Privacy Policy

Last updated: 7 September 2026

1. Who We Are

PaperSolve.org ("the Platform") is operated by PaperSolve ("we", "us", "our"). We provide online video courses for IGCSE exam preparation. This policy explains what personal data we collect, why we collect it, and how we protect it. It describes how the Platform works today; where something is still being built, we say so.

2. What We Collect

We collect the following categories of personal data:

Data	Source	Purpose
Name, email address, profile photo, Google account identifier	Google sign-in. You can change your display name in your profile settings.	Creating and securing your account; showing your name and photo to friends you connect with and, if you join a school on the Platform, to that school's staff; sending you account emails
Purchase records: what you bought, amounts and currency, discounts and wallet credits applied, and the Paddle transaction reference	Your purchases through Paddle. Card and billing details are entered directly with Paddle and never reach our servers.	Order fulfilment, refunds, accounting, referral credits
Learning records: how far you have watched each video and when you completed it; each exam attempt with its score, timing, and every answer you selected	Your use of the Platform	Progress tracking, resume playback, best scores and the friends-only leaderboard, refund eligibility (see our Refund Policy)
Friends and referrals: friend requests, your friends list, and who referred whom	Friend requests you send or accept; referral links you share or follow. Signing up through a friend's link also connects the two of you as friends.	Friends features, referral credit attribution
Support messages	Tickets and replies you write on the support page	Answering your request
School and classroom membership	Only if you join a school or classroom on the Platform, using its join code or an invitation	Giving you the courses your school has licensed; letting your school's staff manage their class lists
IP address and browser details (User-Agent), and a hash of the two	Recorded automatically when you sign in, and on requests we rate-limit	Security, limiting each account to one active session, reviewing suspected account sharing, abuse prevention
Video watermark: your initials and an account code	Derived from your account	Shown on every video you watch, to deter redistribution; we can trace the code back to your account
Notifications	Generated by the Platform	Telling you about activity on your account

We do not collect sensitive personal data (health, biometric, religious, or political data). We do not ask you for a password and do not offer password sign-in: authentication is handled by Google, and your Google password never reaches us. When you first link your Google account, Google issues us technical sign-in tokens, which we keep with your account record.

Device records, in plain terms: when you sign in we record your IP address and browser details, and we keep a list of the distinct browser-and-network combinations your account has signed in from. We use this to allow one active session per account (signing in on a new device signs out the previous one) and so that our staff can review accounts that appear to be shared. This is a coarse server-side record, not a browser fingerprint: we run no fingerprinting script, and it cannot follow you to other websites.

If you choose to share an exam result, the public share page shows your first name, your score, and the course and exam names — never your email address or full name.

3. Legal Basis for Processing

We process your data based on:

Contract performance: processing required to provide the service you purchased (account, course access, progress tracking, support)
Legitimate interest: security monitoring, limiting each account to one active session, reviewing suspected account sharing, abuse prevention, and keeping accounting records
Consent:optional features you can switch off at any time in your profile settings — email updates, letting friends see your progress and rank you on the leaderboard, and being findable by email address

4. Third-Party Processors

We share data only with the processors necessary to operate the Platform:

Paddle.com Market Ltd— payment processing, invoicing and tax compliance as our merchant of record (UK based). Paddle's checkout runs inside our cart page and receives your email address and the items you are buying; card details are entered directly with Paddle.
Vercel Inc.— application hosting and delivery (US company; our application runs in Vercel's London region)
Neon, Inc.— database hosting (US company; our database is in AWS eu-west-2, London)
BunnyWay d.o.o. (Bunny CDN)— video streaming (EU based). Your browser fetches video directly from Bunny, so Bunny sees your IP address and browser details; the video links it receives do not contain your identity. Course thumbnails on our public pages also load from Bunny.
Cloudflare, Inc.— storage for images used on the Platform (exam question images, video thumbnails, course covers, school logos), fetched by your browser through short-lived links (US company). We also plan to keep off-site database backups with Cloudflare; see section 5.
Google LLC— sign-in via Google OAuth (US company). Your profile photo is loaded from Google's servers whenever it is shown.
Resend, Inc.— delivery of our emails (welcome, purchase, referral and wallet-credit, support, and course-expiry notices). Resend receives your email address and the content of each email (US company).
Upstash, Inc.— the store behind our rate limiting. It holds your IP address and, for signed-in requests, your account identifier, for a short period that expires automatically (US company).

