Privacy Policy

Exam Arena app. For your account, payments, the personality test and the in-app AI assistant, the authoritative and up-to-date version of our privacy policy is published in the app: https://app.examarena.com/privacy. It prevails over this page in case of any difference.

Last updated: November 13, 2026

This policy applies to the website www.examarena.com (Part A below), the Exam Arena mobile app (iOS and Android) and the web service app.examarena.com, all operated by ARENA, registered in France under SIREN 934 277 344, with its registered office at 229 rue de Solférino, 59000 Lille, France.

ARENA is the data controller under the GDPR.

For any privacy-related question:
Email: contact@examarena.com
Mail: ARENA, 229 rue de Solférino, 59000 Lille, France

Part A – The website www.examarena.com

This part covers what happens when you browse the website. Articles 1 to 10 below cover the app. Your rights (Article 5) apply to both.

A.1 – Hosting and server logs
The website is hosted by Hostinger International Ltd (61 Lordou Vironos Street, 6023 Larnaca, Cyprus) on a server located in France. For every page, the server processes the technical data your browser sends: IP address, date and time, page requested, referring page, browser and operating system. Purpose: serving the website and protecting it against abuse. Legal basis: legitimate interest. Retention: 14 days.

A.2 – Your cookie choice
On your first visit, a banner asks for your consent to two categories: “Audience measurement” (Google Analytics, Microsoft Clarity) and “Advertising and partners” (Google Ads, ad click identifiers, paying the partner site that referred you). “Reject all” and “Accept all” are offered at the same level, and “Customise” lets you choose category by category. Until you answer, and if you reject, none of these tools is loaded.
Your choice is kept for 6 months in the ea_consent cookie, on the examarena.com domain (so it also applies to app.examarena.com), after which we ask again. You can change your mind at any time with the “Cookies” link at the bottom of every page; if you withdraw your consent, cookies already set are deleted. We are testing several banner layouts: the one shown to you is kept for the duration of your visit (sessionStorage ea_ck_d).

A.3 – What works without your consent
Necessary trackers: the language you chose (pll_language cookie, 1 year), your cookie choice (ea_consent, 6 months) and a random identifier that keeps the same offer and price on the website and in the app during our price tests (ea_pv, 1 year).
Chat: the Crisp window (Crisp IM SAS, Nantes, France; data hosted in the European Union) only loads if you click its bubble. It then keeps a session (crisp-client cookie, 6 months) to continue the conversation. Your messages and the email address you give are used to reply to you (legal basis: pre-contractual steps or legitimate interest); conversations are deleted after 24 months without a new message.
Anonymous statistics: Umami, installed on our own server in France (hosting provider Contabo; requests pass through Cloudflare’s network), counts page views, where visits come from (including utm_* parameters) and clicks to the app. It sets no cookie, does not keep your IP address, and we strip ad click identifiers from its data. Legal basis: legitimate interest (audience measurement exempt from consent). Retention: 25 months. You can opt out from the “Cookies” link, under “Anonymous statistics”; your opt-out is kept in your browser (localStorage umami.disabled).
Visit source: the campaign parameters (utm_*) and the partner site code (?v=) of your landing page are kept for the duration of your visit (sessionStorage) and added to links to the app, so we know where your sign-up came from. They contain no personal identifier. Legal basis: legitimate interest.

A.4 – Audience measurement, with your consent
Google Analytics 4 (measurement ID G-4J6N2Y332F), loaded by Google Tag Manager (GTM-TBSF7K5P) and provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with transfer to Google LLC in the United States: pages viewed, visit duration, source, device, browser, approximate location and a pseudonymous identifier. Cookies _ga and _ga_* (up to 2 years); reports kept for 14 months.
Microsoft Clarity (project tndtpzwww7), provided by Microsoft Ireland Operations Limited (Dublin, Ireland), with transfer to Microsoft Corporation in the United States: recording of your browsing (clicks, scrolling, mouse movements, input outside sensitive fields) to spot what gets in the way. Cookies _clck (1 year) and _clsk (1 day).
Legal basis: your consent.

