Privacy Policy

The controller of your personal data is DUVAN ALP EREN, VAT number 03013430180, Via Indipendenza, 27100 Pavia, Italy, Italy. For anything in this policy, contact infomasterimat@gmail.com.

When you register and use Master IMAT we hold:

• Account details — your name and email address.
• Your password — stored only as a bcrypt hash. We cannot read it and cannot tell you what it is.
• Study activity — the questions you answer, whether you got them right, your quiz sessions, mock exam attempts and scores, bookmarks and notes.
• Account status — your plan, when it started and when it ends.
• Technical data — basic server logs generated when you use the site.

We do not collect payment card details. We never see or store your card number.

• To run your account and provide the Service — including tracking progress and showing your results. Basis: performance of our contract with you.
• To take payment and grant the access you bought. Basis: performance of our contract.
• To email you about your account — password resets, and notices such as your access period ending. Basis: performance of our contract.
• To keep the Service secure and improve our questions — for example spotting items that are answered wrongly by nearly everyone. Basis: our legitimate interest in a working, accurate product.

We do not sell your data, and we do not use it for advertising or profiling.

We use a small number of providers, who act on our instructions:

• Turso — database hosting.
• Resend — sending account emails.
• Vercel Inc. — running the website.
• Stripe Payments Europe Ltd — processing payments.
• Google Ireland Ltd — mock exam results are exported to a Google spreadsheet.

Some of these are based outside the European Economic Area. Where data is transferred outside the EEA it is protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

We use only what the site needs to work: a session cookie that keeps you signed in, and a security cookie that protects sign-in forms. There are no advertising cookies, and no third-party analytics or tracking. Because these cookies are strictly necessary, no consent banner is required.

We keep your account and study history for as long as your account exists, so your progress is there when you come back. Ask us to delete your account and we remove your personal data, keeping only what we must for legal or accounting reasons — invoices, for instance, are kept as Italian tax law requires. Password reset links expire after one hour.

Under the GDPR you can ask us to:

• give you a copy of the data we hold about you;
• correct anything inaccurate;
• delete your data;
• restrict or object to how we use it;
• send your data to you or another provider in a portable format.

Write to infomasterimat@gmail.com and we will respond within one month. If you think we have handled your data badly you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

Passwords are hashed with bcrypt, traffic is encrypted in transit, and access to the production database is restricted. No system is perfectly secure, but if a breach ever affects your rights we will tell you and the supervisory authority as the law requires.

The Service is aimed at students preparing for university admission and is not intended for children under 16. If you believe a child under 16 has given us personal data, contact us and we will delete it.

If we change this policy we will update the date above and, for material changes, tell you by email or in the Service.