timestamps recorded during your authenticated practice sessions so we can compute your domain mastery and weak-spot matrices.
• Streak & Subscription Profile (user_profiles): Active subscription tier (free, single_cert, or pro), consecutive daily streak counters, and calendar date strings (YYYY-MM-DD) of completed drills.

3. Authorized Sub-Processors & International Transfers

We never sell, rent, or broker personal data. To deliver core platform functionality, we engage the following strictly vetted infrastructure sub-processors under GDPR Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs):

4. Cookie Policy (Strictly Necessary Functional Cookies Only)

In compliance with Article 22.2 of the Spanish Law on Information Society Services and Electronic Commerce (LSSI-CE) and the EU ePrivacy Directive, BenchCert uses strictly necessary functional session cookies (specifically Supabase authentication cookies) required to maintain your logged-in session and security state, alongside local browser storage (localStorage) for UI theme preferences.

We deploy zero third-party advertising cookies, cross-site tracking pixels, or behavioral profiling scripts.

5. Your Rights Under GDPR & Spanish LOPDGDD

Under Articles 15 to 22 of the GDPR and Title III of the Spanish LOPDGDD, you have the right to exercise the following rights at any time free of charge:

• Right of Access (Art. 15 GDPR): Inspect all telemetry, scores, and profile records associated with your account directly on your Study Stats dashboard.
• Right to Rectification (Art. 16 GDPR): Update your account credentials or reset your password via the authentication portal.
• Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): You may permanently and irreversibly delete your account, profile record (user_profiles), and all historical exam telemetry (exam_attempts) at any time using the self-service “Delete My Account & Data” button inside your top-right account menu, or by emailing benchcertsupport@gmail.com.
• Right to Data Portability & Restriction (Arts. 18 & 20 GDPR): Request a structured export or restriction of processing of your personal data.

You also have the right to lodge a complaint with the Spanish Data Protection Supervisory Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es if you believe your data protection rights have been infringed.

6. Technical & Organizational Security Measures

All database tables enforce strict PostgreSQL Row Level Security (RLS) policies scoped to auth.uid() = id / auth.uid() = user_id, ensuring no user can read, modify, or delete another user's records. All network traffic is encrypted in transit via TLS 1.3.