Privacy Notice

SPaG Quest ("we", "us") is provided by PRAS Consulting Ltd. We act as the data controller for personal data collected through the service.

For data-protection or privacy questions, email us at 11+SPAG@prasconsulting.co.uk.

• Account data (first name, last name, email, hashed password, chosen year group) — to create your account and personalise practice.
• Practice data (test attempts, answers chosen, scores) — to show your history and analytics.
• Support messages — to help you when you contact us.
• Technical data (device type, browser, IP address, basic usage logs) — for security, fraud prevention and service reliability.

We rely on: contract (to provide the service you signed up for), legitimate interests (to secure, improve and support the service), consent (for optional cookies and marketing, where applicable) and legal obligation (to keep required records).

• Hosting and infrastructure (our cloud hosting provider), used to run the service.
• Merchant of Record — Paddle (Paddle.com Market Ltd), for payments, subscription management, invoicing and tax compliance. Paddle acts as an independent controller for the sale itself.
• AI provider — anonymised prompts are sent to our AI provider to generate questions. We do not send account identifiers with prompts.
• Authorities where required by law.

Some of the providers above are based outside the UK/EEA. Where personal data is transferred internationally we rely on appropriate safeguards such as UK IDTA / EU Standard Contractual Clauses, or an adequacy decision.

We keep account and practice data for as long as your account is active. If you delete your account, we delete or anonymise personal data within 30 days, except where we must keep records for legal, tax or fraud-prevention reasons.

Where UK/EU GDPR applies you have the right to: access, rectification, erasure, restriction, portability, objection, to withdraw consent, and to complain to a supervisory authority (in the UK, the ICO). We aim to respond within one month.

To exercise any of these rights, contact us at 11+SPAG@prasconsulting.co.uk.

We apply appropriate technical and organisational measures including encryption in transit, access controls and role-based permissions on our database.

We use essential cookies (session, authentication) needed for the service to work. If we introduce analytics or marketing cookies we will ask for your consent.