Privacy policy

1. Who we are

This policy is issued by SmarTest Ltd, based in Ireland (registration pending), referred to below as “SmarTest”, “we”, or “us”. We are the data controller for personal data processed through the SmarTest website, application, and associated services.

You can reach our data protection contact at privacy@smartestmaths.ie.

2. What we collect

Account data

When you create a SmarTest account we collect your full name, school email address, the school you work at, and optionally your role (e.g. teacher, head of mathematics). We do not collect personal email addresses.

Content you create

We store the papers, figures, marking schemes, notes, and shared library items you create in SmarTest. This content belongs to you. We process it so we can display it back to you, sync it across devices, and share it with colleagues in your workspace if you choose to.

Usage data

We record basic usage events so we can fix problems and improve the product. This covers page loads, feature interactions, error reports, and approximate location derived from IP address (country-level only). We do not build advertising profiles.

Billing data

If you or your school are on a paid plan, Stripe collects and stores payment information directly. SmarTest stores a customer identifier, plan tier, and invoice history. We never see your card number.

3. Why we collect it

We process personal data on the following legal bases under the GDPR:

• Contract. To provide the SmarTest service you have signed up for: account data, content, and billing data.
• Legitimate interest. To keep the service working and secure: usage data, error reports, abuse prevention.
• Legal obligation. To meet tax and company-law record-keeping requirements: billing records.
• Consent. For any optional feature that requires it. We will always ask first and you can withdraw consent at any time.

4. Student data

When features that involve identifiable student data are introduced (for example, uploading student work for marking), this policy will be updated in advance, schools will be given notice, and a data processing addendum will be put in place before the feature is enabled on any account.

5. Sub-processors

We use a small number of specialist vendors to deliver the service. Each sub-processor only sees the data required for its specific job, and each is bound by a written data processing agreement compliant with Article 28 GDPR.

When a sub-processor is added, removed, or replaced, we update this page and notify account administrators at least 14 days before the change takes effect. Sentry, Resend, and Stripe are marked “planned” because error reporting, transactional email, and paid billing are not yet wired in the beta; this page will move them to “active” the moment they are.

6. Where your data lives

Primary data storage is in the European Union, specifically a Google Cloud Firestore EU multi-region. Sub-processors that operate across multiple regions (Google Cloud Vertex AI for generation, Vercel edge for static delivery, Stripe and Resend once they launch) do so under Standard Contractual Clauses and equivalent transfer safeguards.

We do not transfer data to any processor that has not executed an SCC-based data processing agreement with us.

7. How long we keep it

• Account data: for the lifetime of the account, plus 30 days after deletion to allow recovery.
• Content: same as account data. Deleting a paper or figure removes it immediately from your view and permanently after 30 days.
• Usage and error data: 90 days rolling.
• Billing records: 7 years, as required by Irish tax law.

8. Your rights

Under the GDPR you have the right to access, rectify, port, and delete your personal data, to restrict or object to processing, and to lodge a complaint with a supervisory authority (in Ireland, the Data Protection Commission, dataprotection.ie).

You can delete your account directly from your account page inside SmarTest. For data access, export, correction, restriction, or objection requests, email privacy@smartestmaths.ie. We will respond within 30 days.

9. Cookies

SmarTest sets one type of cookie: an essential session cookie that keeps you signed in. We do not run analytics cookies, advertising cookies, or any third-party tracking. Because we only use essential cookies, there is no cookie banner to click through.

Your browser's standard controls let you clear the session cookie at any time; doing so signs you out.

10. Changes to this policy

When we make material changes to this policy we will update the effective date at the top of the page and notify account administrators by email at least 14 days before the change takes effect. Minor clarifications (typos, formatting) can be made without notice.

Previous versions are available on request.

11. Contact