Privacy

• Data controller: Bilal Sbaiby, Travesía del Nuevo Alamín 11, 2D, 19005 Guadalajara, Spain (support@hexaciv.com).
• No advertising cookie or tracker. Without an account, your answers, results and language stay on your device; with an account, see below. Your exam date does too, unless you buy the Exam Pass: then it goes with the order so your access lasts until the exam, and we email you once, 3 days after that date, to ask how it went.
• An account is optional. The free mock exam does not need one and sets no cookie. If you sign in, we keep your email, your chosen language, your answers (theme, right or wrong), your mock exams (questions asked, start time, answers, score, duration), your settings (exam date, track, questions to review) and, if you make one, your guarantee claim and its note, so your progress follows you across devices and your readiness can be calculated.
• There is no password: we send a single-use link, valid for 15 minutes, and an 8-digit code. After sign-in, one session cookie (HttpOnly, Secure, SameSite=Lax) keeps you signed in. It expires after 30 days without use and after 90 days at the latest; you can end the session at any time. This cookie is used only to keep you signed in: no advertising, no audience measurement.
• From your account you can export your data or delete your account (a sign-in less than 10 minutes old is required). Deletion removes your answers, mock exams, settings, sessions, sign-in codes and open guarantee claims. What remains: the purchase, detached from the account, for up to 12 months after purchase, and guarantee claims already decided, detached from the account and without their note. The sign-in security log is deleted after 90 days.
• Legal basis for the account (GDPR Art. 6): performance of the service you ask for by signing in (b). The strictly necessary session cookie needs no consent.
• We count anonymously (day, language, event type: visit, exam started, finished, GO, buy click, buy click with an exam more than 60 days away, purchase, 'I passed' page opened, report confirmed). Our own counter stores no identifier, IP address or cookie, and your exam date is not sent with these events. For visits and exams started or finished we add the tags of the link you arrived through (source, medium, campaign, content), if it had any, to see which channel brings visitors. Hexaciv does not save them on your device. Opening a recognised partner link is counted per code and per day, without the language.
• We also count visits with PostHog (EU servers), without cookies and without storing anything on your device. Each event carries the page path, the referring site, campaign tags (utm), your language, time zone, screen size and browser type. It carries no name, email or advertising id. Your IP address is used only to count one visit per day and is not stored. PostHog stays off when your browser sends Do Not Track or Global Privacy Control. Events are kept for up to 12 months. Legal basis: our legitimate interest in measuring and improving the site (GDPR art. 6(1)(f)); you can object at any time by writing to support@hexaciv.com.
• The web server, however, keeps a technical log: your IP address, a description of your browser and device, the time and the address of the page requested with its link tags. We read it by hand to diagnose faults and investigate security problems. It is not used for statistics or profiling and is not shared. It is deleted automatically after about 15 days.
• If you buy: Stripe processes the payment. We keep your email, the payment reference and the plan bought to send and revoke access, for up to 12 months after purchase.
• If you ask to be notified: double confirmation, address deleted any time through the unsubscribe link, after 12 months at the latest.
• If you report a pass: we keep your email only until you confirm it (7 days at most if you don't). After that we keep a coded fingerprint of the address so it can't be counted twice, plus the exam month, language and confirmation date, for as long as the tally is shown. The public tally shows only the number of reports and the date of the first.
• If a partner sent you, we keep the partner code with your order so we can pay them.
• Legal basis (GDPR Art. 6): performance of the contract for the purchase and for sending and revoking access (b); consent for the notification and the pass report, which you can withdraw at any time (a); legitimate interest for counting visits (our counter and PostHog) and for the single follow-up email of the Exam Pass (f).
• Processors: Stripe (payment), Resend (sending the emails: access link, confirmations, unsubscribe), PostHog (audience measurement, EU servers) and Hetzner Online GmbH (hosting, Germany). Each processes data only for its function. Stripe and Resend may process data outside the European Union, including in the United States, under standard contractual clauses or the EU-US Data Privacy Framework. Mail sent to support@hexaciv.com goes through Forward Email (Forward Email LLC, United States), which by its own policy does not store it and passes it on to the operator's own mailbox at Google (Gmail, United States); these transfers rely on standard contractual clauses (Forward Email) or the EU-US Data Privacy Framework (Google).
• Rights of access, rectification, erasure, restriction, objection and portability: write to support@hexaciv.com.
• You can also lodge a complaint with the data protection authority of your country (Spain: AEPD, aepd.es; France: CNIL, cnil.fr).