Privacy Policy

The data controller is the operator of IvyTest. For anything about your personal data, write to us at [email protected].

When you create an account we collect your name and email address. When you buy, Stripe and Link collect the billing details they need, such as your country (see the section on payment).

When you use our platform, we automatically collect certain technical data such as your IP address, browser type, device information, and pages visited. This helps us maintain the security and performance of our services.

We may also collect usage data from the exam simulator, including session results and topic performance, to provide you with personalised analytics and progress tracking within your account.

When you create an account we also note how you reached the site on that visit: the website that sent you (for example a search engine or a social network), the campaign name if the link you followed carried one, an invite or partner code, and the first page you opened. Nothing is stored in your browser for this, and it is not shared with anyone.

If you ask us to email you about a university's dates (when its applications open, before they close, and when its exam date is published), we keep your email address, the universities you chose, your language and which of these emails we have sent you. Unless it is the address of the account you are signed in with, we first send one email asking you to confirm, and send nothing else until you do.

If you use MedApply while signed in, the application plan you build is saved to your account so you find it on any device: the universities you chose, the answers you gave about yourself (such as your nationality, the country of your diploma and your budget), the tasks you ticked, the outcome of each application and your notes. Signed out, it stays only in your browser, and signing out removes it from the browser. "Start over" in MedApply clears it, and deleting your account deletes it.

We use your personal data to deliver the products and services you have purchased, including study guide access, simulator sessions, and video course enrolment. Your email address is used for order confirmations, product delivery, and essential account communications.

Usage data from the simulator is processed to generate your personal analytics dashboard, showing topic accuracy, time management, and progress over time. This data is associated with your account and is not shared with third parties.

With your consent, we may send occasional product news, exam tips, deadlines and offers. You give it with a separate, optional checkbox when you sign up, or later on your Account page, and we record when you gave or withdrew it. You can unsubscribe at any time with the link in any of these emails, with the switch on your Account page, or by contacting us.

If you buy from us, we may also email you, without asking first, about our own products and services similar to what you bought, for example your personal invite link and what it can earn you. The law allows this for existing customers, provided you can refuse at any time: every such email has an unsubscribe link, and you can also write to us.

We use your account details, purchases and study data to provide the service you signed up for or bought: this is necessary to perform our contract with you (GDPR article 6(1)(b)).

We use technical data such as your IP address, and the security check on the sign-in page, to keep IvyTest secure and working and to prevent abuse: this is our legitimate interest (article 6(1)(f)), and you can object to it.

We keep purchase and accounting records because tax law requires it (article 6(1)(c)).

We note how you reached the site when you signed up so that we know which channels bring students to IvyTest: this is our legitimate interest (article 6(1)(f)), and you can object to it by writing to us.

We email you about a university's application and exam dates because you asked us to (article 6(1)(a)). You can stop them at any time with the link in any of these emails.

We send product news and offers only if you have agreed to receive them (article 6(1)(a)), and you can withdraw that consent at any time.

Emails to existing customers about our own similar products, such as your invite link, are our legitimate interest (article 6(1)(f), and the exception for existing customers in article 130(4) of the Italian Privacy Code). You can refuse them at any time, free of charge, with the link in each email.

Payments are processed by Stripe through Stripe Managed Payments, in which Sold through Link, LLC, a Stripe affiliate ("Link"), acts as merchant of record. When you make a purchase, Stripe and Link collect and process your payment information directly. IvyTest does not store or have access to your full credit card details or bank account information.

Stripe and Link process your payment data in accordance with PCI-DSS standards and their own privacy policies. They may collect your name, email, billing address, and payment method details as required to complete transactions, issue receipts and invoices, handle refunds and disputes, and comply with tax obligations. We receive from Stripe what we need to give you access and to keep our accounts: what you bought, the amounts, and the order's status; never your full card details.

For more information about how Stripe handles your data, please refer to the Stripe Privacy Policy at stripe.com/privacy.

Jade, our AI study assistant, and the AI interview simulator are powered by OpenAI. When you use them, what you write and, in the interview simulator, your voice recordings are sent to OpenAI so it can transcribe them and generate a reply or feedback. OpenAI processes this data on our behalf under its data processing terms, and does not use it to train its models.

This processing can take place outside the European Union, with the safeguards the GDPR requires for such transfers. Please do not include other people's personal data, or sensitive information about yourself, in what you send to these features.

We use a small number of service providers, who process data only on our instructions and under data processing agreements:

Supabase, for our database, accounts and file storage. Your account and study data are stored on its servers in Frankfurt, Germany.

Resend, which sends our emails: account confirmations, password resets and, if you agreed to them, product news.

Cloudflare, which delivers the website, stores the video-lesson files and runs the security check on the sign-in page (Turnstile). Our site is built and hosted with Lovable, which serves it through Cloudflare.

Google, only if you choose to sign in with your Google account: Google confirms who you are and gives us your name and email address.

Sentry, which tells us when the website breaks: if a page fails in your browser, it receives a technical error report (the page address, browser and device type, and what failed), without your name or email address. Its servers are in the European Union.

Stripe and Sold through Link, LLC (payments), OpenAI (the AI features) and Plausible (anonymous visit counts), as described in their own sections.

Some of these providers are based in, or may process data in, the United States. Where data leaves the European Economic Area, it is protected by the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

We retain your account data and purchase history for as long as your account is active or as needed to provide you with our services. You can delete your account at any time from your account page, under Delete account: the account and the personal data in it are erased at once. You can also ask us by email, and we will do it within 30 days. Records the law requires us to keep are kept; receipts and invoices for purchases are issued and kept by Link (Sold through Link, LLC), not by us.

Transaction records may be retained for up to 10 years in accordance with Italian and EU tax and accounting regulations. Anonymised, aggregated usage data may be retained indefinitely for product improvement purposes.

Simulator session data and analytics are retained for the duration of your account. Upon account deletion, this data is permanently removed.

An address left for these date alerts is deleted 7 days after we asked you to confirm it, if you did not; otherwise each university you chose is removed 30 days after the exam it was for, the address 30 days after you unsubscribe, and the address itself once nothing is left to wait for.

Under the General Data Protection Regulation (GDPR) and applicable EU/Italian data protection law, you have the right to access, correct, or delete your personal data. You may also request a portable copy of your data or restrict certain processing activities.

You have the right to withdraw consent for marketing communications at any time. Where we process data based on legitimate interest, you have the right to object to that processing.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with a data protection authority: in Italy, the Garante per la protezione dei dati personali.

We use essential cookies and similar browser storage to keep you signed in and remember your preferences. They are necessary for the platform to work and cannot be disabled. If you sign in with Google, or complete the security check on the sign-in page, Google or Cloudflare may use their own cookies to do so.

To understand how the site is used we use Plausible Analytics, which sets no cookies and collects no personal data: it counts visits and actions in aggregate, without identifying you.

We do not use third-party advertising cookies or sell your data to advertisers.

If you have any questions about this privacy policy or how we handle your personal data, please contact us at [email protected].

This privacy policy was last updated on 14 October 2026. We may update it to reflect changes in our practices or the law, and will tell you about material changes by email or with a clear notice on the site.