Enamel, the sole-proprietor business named in the Terms, is responsible for your data (the controller). It collects only what it needs to run Enamel, listed below, and nothing else. There are no advertising trackers and your data is not sold.
What we keep
| What | Why | Basis |
|---|---|---|
| Your email, and the name and profile picture Google sends if you sign in with Google | Your account and access | Contract |
| Your study progress and settings: answers, XP, streaks, mistakes, flagged answers, mock results, your Marathon position, flashcard marks, and choices such as sound and which sets are on | So it follows you between devices | Contract |
| Your purchases: amount, date, payment method, order number | To give you access, and for our accounts | Contract, and legal obligation for the records |
| A referral code, if you arrived through a partner's link | To credit that partner for the introduction | Legitimate interest |
| Your email and what you asked to hear about (the next colloquium date, more ways to pay), if you use an “Email me” form | To send you that news and nothing else. Ask, and we delete it. | Consent |
| The emails we send you. A 6-digit code confirms your address when you sign up with an email. A welcome follows a purchase. If you started but didn't buy, you get at most two reminders: one if a payment didn't go through, and one with the free questions a day after you sign up. We keep only a scrambled form of the code, for 15 minutes. | To make sure every account has a real email, and to help you finish what you started. Each reminder has a link that stops them all. | Contract (code, welcome); legitimate interest (reminders) |
| Your answer to the app's one-question prompt (what almost stopped you buying, or what Enamel should add), if you send one | To make Enamel better, and to write back to you about it | Legitimate interest |
| Anonymous counts of a few page actions (for example, how many people finish the free sample), with the country your browser's time zone points to | To see which pages help. They are not linked to you or your device. | Legitimate interest |
| Server logs: IP address, browser and the address requested, kept by Google Cloud for 30 days | Security and fixing faults | Legitimate interest |
We never receive your card number or your PayPal login. Those go directly to the payment provider.
Who processes it
- Google Firebase: sign-in, database, file storage and hosting
- Google Gmail: sending our emails (the code, the welcome and the reminders)
- Paddle.com: payments by card, PayPal, Apple Pay and Google Pay, as Merchant of Record, under its own privacy notice
Your data may be processed outside your country. Enamel's server runs in Google's europe-west1 region (Belgium), and Firebase sign-in and hosting are global Google services. Paddle processes payments in the United Kingdom and the United States.
Cookies and storage
One cookie, __session, keeps you signed in to the content you paid for. It is strictly necessary and is not used for tracking. Your sign-in is kept by Firebase in your browser's storage, with a note that this browser has signed in before, so the app opens without the sign-in form. Your browser's local storage also keeps a copy of your progress, the pass you picked, your answers to the free sample and the oral date you entered. In the app it also notes which first steps you've done and whether the app has asked you its one question. If you came through a partner's link, it also keeps that link's referral code.
How long we keep it
We keep your account and progress until you ask us to delete them, so your progress is there when you buy again. Purchase records are kept as long as the law requires for accounting. Referral codes are kept with the order they came with, as long as purchase records are, and in your browser until a purchase uses one. Email-me addresses: deleted once we've sent that news, or when you ask. Answers to the one-question prompt: kept until you ask us to delete them, and deleted with your account. The anonymous counts are daily totals with nothing about you in them, kept as totals. Server logs: 30 days, then Google Cloud deletes them.
Your choices
You can export your progress from the Stats tab at any time. You can ask to see the data we hold about you, to have it corrected, or to have it deleted, account and progress included. Write to enamel.colloquium
If you think we have handled your data wrongly, you also have the right to complain to the data-protection authority where you live.
Contact
Questions about your data, or about this policy: enamel.colloquium