Privacy Policy

OETlab ("we", "us") provides OET writing preparation and evaluation at www.oetlab.com. We decide how and why the personal data described here is processed, which makes us its controller.

For anything in this policy, contact us at support@oetlab.com or on WhatsApp at +20 11 0468 1108 (see Contact Information below).

We collect and process personal data in accordance with this Privacy Policy and applicable data protection law, including the UK and EU GDPR where they apply to you.

Account and Identification Information: Name (used to personalize evaluation reports and correspondence), email address (unique account identifier, stored lowercase), password hash (bcrypt, never plaintext), profession, and authentication method (password and/or Google). Your email address is verified either through Google sign-in or by a 6-digit code we email to you; the code expires after 15 minutes.

Communication Data: WhatsApp phone number (used by our team to contact you about your submissions, about our weekly challenges and offers, and for support; stored in a standard form so it can be matched to your account). When you enter a number, we check with a validation service that it is a real, assigned number.

Educational Content: OET writing submissions (referral letters, discharge summaries, and case notes) uploaded or pasted for review, our evaluations of them, plus personal letter library items (manual adds and exam-captured letters), exam attempt history (drafts and notes synced when signed in), and case-notes favorites.

Content Protection (Copy Log & Watermarks) — When you copy text from a case (the exam text, the model answer, or a selection), we log the copy: your account ID, the case, which part was copied, its length, the time, and a shortened network address. The copied text itself is never stored. The copied text also carries an invisible marker holding your account ID, the case, the time and a server signature. While you are signed in, case pages and printed sheets show a visible watermark with a partly hidden version of your email and the last 8 characters of your account ID.

Information You Choose to Give Us — Suggestions you send from your account (stored with your name, email and profession); answers to our survey, where your name and WhatsApp number are optional and are asked so we can send a prize and, occasionally, tell you about OETlab challenges and offers. Reply STOP at any time and we will not message you again; and, if you allow browser notifications, the notification address your browser gives us.

Testimonials — With your permission, we publish your feedback under the name you choose. You can ask us to remove it at any time.

Weekly Challenge — The names of challenge participants and their scores are shown on the leaderboard, which only signed-in users can see.

Security and Technical Data — When you sign in we set a session cookie, and we keep a record of the session for up to 90 days. To protect accounts from abuse we log failed sign-ins, rate-limit hits and similar security events with a shortened network address (the last part removed), never the full address. Sign-up, sign-in, email verification and submission forms use a bot check.

Your personal data is processed solely for the following specified, explicit, and legitimate purposes. For each, we name the legal basis we rely on:

Service Provision — Reviewing, auditing, and returning your OET writing submissions with expert feedback; maintaining your personal library and submission status; syncing exam attempts for cross-device resume. Legal basis: performance of our contract with you.

Account Management — Creating and securing your account, authenticating via email/password or Google OAuth, verifying your email address and WhatsApp number, and enforcing the account pre-hijacking protections gated on email verification. Legal basis: performance of our contract with you.

Support and Communications — Responding to inquiries, troubleshooting submissions, and contacting you on WhatsApp or by email about your account. Legal basis: performance of our contract with you.

Security and Abuse Prevention — Security logs, rate limits, bot checks, and the 30-day reservation of a deleted email address. Legal basis: our legitimate interest in keeping the service and its users safe.

Copy Log and Watermarks — The copy log and watermarks described above help us detect bulk copying and other misuse of the service; we are alerted when an account copies from an unusually large number of cases in one day. Legal basis: our legitimate interest in preventing misuse of the service.

Improving the Service — Reading your suggestions and survey answers, and counting page visits with privacy-friendly analytics that use no cookies and do not identify you. Legal basis: our legitimate interest in improving OETlab.

Challenges and Offers — Messages on WhatsApp about our weekly challenges and offers. Legal basis: our legitimate interest in telling people who use OETlab about it. Reply STOP at any time and we will not message you again.

Notifications, Prizes and Testimonials — Browser notifications, the optional contact details on the survey, and publishing a testimonial. Legal basis: your consent, which you can withdraw at any time (turn notifications off in your browser, or ask us to remove your survey details or your testimonial).

We do not sell, rent, or lease your personal information. We send offers only as described above, and only about OETlab. We do not make decisions about you by automated means alone.

We implement appropriate technical and organizational security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction.

