Privacy

• Data controller: Bilal Sbaiby, Travesía del Nuevo Alamín 11, 2D, 19005 Guadalajara, Spain (support@hexaciv.com).
• No advertising cookie or tracker. Without an account, your answers, results and language stay on your device; with an account, see below. Your exam date does too, unless you buy the Exam Pass: then it goes with the order so your access lasts until the exam, and we email you once, 3 days after that date, to ask how it went.
• An account is optional. The free mock exam does not need one and sets no cookie. If you sign in, we keep your email, your chosen language, your answers (the question, the time you answered, the theme, right or wrong), your mock exams (questions asked, start time, answers, score, duration), your settings (exam date, track, questions to review) and, if you make one, your guarantee claim and its note, so your progress follows you across devices and your readiness can be calculated.
• There is no password: we send a single-use link, valid for 15 minutes, and an 8-digit code. We keep a record of each sign-in email we send (your address and the time, no link or code) for 7 days, to retry a failed send. After sign-in, one session cookie (HttpOnly, Secure, SameSite=Lax) keeps you signed in. It expires after 30 days without use and after 90 days at the latest; you can end the session at any time. This cookie is used only to keep you signed in: no advertising, no audience measurement.
• From your account you can export your data or delete your account (a sign-in less than 10 minutes old is required). Deletion removes your answers, mock exams, settings, sessions, sign-in codes and open guarantee claims. What remains: the purchase, detached from the account, for up to 12 months after purchase, or until your access ends if that is later, and guarantee claims already decided, detached from the account and without their note. The sign-in security log keeps, for each event, the date, its type and a keyed hash of your email address and of your IP address (not the addresses themselves); it is deleted after 90 days.
• Legal basis for the account (GDPR Art. 6): performance of the service you ask for by signing in (b). The strictly necessary session cookie needs no consent.
• We count anonymously (day, language, event type: visit, quick test started, finished, exam started, finished, GO, buy click, purchase, 'I passed' page opened, report confirmed, reminder requested, reminder confirmed, error reported on an answer, result and plan requested, result and plan confirmed, test 'Do I need the civic exam?' started or finished, French level check started or finished, diagnostic started or finished, French practice started or finished, language pack viewed, click on its purchase button, audio mock in darija started or finished, question 1, 10, 20 or 30 answered, click on 'Hand in', plan opened, Pass offer viewed, click on the Pass from a result, click on a link to the Pass page, click to the mock exam from the 'Do I need the civic exam?' or French level check result, click on the exam start button, free TCF test started or finished, Morocco TCF Pass offer seen, click on its purchase, Morocco TCF Pass series started or finished, Morocco TCF Pass listening task played). Our own counter stores no identifier, IP address or cookie, and your exam date is not sent with these events. For visits and exams started or finished we add the tags of the link you arrived through (source, medium, campaign, content), if it had any, to see which channel brings visitors. Hexaciv does not save them on your device. Opening a recognised partner link is counted per code and per day, without the language.
• We also count visits with PostHog (EU servers), without cookies and without storing anything on your device. Each event carries the page path, the referring site, campaign tags (utm), your language, time zone, screen size and browser type. It carries no name, email or advertising id. Your IP address is used only to count one visit per day and is not stored. PostHog stays off when your browser sends Do Not Track or Global Privacy Control. Events are kept for up to 12 months. Legal basis: our legitimate interest in measuring and improving the site (GDPR art. 6(1)(f)); you can object at any time by writing to support@hexaciv.com.
• The web server, however, keeps a technical log: your IP address, a description of your browser and device, the time and the address of the page requested with its link tags. We read it, with software tools, to diagnose faults and investigate security problems. Programs also read it, to count visits and errors and to make the first-page note described below. It is not used for profiling and goes to no one except the recipients listed below. It is deleted automatically after about 15 days.
• When you buy, we also note which page your visit started on that day and what kind of site sent you there (for example a search engine or a chat assistant), and keep it with your payment record, so we learn which pages bring customers. We work this out on our own server from its technical log. No cookie is used and it goes to no one except the recipients listed below.
