Privacy Policy
Last updated: 7 August 2026
1. Who we are. Practica operates practica-lab.com. Contact: hello.practica.lab@gmail.com. This policy explains what personal data we collect and why. We comply with Singapore's Personal Data Protection Act (PDPA) and, where applicable, the GDPR.
2. What we collect.
- Email address: used to sign you in (magic link) and to contact you about your purchases.
- Purchase records: what you bought, when, and the amount, received from our payment processor. We never see or store your card details; payment is handled entirely by Stripe.
- Exam activity: your attempts, answers, scores, and timestamps, stored so you can review results and progress.
- We do not run advertising or cross-site tracking, and we do not use analytics cookies at launch. We use only cookies strictly necessary for signing you in.
3. Why we process it. To provide the service you purchased (contract), to keep records of transactions (legal obligation), and to respond to support requests (legitimate interest).
4. Processors we use. Supabase (database and authentication hosting) and Stripe (payments), plus Vercel (website hosting). Each processes data on our behalf under their own data processing terms. Data may be stored or processed outside your country; our processors maintain safeguards recognized under applicable law for such transfers.
5. Retention. Account and exam data are kept while your account is active. Purchase records are kept as long as required for tax and accounting purposes. If you ask us to delete your account, we delete your account and exam data within 30 days, keeping only what payment regulations require us to retain.
6. Your rights. You may request access to, correction of, or deletion of your personal data, and (where GDPR applies) portability or restriction, by emailing hello.practica.lab@gmail.com. We respond within 30 days. If you are in the EU/UK you may also complain to your local supervisory authority; in Singapore, to the PDPC.
7. Security. Data is encrypted in transit, access to production data is restricted, and per-user data access is enforced at the database layer.
8. Changes. We will post any changes here with an updated date.