A.5 – Advertising and partners, with your consent
Google Ads (Google Ireland Limited and Google LLC): measuring sign-ups that come from our ads and building lists to show you our ads on Google. Cookies _gcl_au and _gcl_aw (90 days). The ad click identifiers of your landing page (gclid, gbraid, wbraid, fbclid, msclkid) are kept for the duration of your visit and passed to the app.
Partners: if you arrive through a partner site’s link, its code (?v=) is kept for 30 days in the ea_aff cookie, so we can pay the partner if you subscribe.
Legal basis: your consent.

A.6 – Contact form
Name, email address, message, confirmation that you have read this policy, and the IP address the message was sent from (protection against automated submissions). The message is stored in the website’s database and emailed to contact@examarena.com. Purpose: replying to you. Legal basis: pre-contractual steps or legitimate interest. Retention: up to 24 months.

A.7 – Content loaded from other sites
Fonts come from Google Fonts, icons from jsDelivr and the thumbnails of some videos from YouTube (the video itself only loads on click): your browser then sends your IP address to these services, without cookies. The TOEIC Listening page embeds a whyp.it audio player and the recruitment centre map uses Mapbox (Mapbox Inc., United States): they load when the page is displayed and may set their own cookies or browser storage. We plan to serve this content from our own server.

A.8 – Recipients and transfers outside the European Union
Hostinger (hosting, France), Contabo GmbH (Umami statistics server, France), Cloudflare, Inc. (network relaying the Umami statistics; United States), Google Ireland Limited and Google LLC (Analytics, Ads, fonts; United States), Microsoft Ireland Operations Limited and Microsoft Corporation (Clarity; United States), Crisp IM SAS (chat; France), jsDelivr (icons), whyp.it (audio player) and Mapbox Inc. (map; United States). Transfers to the United States rely on the EU–US Data Privacy Framework for certified companies and on the European Commission’s standard contractual clauses. We do not sell your data.

A.9 – What the website does not do
No Meta, TikTok or LinkedIn pixel. The icons of our social networks are plain links. No automated decision is made from your browsing.

Article 1 – What data do we collect?

We only collect data needed to run the service and improve your experience. We never sell your data.

1.1 Identity and contact data
First name, last name (provided at signup or via Sign In with Apple / Google).
Email address.
Profile picture (optional).

1.2 Authentication data
Password (stored hashed and salted by Supabase, never accessible in clear text).
Apple / Google identifier if you use Sign In with Apple or Google.

1.3 Technical identifiers
Internal user ID (randomly generated UUID).
Device token for push notifications (Firebase Cloud Messaging), only if you accept notifications.

1.4 Product usage data
Exercise attempts (questions, answers, scores, time spent).
Lessons read and completion status.
Sport sessions completed.
Selected preparation, priority subjects, exam date entered during onboarding.

1.5 Payment data
Subscription status (free, premium, expiration dates).
Stripe (web) or RevenueCat (iOS / Android) technical identifiers.
Payment history (amount, currency, date, status, billing country).
We never store credit card numbers on our servers. They are processed directly by Stripe, Apple, or Google depending on the payment channel.

1.6 Preference data
Selected language.
Email notification preferences.

1.7 Marketing and attribution data
Acquisition source (UTM parameters: utm_source, utm_medium, utm_campaign, utm_term, utm_content).
Landing page, referrer.
Ad click identifiers: gclid (Google Ads), gbraid / wbraid (Google iOS).
Apple Search Ads attribution (campaign and ad identifiers, no Apple user identifier).

Article 2 – Why we collect this data

Email, name, password: account creation, authentication. Legal basis: performance of the contract.

User ID, Apple / Google identifiers: link your data to your account. Legal basis: performance of the contract.

Product usage data: save and display your progress. Legal basis: performance of the contract.

Payment data: manage your subscription, support, accounting obligations. Legal basis: contract and legal obligation.

Push device token: notify you about free credits and active offers. Legal basis: consent (OS-level prompt).

Email and subscription status: send transactional emails (welcome, receipts, password reset). Legal basis: performance of the contract.

Email and payment behavior: reminder email if you started a payment without completing it. Legal basis: legitimate interest (help you resume your purchase).

Aggregated usage data: understand how the service is used, prioritize improvements. Legal basis: legitimate interest.

UTM, click IDs, Apple Search Ads attribution: measure the effectiveness of our marketing campaigns. Legal basis: legitimate interest.