• If you buy: Stripe processes the payment. We keep your email, the payment reference and the plan bought to send and revoke access, for up to 12 months after purchase, or until your access ends if that is later.
• If you make a guarantee claim from your account: to handle it, we also keep these purchase details for as long as the claim is open, even beyond that period.
• If you ask to be notified: double confirmation, address deleted any time through the unsubscribe link, after 12 months at the latest.
• If you report a pass: we keep your email only until you confirm it (7 days at most if you don't). After that we keep a coded fingerprint of the address so it can't be counted twice, plus the exam month, language and confirmation date, for as long as the tally is shown. The public tally shows only the number of reports and the date of the first.
• If you ask for a renewal reminder: we keep your email, card category, expiry date and language only for the confirmation and at most two messages. Everything is erased after the second message, when you unsubscribe (one click from every message), 7 days after an unconfirmed request, or 30 days after the expiry date.
• If you report an error on an answer: we keep the question id, the language, your optional note (300 characters at most) and the date and time of the report, with no email, no IP address and no account, to compare the answer with the Ministry sheet. These rows are deleted within 12 months. Put no name or email in the note; to get a reply, write to support@hexaciv.com.
• If a partner sent you, we keep the partner code with your order so we can pay them.
• If you ask for your result and your plan: double confirmation by email, then at most 4 emails over 9 days. We keep your email, language, your procedure (multi-year card, resident card or naturalisation), the type of test and your score, your weakest theme and the estimate shown, only for these emails. Everything is erased after the 4th email, when you unsubscribe (one click from every message), 7 days after an unconfirmed request, or 60 days after confirmation at the latest.
• If you answer the email sent after your exam date (passed, did not pass, did not sit): we keep your answer, declared and without any document, with the GO state on the exam date, the track and the language, under a code that does not let us find your address without our secret key. An approved refund claim is recorded the same way as a fail. These rows are erased at the latest 12 months after your answer; only totals of at least 30 answers from GO learners could be published.
• Legal basis (GDPR Art. 6): performance of the contract for the purchase and for sending and revoking access (b); consent for the notification, the pass report, the renewal reminder and the result-and-plan emails, which you can withdraw at any time (a); legitimate interest for counting visits (our counter, PostHog and the technical log), for reading that log when something fails or for security, for answering your messages, for noting the first page and the type of referring site when you buy, for the single follow-up email of the Exam Pass and for error reports on an answer (f).
• Recipients: Stripe (payment), Resend (sending the emails: access link, confirmations, unsubscribe), PostHog (audience measurement, EU servers), Hetzner Online GmbH (hosting; a German company, servers in Helsinki, Finland) and Anthropic Ireland, Limited (Ireland, EU; the software tools we use to read the technical log, our support mail, the error reports on an answer and, read-only, account and payment records, when diagnosing faults and security problems, answering your messages and checking a reported answer; it may transfer data to Anthropic, PBC in the United States under standard contractual clauses). Each processes data only for its function, with one exception: when our software tools run on a consumer Claude plan (Pro or Max) instead of our business (Team) accounts, Anthropic is an independent controller under its own privacy policy (anthropic.com/legal/privacy), which also lets it use the data to prevent fraud and abuse, resolve security issues and meet its legal obligations. On the consumer plan we have switched off the setting that lets Anthropic use our conversations to train its models; its business terms already exclude that. Stripe, Resend and Anthropic may process data outside the European Union, including in the United States, under standard contractual clauses or the EU-US Data Privacy Framework. Mail sent to support@hexaciv.com goes through Forward Email (Forward Email LLC, United States), which by its own policy does not store it and passes it on to the operator's own mailbox at Google (Gmail, United States); these transfers rely on standard contractual clauses (Forward Email) or the EU-US Data Privacy Framework (Google).
• Rights of access, rectification, erasure, restriction, objection and portability: write to support@hexaciv.com.
• You can also lodge a complaint with the data protection authority of your country (Spain: AEPD, aepd.es; France: CNIL, cnil.fr).