Privacy

Who is responsible

SummitPapers, run by the SummitPapers Team, is the controller of the personal data described here. Write to hello@summitpapers.com about anything in this notice, including a request to see or delete your data.

Reading without an account

You can read every question and its correct letter without signing in. The site then stores nothing about you on its servers. Your answers, your topic progress and your bookmarks are kept in your own browser, so that the practice pages can show them back to you. Clearing this site's data in your browser removes them.

An account

You sign in with Google. The account receives the name, email address and profile picture that Google provides. A session record keeps you signed in; it holds the time it was created, the IP address and the browser type, so that a stolen session can be spotted. The IP address at sign-up is also checked to prevent abuse.

When you are signed in, your TMUA answers and bookmarks are saved to the account as well, so they follow you to another device. What is saved is the question, the option you chose, whether it was right, whether you flagged it, and the time. Answers made in the same browser before you signed in are added to the account the first time you sign in there.

Legal basis: performing the service you asked for (the account and its practice history), and legitimate interests in keeping accounts secure.

A purchase

Card payments are taken by Stripe. SummitPapers never sees or stores the full card number. The account keeps a record of the order: the plan, the amount, the date, the payment reference and any refund, and the dates the 12 months started and ends. It also records when a paid question was first used after the purchase, because that decides whether the 7-day refund still applies, as the terms say.

Legal basis: performing the contract, and the legal obligation to keep accounting records.

Feedback

If you send feedback through the site, its text and your account are kept so the message can be answered. If the account is deleted, the feedback is kept without the link to you. Legal basis: legitimate interests in answering and improving the site.

Emails

Emails about your account or a purchase are sent through Resend. The site does not send marketing email.

Optional cookies

The site can measure where visitors come from and how pages are used. That measurement is optional. It runs only if you choose Accept in the cookie banner, and the banner appears only when such a tool is switched on. If you choose Decline, or do nothing, it stays off. You can change your mind by clearing the cookieConsent cookie, which brings the banner back. Legal basis: consent.

Cookies and similar storage

These are needed for the site to work, so they do not ask for consent:

• Sign-in session cookie (set by the sign-in system, named with better-auth): keeps you signed in until it expires or you sign out.
• Practice history in your browser (summitpapers.v1, summitpapers.bookmarks, summitpapers.owner): your answers and bookmarks, and which account they belong to after you sign in.
• Preferences: the language (NEXT_LOCALE), the light or dark theme, and an unsent feedback draft.
• Cookie choice (cookieConsent): remembers whether you accepted or declined optional cookies, for 12 months.
• Offline page: a service worker keeps a small offline notice and the site's own files.

Optional, only after you accept: user_tracking_data, which records the page or campaign that brought you to the site for 30 days, and any analytics or chat tool that the banner names.

Who else handles the data

These providers process data for SummitPapers under contracts that limit them to that work:

• Google, for signing in.
• Stripe, for card payments and refunds.
• Neon, which hosts the database, on servers in London.
• Resend, for account and purchase emails.
• Vercel, which hosts the website and keeps short-lived server logs.

Some of these providers are based in the United States. Where data leaves the UK or the EU, the transfer relies on an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. No data is sold, and none is used for advertising or for profiling.

How long it is kept

• The account and its practice history: until you delete the account, or ask for it to be deleted.
• Order and payment records: six years after the purchase, for accounting and tax law.
• The sign-in session: until it expires or you sign out.
• Practice history in your browser: until you clear this site's data.
• Server logs: a short period set by Vercel, for security and fault finding.

Your rights

You can ask to see the data held about you, to correct it, to delete it, to restrict or object to how it is used, and to receive a copy in a portable form. Where something relies on consent, you can withdraw it at any time. Write to hello@summitpapers.com from the email address on the account. A request is answered within one month. You can also delete the account yourself from the account settings page: that removes the account, its practice history and its bookmarks at once. Order and payment records are kept for the period above, no longer linked to the deleted account.

You can also complain to the Information Commissioner's Office at ico.org.uk. In the European Union you can complain to the data protection authority where you live.

Children

The TMUA is usually taken at 17 or 18. You need to be at least 13 to create an account. The site shows no advertising, does not profile its readers, and keeps optional tracking off unless you accept it.

Links to other sites

A past-paper link opens a file on UAT-UK's or Pearson's site, where their own notice applies. The terms say what a purchase includes, and the disclaimer says what the site is not.

Changes to this notice

If this notice changes, the date at the top changes with it.