Privacy Policy

01Who we are

SQEase is a SQE1 exam-preparation platform operated by Finlay Salisbury, a sole trader trading as SQEase. For the purposes of UK GDPR, Finlay Salisbury is the data controller. Address for service of documents: 2 Rodney Street, London N1, England. Data protection queries: privacy@sqease.uk.

02Data we collect

You give us directly

• Account data — name, email, password (hashed), exam date, study goals, and whether you signed up on our website or in our app. At sign-up we also ask three optional questions: where you heard about SQEase, whether you are resitting, and what other SQE preparation you use. You can skip them.
• Marketing data — email address (if you opt in to receive updates).
• Billing data — on our website, payments are handled by Stripe; we receive plan, billing period, country and last-four digits. In our iPhone app, Apple is the seller and takes the payment; we receive your plan and its renewal status from Apple through RevenueCat, and never see your card details.
• Study materials — documents, notes, photos and Google Drive imports you upload.
• Questions you ask Lex — what you type or dictate to Lex, our AI study assistant, and the replies it gives.
• Your study background — what you tell Lex about your prior study, how confident you feel on each topic, and the short note you confirm in your own words at the end of that chat. This is your own account of yourself: it shapes the order of your study plan, and it never limits what you can practise.
• Voice recordings — only while you hold the microphone button to dictate to Lex. Audio is streamed straight from your device to our transcription provider, Deepgram, and converted to text; it is not recorded to a file, and neither we nor the provider keep the audio. The microphone is released the moment you stop, and the app never listens in the background. See §05.
• Camera photos — only the pages you choose to photograph in the mobile app to turn handwritten notes into questions. They are uploaded, read once by Anthropic's AI model to turn the handwriting into text, and then deleted (§06). We never access your camera roll or take photos on our own initiative.
• Support correspondence — messages you send via email or in-app chat.

We collect automatically

• Usage data — questions answered, time per question, mode, topic scores.
• Product-analytics events — when you're signed in, we record first-party operational events (sessions, screens viewed, and features used such as exams, Lex, uploads and flashcards) to understand how the app is used and improve it. This is processed in our own infrastructure and is not shared with third-party advertising or analytics networks. Event records contain no study-material content.
• Ad measurement — only if you turn on advertising cookies (a separate choice in our cookie banner): when you arrive from one of our ads, and if you then create an account, start checkout, start a free trial or subscribe on our website, the Meta Pixel and the Google Ads tag tell Meta and Google, with an event ID and your browser's ad cookies. They are not given your name or email. See §05 and our Cookie Policy.
• Device data — browser, OS, screen size, IP address (truncated).
• How you found us — if you arrive through a link that carries campaign tags (for example from an ad, a social post or a creator's link), we note those tags, the website you came from (not its full address) and the first page you saw, and store them with your account when you sign up. If you have accepted analytics cookies, we also keep the ad's click identifier so we can tell which ad brought you. This stays in our own systems and is never sent back to an ad network. If you joined through a creator's link or code, or a partner's discount code, we tell that creator or partner how many people joined and how much they paid in total, so we can pay their share. We never tell them who you are.
• Push token — only if you turn on study reminders: a token for your phone or browser, so we can send them (§05).
• Your AI choice — in our iPhone app (version 1.0.1 and later), we ask your permission before your words, notes, photos or voice are first sent to an AI provider. We store your answer, and when you gave it, with your account. You can change it in Settings.
• Cookies — see our Cookie Policy.

03Why we use it

We use your data to provide the platform, bill you, personalise difficulty, send service emails, and improve AI quality. See our full data-use table in the source policy.

04Legal basis

• Contract — to provide the service.
• Legitimate interests — security, fraud prevention, quality improvement.
• Consent — marketing emails and non-essential cookies.
• Legal obligation — tax, accounting, lawful disclosure.

05Who we share it with

We never sell your personal data. We share it only with vetted processors:

For ad measurement, Meta and Google act as independent controllers as well as processors: they may use what their tags collect under their own privacy policies, including to improve their ad systems. That is why it only happens if you opt in, and you can withdraw at any time from "Cookie settings" in the footer.

Two of these behave differently from the rest, and it matters.

• Deepgram receives your voice directly from your device, not through our servers — dictation streams from your browser or phone straight to Deepgram, using a short-lived access token our server issues for that one session. Our servers never receive the audio; we receive only the resulting text and a count of seconds used for billing. Deepgram processes the audio to return the transcript. With every request we switch off Deepgram's model-improvement programme, so it does not keep your audio or use it to train its models (on the website, and in our iPhone app from version 1.0.1; earlier app versions did not send this setting).
• Tavily receives a search query, not your identity. When you ask Lex to check something against live sources, we send a search phrase derived from your question. We do not send your name, email or account identifier with it.