We do not sell personal data. We do not share data with advertisers or data brokers. We do not use third-party analytics or tracking scripts.

5. Data Retention

How long we keep data, as the Platform currently operates:

Account details, learning records, friends, support messages, and school membership are kept for as long as your account exists. They are not deleted automatically when a course access period ends.
Purchase, wallet, and referral records are kept for as long as your account exists and, after an account is deleted, for as long as accounting and tax rules require.
Sign-in device records: the record of your current session is kept while it is active. Records of earlier sessions are deleted 30 days after they were created. The list of distinct devices your account has signed in from is kept for as long as your account exists.
Rate-limiting records (IP address) expire automatically within a few hours at most.
Notifications: read notifications are deleted after 90 days, and we keep at most 1,000 per account.
Administrative audit log: our record of the actions our staff take on accounts, which references your account identifier, is kept permanently.
Server logs: our hosting provider, Vercel, keeps request logs for the period set by our hosting plan; we do not run a separate log store.
Backups: our database provider keeps rolling point-in-time backups for disaster recovery. We are setting up additional off-site backup copies on Cloudflare; their retention (35 days for daily copies and 180 days for weekly copies, with the period for monthly copies still to be decided) will be stated here before they are switched on.

You may ask us to delete your account and associated data at any time by contacting us at hello@papersolve.org. Deletion is currently carried out by our team by hand rather than through a self-service control, and we will confirm when it is done. Records we must keep for legal or accounting reasons (purchase and payment records, and the administrative audit log) are retained; where we can, we remove your identifying details from them.

6. Your Rights

Under Saudi Arabia's Personal Data Protection Law (PDPL) and applicable international regulations, you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data (subject to legal retention obligations)
Object to processing based on legitimate interest
Withdraw consent for optional processing at any time
Request a copy of your data in a portable format

To exercise any of these rights, contact us at hello@papersolve.org. We currently handle these requests by email rather than through self-service tools, and we will respond within 30 days.

7. Cookies and Local Storage

The Platform sets the following cookies:

Sign-in cookies: the session cookie that keeps you signed in, plus short-lived cookies needed to complete Google sign-in securely.
ps_ref:if you arrive through a friend's referral link, a cookie holding their referral code for 30 days so they receive credit when you sign up.
An admin-only preference cookie used by our staff when they view the Platform as a student sees it.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies, and we do not currently show a cookie banner. Paddle's checkout, which runs inside our cart page, is governed by Paddle's own privacy and cookie policy.

We also use your browser's local storage (not cookies) for unsaved exam answers (kept for up to 3 days and removed when you sign out), your playback position and chapter trail in videos, and whether you dismissed the referral banner. These copies stay on your device; the server-side learning record described in section 2 is kept separately.

8. Security

We implement appropriate technical and organizational measures to protect your data, including:

HTTPS encryption for all data in transit
Encrypted database connections (TLS/SSL)
Role-based access control for administrative functions
One active session per account, and a review surface for suspected account sharing
Rate limiting and abuse detection
Audit logging of administrative actions
Content Security Policy headers to prevent XSS

9. Children

The Platform is designed for IGCSE students, many of whom are under 18. We do not ask for your age at sign-up and we do not verify parental consent. If you are under 18, please use the Platform with the agreement of a parent or guardian. If you believe a child has created an account without appropriate consent, contact us and we will delete the account.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on the Platform. The "last updated" date at the top of this page reflects the most recent revision.

11. Contact

For privacy-related questions or to exercise your data rights, contact us at hello@papersolve.org.