Infrastructure Security — All data is stored on secure, server-side cloud infrastructure. Sensitive data is never cached or stored on the client side (browser); every authenticated API response sets Cache-Control: no-store, and the service worker never caches an account-scoped API response, so signing out removes anything it held. Your browser does keep a few local items on this device: unsent exam drafts, survey answers, and sidebar state — none of which identify you to us or leave your device.

Retention — Your account data (profile, favorites, library items, exam history) and your writing submissions with their evaluations are kept while your account exists, so you can return to them. Survey answers are kept until you ask us to remove them. Leaderboard names are kept until you ask us to remove yours.

Automatic Deletion — Copy log entries are deleted after 12 months; security event logs after 30 days; sessions after at most 90 days; email verification codes after 15 minutes. Copy log entries contain no copied text and no contact details.

Account Deletion — You may delete your account at any time from /account (self-service). This removes your profile, sessions, favorites, library items, exam history and the files recorded as uploaded by your account (files uploaded before we began recording ownership are removed on request); submissions remain as business records that are no longer linked to your account (your name, contact details and the letter text are removed from them), and suggestions you sent stay without your name, email or profession. Copy log entries are kept until their 12-month expiry even after deletion, so deleting an account does not erase the record of what was copied; they hold only your former account ID, never your name, email or phone number. For anti-abuse, a self-deleted email is reserved for 30 days before it can be re-registered — we keep only a one-way fingerprint of it, not the address. An admin-initiated deletion (support path for lockouts) does not reserve the email so you can re-register immediately.

You may request immediate deletion of your data at any time (see Your Rights below).

We do not share your personal data with third parties except as necessary to provide the service or as required by law. The providers below process data on our behalf, only for the purpose stated:

Hosting and Analytics (Vercel) — Runs the website and our servers, and provides the cookie-free visit counts mentioned above.

Database (MongoDB Atlas) — Stores your account and submissions.

File Storage (UploadThing) — Stores the files you upload and the evaluation files we return.

Email (Resend) — Sends email verification codes.

Authentication and Viewing (Google) — When you sign in with Google, we verify your ID token via Google’s certificates to confirm email ownership; only email, name and Google ID are stored. Our web fonts are loaded from Google Fonts. When you open a PDF in your account, it is displayed through Google’s document viewer.

Bot Protection (Cloudflare Turnstile) — Checks that sign-up, sign-in, verification and submission requests come from a person.

Phone Number Validation (AbstractAPI) — Receives the WhatsApp number you enter, to confirm it is a real number.

Messaging (Meta/WhatsApp) — Our team contacts you through WhatsApp. These messages are also subject to the WhatsApp Privacy Policy.

Browser Notifications — If you turn them on, notifications are delivered through your browser maker’s push service.

International Transfers — Some of these providers process data outside your country, including in the United States. Where the law requires it, these transfers rely on appropriate safeguards such as standard contractual clauses.

Under data protection laws, you retain full control over your personal data. You have the right to:

Access & Portability — Request a copy of all personal data we hold about you, including your library and exam history.

Rectification — Request correction of any inaccurate or incomplete personal data via /account.

Erasure ('Right to be Forgotten') — Delete your account and personal data self-service from /account at any time. As above, self-deletion reserves your email for 30 days; contact support for an immediate admin deletion if you are locked out and need to re-register at once. Upon admin action, data is purged from active databases; submissions you made remain only as records no longer linked to your account, and copy log entries remain until their 12-month expiry as described above.

Restriction and Objection — Ask us to limit how we use your data, or object to processing we base on our legitimate interests.

Withdraw Consent — Where we rely on your consent, withdraw it at any time. This does not affect processing that took place before you withdrew it.

Complain to a Regulator — If you are unhappy with how we handle your data, you can complain to a data protection authority, in particular in the country where you live or work. In the UK this is the Information Commissioner’s Office (ico.org.uk); in the EU it is your national data protection authority. We would appreciate the chance to resolve your concern first.

To exercise any of these rights, please contact us via our official support channels or use the self-service deletion in your account.

If you have any questions regarding this Privacy Policy, your data rights, or wish to submit a data erasure request, please contact us:

Email: support@oetlab.com

WhatsApp: +20 11 0468 1108

We aim to respond to and resolve all data privacy requests within 48 hours, and always within one month.

Changes to This Policy — When we change this policy we update the date at the top of this page.