Privacy policy

This policy explains how we collect, use, share and protect personal data when you use the GRE Mastery website at www.gre-mastery.com and the learning platform at app.gre-mastery.com (together, the "Service"). It also explains your rights and how to use them. We have tried to keep it short and plain. If anything is unclear, email us at [email protected].

Contents

1. Who we are
2. Data we collect
3. Where data comes from
4. Why we use it and our legal bases
5. Who we share it with
6. International transfers
7. How long we keep it
8. Your rights
9. How to use your rights
10. Automated processing
11. Marketing emails
12. Cookies and similar storage
13. Children
14. Security
15. Data breaches
16. Changes to this policy
17. Contact and complaints

1. Who we are

The Service is operated by Becket & Partners LLC, a limited liability company licensed by Sharjah Media City (Shams) Free Zone, Government of Sharjah, United Arab Emirates. License No. 2647737.01 (Formation No. 2647737). Registered address: Sharjah Media City, Sharjah, United Arab Emirates. Manager: Guy Hermann Ngambeket Ndiandukue.

Becket & Partners LLC is the controller of your personal data. This means we decide why and how your data is used. We have not appointed a data protection officer. For any privacy question or request, contact [email protected].

We follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the "PDPL"). Where they apply to you, we also follow the EU General Data Protection Regulation and the UK GDPR (together, "GDPR") and similar laws in other countries.

2. Data we collect

• Account data: your name, email address, password (stored only as a salted hash, never in readable form), target score, test date, and whether your email is verified.
• Optional profile data: country and date of birth, if you choose to add them.
• Learning data: your answers, scores, time spent, progress through lessons, flashcard, practice and simulation activity, self-assessment ratings, diagnostic results, your learning path, notes and question reports.
• Bookings and communications: tutoring requests and sessions, bootcamp enrollments, reschedule requests, reviews you write, and messages you send to support.
• Payment data: payments are handled by Stripe. We receive your Stripe customer and subscription identifiers, plan, billing status, amounts and dates, and a card fingerprint used only to enforce one free trial per card. We never receive or store your full card number.
• Video session data: when you join a tutoring session or bootcamp class, your display name and your audio and video are carried by our video provider, Daily. Tutoring sessions and bootcamp classes are recorded (audio, video and shared screen) and stored by Daily. We ask for your agreement before you book a session or register for a bootcamp, and you cannot book without it. Recordings are used so learners can review sessions, to check teaching quality and to handle complaints or disputes. They are not sold, published or used for advertising, and they are deleted after 90 days.
• Consent records: when you accepted our Terms and this policy, which version, whether you confirmed you are 16 or older, and your marketing choices, with the date, IP address and browser type.
• Email data: which service and marketing emails we sent you, your email preferences, and unsubscribe actions.
• Referral and coupon data: referral codes you used or shared, coupons issued to you and redeemed.
• Website download requests: your first name and email when you request a free guide on our website, which guide, and whether you ticked the box to receive study tips.
• Technical and security data: IP address, browser and device type, sign-in sessions, and security signals from Cloudflare Turnstile, used to keep the Service secure and prevent abuse.

We do not ask for special category data (such as health, religion or ethnicity) and ask you not to send it to us.

3. Where data comes from

• From you, when you register, use the Service, book sessions, fill in forms or contact us.
• Generated by the Service, such as your scores, progress and learning path.
• From our providers: Stripe tells us about payment and subscription status; Cloudflare tells us whether a sign-up passed the security check.
• From other users: if a friend invites you with a referral code, we link the referral to your account. Tutors may add notes about sessions you booked.

4. Why we use it and our legal bases

Under the GDPR we must have a legal basis for each use of your data. Under the PDPL we process data with your consent or where an exception applies, such as performing a contract with you, meeting a legal obligation, or protecting your interests. The table below sets out each purpose.

Where we rely on legitimate interests, we have checked that our interests are not overridden by your rights. You can object at any time (see section 8).

Giving us your name, email and password is needed to create an account. Optional fields such as country and date of birth are not needed to use the Service.

5. Who we share it with

We do not sell or rent your personal data, and we do not share it for advertising. We share it only with the service providers below, who process it on our instructions under data processing agreements, and with tutors and instructors for sessions you book.

Stripe also acts as a separate controller for some data it needs to meet its own legal duties, such as fraud prevention and financial regulation. See Stripe's privacy policy. Cloudflare acts as a separate controller for limited Turnstile signals it uses to improve bot detection.

Our tutors and bootcamp instructors see your name, email and session details for sessions you book. Other learners on the leaderboard see only your first name and last initial and your points.

We may also disclose data if the law requires it, to protect the rights and safety of our users or others, or as part of a sale or reorganisation of our business, in which case the new owner will be bound by this policy.

6. International transfers

We are based in the UAE and our providers mainly process data in the United States. This means your data is transferred outside the UAE, and outside the EU and UK if you live there.

