Home › Privacy
Privacy Policy
Effective draft date: 15 November 2026 · Covers the Arc app and this website. Draft — not legal advice. To be reviewed by a solicitor before launch.
Who we are
The data controller is [BUSINESS NAME] (trading as Arc) · ABN [ABN] · [ADDRESS] · Phone [PHONE] · [SUPPORT EMAIL]. Arc is a study aid for Irish electrical apprentices (SOLAS Phase 2, 4 and 6) and Irish electricians moving to Australia.
Arc is an independent study aid. It is not affiliated with or endorsed by SOLAS, QQI, NSAI or ETCI. I.S. 10101 is © NSAI; Arc doesn't reproduce it.
What we collect, why, and on what lawful basis
| Data | Purpose | Lawful basis (GDPR Art. 6) | Kept for |
|---|---|---|---|
| Study progress, settings, mistakes list, your Exam Pass unlock token. Stored only on your device (browser localStorage); we do not receive it. | To make the app work and remember your progress. | Contract / strictly necessary. | Until you clear it or press “Remove unlock”. |
| Leaderboard (optional): nickname, a random device id, SOLAS phase, optional mates group code, game and score stats. | Weekly leaderboards and mates groups you choose to join. | Legitimate interests (a feature you choose to use). | Until you ask us to remove it; old weekly boards may be pruned. |
| Purchases: Stripe collects your email, card details and billing country at checkout. We receive your email, the Checkout session / payment ids, amount, currency and payment status. We never see your card number. | To take payment, unlock Exam Pass, let you restore it, and send your receipt / order confirmation. | Contract; legal obligation (tax and accounting records). | Payment records for 6 years (tax law). Stripe keeps its own records under its privacy policy. |
| Cooling-off waiver record: the wording you ticked, its version, the time, the session id, product and amount. | Evidence that you asked for immediate access and acknowledged losing the 14-day right to cancel (Consumer Rights Act 2022). | Legal obligation; legitimate interests (evidence of the contract). | 6 years, then deleted automatically (storage expiry). |
| Website contact / support / sponsor enquiry form: name, email (optional for support, needed for sponsor enquiries), company (sponsor enquiries), message, topic, country, your browser’s user agent, and a hashed (one-way, salted) version of your IP address — never the IP itself. | To answer you, handle refunds, cancellations and copyright reports, and stop spam / abuse (rate limiting). | Legitimate interests (answering you, preventing abuse); contract where it is about a purchase. | 12 months, then deleted automatically (storage expiry). Rate-limit counters: 1 hour. |
| Sponsor click counts: when someone taps a sponsor card in the free app, we add 1 to a monthly total for that sponsor and placement (for example “house-sponsor-arc · home · 2026-11: 12”). No IP address, device id, cookie or other personal data is sent or stored, so the counts cannot identify anyone. | To show sponsors aggregate numbers for their placement. | Not personal data (aggregate counts only). | Kept as totals; no personal data to delete. |
| Technical request data (IP address, browser, time) processed by our host when you load a page. | Delivering the site and protecting it from attacks. | Legitimate interests (security). | Short-term, under Cloudflare’s policies; we do not keep access logs. |
Cookies and device storage
No analytics, advertising or tracking cookies. No third-party trackers or ad networks: sponsor cards are plain links we host ourselves, shown only in the free app and never to Exam Pass holders. Arc only uses strictly necessary browser storage (localStorage and the offline app cache) to keep your progress and unlock on your device, so no cookie banner is needed. Stripe’s checkout page (on stripe.com) sets its own cookies for payments and fraud prevention under Stripe’s policy.
Processors (who handles data for us)
- Cloudflare, Inc.: hosting (Cloudflare Pages), server code (Pages Functions) and storage (Workers KV) for leaderboards, waiver / confirmation records and website messages.
- Stripe: payment processing, checkout and receipts. Stripe is also an independent controller for some payment data (for example fraud checks).
We do not sell or share personal data for advertising. Cloudflare and Stripe may process data outside the EEA (for example in the US or Australia). Where they do, transfers rely on safeguards such as the EU Standard Contractual Clauses or adequacy decisions. The seller is based in Australia.
Your rights
You can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Use the support form (topic “Privacy request”) or email [SUPPORT EMAIL]. We reply within one month. You can complain to the Data Protection Commission (Ireland, dataprotection.ie) or, in Australia, the OAIC.
Children
Arc is for apprentices and adult learners. It is not aimed at children under 16.
Security
HTTPS everywhere, card data handled only by Stripe, IP addresses hashed before storage, signed unlock tokens, and least-access secrets.
Contact
[BUSINESS NAME] (trading as Arc) · ABN [ABN] · [ADDRESS] · Phone [PHONE] · [SUPPORT EMAIL]