Language, preferences: personalize your interface. Legal basis: performance of the contract.

No automated decision producing legal effects is made from your data. There is no advertising profiling.

Article 3 – Who we share data with

Your data is hosted and processed by providers selected for their GDPR compliance. Each acts as a data processor under the GDPR, bound to us by a Data Processing Agreement (DPA).

Supabase Inc. – Database, authentication, file storage. France (Paris, eu-west-3). DPA and Standard Contractual Clauses.

Vercel Inc. – Web application hosting. United States (global edge network). DPA and Standard Contractual Clauses.

Stripe Payments Europe Ltd – Web payment processing. Ireland and United States. Stripe DPA and Standard Contractual Clauses.

RevenueCat Inc. – In-app purchase management (iOS and Android). United States. Standard Contractual Clauses.

Apple Inc. – Sign In with Apple, App Store, Apple Search Ads, iOS push notifications. United States. Apple DPA.

Google LLC – Sign In with Google, Firebase Cloud Messaging, Google Ads, Google Play. United States. Standard Contractual Clauses.

Resend Inc. – Transactional email delivery. United States. Standard Contractual Clauses.

Umami – Cookieless web analytics, instance operated by ARENA on a server in France (Contabo; requests pass through Cloudflare’s network).

We never sell your data to third parties for advertising purposes.

Transfers outside the European Union
Some of our providers are based in the United States. These transfers are governed by the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) and, where applicable, by the EU-US Data Privacy Framework for certified providers.

Article 4 – How long we keep your data

Active account: as long as your account is open.

Deleted account: permanently erased within 30 days of your deletion request.

Payment data: 10 years from invoicing (French accounting and tax obligation).

Technical logs (sent emails, push notifications): 12 months.

Marketing attribution data (UTM, click IDs): 13 months.

Exercise attempts and progress: for the duration of your account, deleted with the account.

Article 5 – Your rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access: get a copy of your data. By request to contact@examarena.com.

Right to rectification: update your data via My account > Profile.

Right to erasure: delete your account via My account > Account > Delete my account. Your data is then erased within 30 days, except for data we are required to keep by law (payments).

Right to data portability: receive your data in a structured format. By request to contact@examarena.com.

Right to object: object to processing based on our legitimate interest by emailing contact@examarena.com.

Right to restrict processing: restrict the use of your data, by emailing the same address.

Right to withdraw consent: for push notifications, from your device settings. For marketing emails, via My account > Notifications.

We respond to any request within one month at the latest.

If you disagree with our response, you can lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris, France, www.cnil.fr) or with your local supervisory authority.

Article 6 – Cookies and trackers

On app.examarena.com
Session cookies (Supabase): strictly necessary for authentication. Exempt from consent under CNIL guidance 2020-091.
Umami Analytics: anonymous audience measurement, no cookies, no fingerprinting, self-hosted instance operated by ARENA. Compliant with the CNIL audience measurement exemption.

In the mobile app
No third-party cookies. No advertising SDK (no Facebook Pixel, no Google Analytics, no Hotjar).
On iOS, the Apple AdServices framework is used once at install time to measure the effectiveness of our Apple Search Ads campaigns, anonymously and without any advertising identifier (no IDFA).
Push notifications are enabled only with your explicit consent via the iOS / Android system prompt.

The app uses no advertising cookies, so it shows no cookie banner. The website www.examarena.com has its own banner (Part A).

Article 7 – Security

Encrypted connections in HTTPS / TLS 1.3.

Passwords hashed and salted by Supabase Auth (bcrypt).

Strong authentication available via Sign In with Apple or Google.

Data access protected by PostgreSQL Row Level Security.

Daily encrypted backups at Supabase.

In case of a data breach posing a risk to your rights, we will notify you without delay, as required by Article 34 of the GDPR.

Article 8 – Minors

The service is open from age 15, the minimum digital consent age in France. For users between 15 and 18, registration is under the responsibility of their legal guardians.

Article 9 – Changes

We may update this policy from time to time. Any substantial change will be notified by email and / or in the app. The last update date appears at the top of this page.

Article 10 – Contact

For any question:
Email: contact@examarena.com
Mail: ARENA, 229 rue de Solférino, 59000 Lille, France