If you choose Google Sign-In, or import study material with the Google Drive picker, Google tells us only what you consent to share at that moment. In our iPhone app, Google’s sign-in component also declares that it may collect data for Google’s own service and analytics, including contact details, a device identifier, approximate location and usage data. Google handles that data under its own privacy policy; we do not receive it.

If you choose Sign in with Apple, on our website or in our iPhone app, Apple shares the name you choose the first time you sign in, and your email address. If you turn on Apple’s Hide My Email, we receive a private relay address instead: Apple forwards our emails to you, and we never see the real address behind it.

06AI & our knowledge base

When you upload a document, its full text is sent to our AI providers OpenAI and Google (§05) so it can be matched to the SRA's SQE1 syllabus and turned into questions and flashcards. A photo of handwritten notes is read by Anthropic first. We do not use your personal data or uploaded documents to train AI models. Nothing removes personal details from a document before it is processed, so please don't upload documents that contain other people's personal data or sensitive personal information.

Your files are processed transiently, then deleted. On the website, documents are converted to text in your browser and only that text is sent to us. In the mobile app, where in-browser conversion isn't possible, the file itself is uploaded and converted to text on our servers — and the original file is deleted straight away, before any processing begins. From there both work identically: the text is matched to the syllabus and used to write your questions, and we delete the text once processing finishes. The one exception is a document you have only partly used: if it covers topics you haven't generated questions from yet, we keep its text so you can come back for the rest without re-uploading. That is capped at 30 days, and it ends sooner if you generate from every topic or delete the document — whichever comes first. We never keep your original files. What we retain is only what we generate from them — the list of legal topics, the practice questions, and any flashcards.

Our AI providers operate under contractual undertakings that your input is never used to train their models.

07Optional profile details

We may prompt you for optional information about your study method, funding method, workplace, training contract provision, education provider, intended area of law, and similar professional details. These answers are stored on your account profile, where you can view, edit or remove them at any time, and we use them only to personalise your experience.

We do not sell this information, and we do not share it with third parties except the processors listed in §05 where needed to run the platform. Providing it is entirely optional.

08How long we keep it

• Account data — active + 30 days after deletion.
• Free mock taken without an account — your answers and an anonymous guest identifier, kept so you can create an account and see your report. The guest identifier is deleted after 30 days and your answers after 45 days; if you create an account, your answers move into it. If you ask us to email you a sign-in link, we keep that address with the link for 7 days.
• Study materials — until you delete them.
• Uploaded files & photos — deleted as soon as the text is extracted; the extracted text is deleted once processing finishes, or after at most 30 days for a document you have only partly used (§06).
• Voice recordings — never stored. Audio is transcribed as it streams and is not written to disk by us or by our transcription provider.
• Lex conversations — the conversation itself is held on your device for the session and not stored on our servers. What you confirm at the end of the onboarding chat is stored — see Study background below. When Lex searches the web for you (Research now), we keep a record of which links the search returned, and on which day, for 13 months, so we can check what our web search shows people and answer the online-safety regulator if it asks. We also keep the web passages it found, each with its link, until we remove them, so Lex can answer later questions, yours or another student’s, without searching again. We do not keep your question, and neither the record nor the passages are stored with your name or account. If you report one of those links to us, the link, your reason and any comment you add are kept with your account for review. If you report a reply to us, that reply and the message that prompted it are kept for review. If you delete your account, we keep the reported reply with no link to you, and delete your message and any comment you added. Lex may also search the web itself while coaching you. We keep the search phrase it used, which can draw on what you wrote, and the passages it found, with their links, until we remove them, so later answers need not search again. Neither is stored with your name or account.
• Study background — your confirmed topic ratings and your note: while your account is open. An onboarding conversation you start but never confirm: 30 days, then deleted. Your first benchmark: while your account is open. After you delete your account we keep your per-topic ratings and benchmark figures with no link to you, and the note you wrote is deleted.
• Billing records — 6 years (HMRC).
• iPhone app subscriptions — RevenueCat keeps your purchase history while your account is open; when you delete your account we ask RevenueCat to delete it. Apple keeps its own records as the seller, under Apple's privacy policy.
• Push tokens — kept with your account and deleted with it. We also remove a token once its device stops accepting reminders.
• Usage logs — 13 months identifiable, then aggregated.

09International transfers

Where data leaves the UK we rely on the UK Addendum to the EU SCCs, the UK-US Data Bridge, or adequacy decisions. This includes the US processors in §05, among them RevenueCat and Expo for our iPhone app, and Apple for in-app purchases and push notifications.

10Your rights

Access, rectification, erasure, restriction, portability, objection, withdraw consent, and automated-decision rights. Use our DSAR form or email privacy@sqease.uk.

11Security

TLS 1.3 in transit, AES-256 at rest, bcrypt passwords, least-privilege access. Full detail on our Security page.

12Changes to this policy

Material changes notified 14 days in advance by email and in-app.

13Contact & complaints

If you're unhappy, complain to the ICO at ico.org.uk.