Privacy Policy

We collect and process personal data in accordance with this Privacy Policy and applicable data protection regulations (including GDPR principles where applicable).

Account and Identification Information: Name (used to personalize evaluation reports and correspondence), email address (unique account identifier, stored lowercase), password hash (bcrypt, never plaintext), and authentication method (password and/or Google). Email verification status is set only when proven via Google OAuth.

Communication Data: WhatsApp phone number (used as the primary delivery and support channel; stored in canonical form for account linkage) and email address (used for account access and backup communications).

Educational Content: OET writing submissions (referral letters, discharge summaries, and case notes) uploaded or pasted for review, plus personal letter library items (manual adds and exam-captured letters), exam attempt history (drafts and notes synced when signed in), and case-notes favorites.

Your personal data is processed solely for the following specified, explicit, and legitimate purposes:

Service Provision — Reviewing, auditing, and returning your OET writing submissions with expert feedback; maintaining your personal library and submission status; syncing exam attempts for cross-device resume.

Account Management — Creating and securing your account, authenticating via email/password or Google OAuth, and enforcing the account pre-hijacking protections gated on email verification.

Support and Communications — Responding to inquiries, troubleshooting submissions, and providing WhatsApp support.

We do not sell, rent, or lease your personal information, nor do we use it for unsolicited marketing campaigns.

We implement appropriate technical and organizational security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction.

Infrastructure Security — All data is stored on secure, server-side cloud infrastructure. Sensitive data is never cached or stored on the client side (browser); every authenticated API response sets Cache-Control: no-store so CDNs never serve one user’s data to another.

Retention Policy — Writing submissions and evaluations are retained for the duration of your active subscription and up to 12 months thereafter to allow you access to your historical files. Account data (email, favorites, library items, exam history) is retained while your account is active. Metadata (name, email) is retained as required for account management and compliance.

Account Deletion — You may delete your account at any time from /account (self-service). This removes your profile, sessions, favorites, library items and exam history; submissions remain as anonymous business records with no link to your identity. For anti-abuse, a self-deleted email is reserved for 30 days before it can be re-registered. An admin-initiated deletion (support path for lockouts) does not reserve the email so you can re-register immediately.

You may request immediate deletion of your data at any time (see Your Rights below).

We do not share your personal data with third parties except as necessary to provide the service or as required by law.

Authentication (Google OAuth) — When you sign in with Google, we verify your ID token via Google’s certificates to confirm email ownership; only email, name and Google ID are stored.

Communication Channels (Meta/WhatsApp) — We utilize the WhatsApp Business platform (Meta) to send notification messages and deliverables. These transmissions are subject to the WhatsApp Privacy Policy.

Data Hosting — Our cloud storage and database providers act as data processors under strict confidentiality terms.

Under data protection laws, you retain full control over your personal data. You have the right to:

Access & Portability — Request a copy of all personal data we hold about you, including your library and exam history.

Rectification — Request correction of any inaccurate or incomplete personal data via /account.

Erasure ('Right to be Forgotten') — Delete your account and personal data self-service from /account at any time. As above, self-deletion reserves your email for 30 days; contact support for an immediate admin deletion if you are locked out and need to re-register at once. Upon admin action, data is purged from active databases; submissions you made remain only as anonymous records.

To exercise any of these rights, please contact us via our official support channels or use the self-service deletion in your account.

If you have any questions regarding this Privacy Policy, your data rights, or wish to submit a data erasure request, please contact our Data Protection representative:

Email: support@oetlab.com

WhatsApp: +20 11 0468 1108

We aim to respond to and resolve all data privacy requests within 48 hours.