• From the EU, EEA or UK: we rely on an adequacy decision where one exists (for example, the EU-US Data Privacy Framework for certified providers), or on the European Commission's Standard Contractual Clauses and the UK Addendum, which are included in our providers' data processing agreements.
• From the UAE: under Articles 22 and 23 of the PDPL, we transfer data to countries with adequate protection, or under contracts that require the recipient to protect data to the PDPL standard, or where the transfer is needed to perform our contract with you.

You can ask us for more information about these safeguards at [email protected].

7. How long we keep it

We keep personal data only as long as we need it. Our system deletes data automatically on the schedule below.

8. Your rights

Depending on where you live, you have some or all of these rights. Under the GDPR you have all of them. The PDPL gives similar rights.

• Access: get a copy of your personal data and information about how we use it.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Restriction: ask us to limit how we use your data, for example while we check a complaint.
• Portability: receive the data you gave us in a structured, machine-readable format (JSON) and have it sent to another provider.
• Objection: object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect processing before you withdrew it.
• Automated decisions: not to be subject to decisions based only on automated processing that have legal or similarly significant effects (see section 10).
• Complain: to a data protection authority. In the UAE this is the UAE Data Office. In the EU or EEA, the supervisory authority where you live or work. In the UK, the Information Commissioner's Office (ICO). We would appreciate the chance to resolve your concern first.

Residents of California and some other US states also have rights to know, delete and correct their data, and to opt out of the sale or sharing of personal data. We do not sell or share personal data for cross-context behavioural advertising. We will not treat you differently for using your rights.

9. How to use your rights

• In the app: go to Profile, then Privacy & data. You can download all your data as a JSON file, see your consent history and delete your account. Go to Profile, then Settings, to correct your name, email, target score and test date, and to change your email preferences.
• By email: write to [email protected] from the address on your account. For any other request, such as restriction or objection, email us.

We reply within 30 days. If a request is complex, we may extend this by up to two more months and will tell you why. We may need to confirm your identity before acting. Requests are free unless they are clearly unfounded or excessive.

What happens when you delete your account: any subscription is cancelled at Stripe immediately, you are signed out on all devices, and your profile, learning data, notes and preferences are deleted. We keep only what the law requires, such as payment records, and records of paid bookings in anonymised form.

10. Automated processing

The Service uses your answers, ratings and test date to estimate your score and to build and update your learning path automatically. This is profiling for the purpose of personalising your study plan. It does not produce legal effects or similarly significant effects on you: it does not decide access to the Service, prices, admissions or any official score. You can retake the assessment or change your test date at any time to change your plan.

11. Marketing emails

We send offers, coupons, product announcements and study tips by email only if you opt in, for example by ticking "Send me offers and promotions by email" when you register or turning it on in Profile, then Settings. This is off by default. Every marketing email includes an unsubscribe link that works without signing in, and you can turn marketing off in your Profile at any time.

Service emails, such as security notices, booking confirmations and receipts, are part of running your account and cannot be turned off. Study reminders and progress recaps are on by default and you can turn them off in your email preferences or with the link in each email.

12. Cookies and similar storage

We do not use advertising or analytics cookies, and we do not use tracking pixels. We use only storage that is strictly necessary to provide the Service you ask for, so we do not show a cookie banner.

Fonts and charting code are served from our own servers, so loading our pages does not send your data to font or code delivery networks. The video library is loaded only when you join a video session.

13. Children

The Service is for people aged 16 and over. You must confirm you are 16 or older to register. If we learn that we hold data about someone under 16, we will delete it. If you believe a child has given us data, contact us.

14. Security

We protect your data with encryption in transit (HTTPS with HSTS), salted password hashing (PBKDF2-SHA256 with 600,000 iterations), access controls that limit staff access to what they need, rate limits on sign-in and sensitive actions, a CAPTCHA on sign-up, security headers in the browser, and regular deletion of data we no longer need. No system is perfectly secure, so please use a strong, unique password.

15. Data breaches

If a personal data breach happens, we will act quickly to contain it. We will report it to the UAE Data Office as the PDPL requires, and, for breaches covered by the GDPR, to the relevant supervisory authority within 72 hours of becoming aware of it unless it is unlikely to put anyone at risk. We will tell you without undue delay if the breach affects the privacy, confidentiality or security of your data in a way that the law says you must be told about, explain what happened and what you can do.

16. Changes to this policy

We may update this policy. The effective date and version at the top show when it last changed. If we make important changes, we will tell you by email or in the app before they take effect, and ask for your consent again where the law requires it.

17. Contact and complaints

Becket & Partners LLC, Sharjah Media City, Sharjah, United Arab Emirates. Email: [email protected].

If you are not happy with our reply, you can complain to the UAE Data Office, to the data protection authority in the EU or EEA country where you live or work, or to the UK Information Commissioner's Office.