1. What we collect
- Account
- Your email address and a hashed form of your password (we never store the password itself). The date you created the account and when you last signed in and were last active. Your device’s time zone (such as Australia/Sydney), so the dates in our emails match the ones you see in the course.
- Learning progress
- Your answers, confidence ratings, lesson completions, practice exam results, settings and study sessions. These are stored in your browser and synced to our server so that your progress follows you between devices and survives a cleared browser.
- Purchases
- Records from Stripe, whose payment service Link is our merchant of record: which plan you bought, when, the amount (in US dollars, the price’s currency, even if you paid in your own), the email address and country you gave at checkout, Stripe’s fee, and a transaction reference. Stripe also asks for your name and billing address to work out tax; we don’t keep them. We never receive or store your card or bank details; Stripe handles payment.
- Attribution
- If you arrived from an advert or link with tracking parameters (such as utm_ values or a Google Ads click id), we keep those with your purchase so we know which campaigns work. They stay in your browser’s session storage until you open the checkout, which sends them to us; they are not sent to Stripe. If you bought after clicking a Google Ads advert, we may tell Google Ads that the click led to a purchase (the click id, the time and the amount) to measure our adverts. If your browser sends the Global Privacy Control signal, we don’t keep the click id, so this never happens.
- Support messages
- What you send through the support form or by email to our addresses: the message, any attachments, your email address and the name your email program shows, and for bug reports the page address and browser details the form attaches. We keep them as a conversation with our replies, linked to your account if you have one, and may add private notes to it; notes are included when you download your data. A copy of each new message is forwarded to the business owner’s Gmail mailbox (see Who processes it).
- Help bot conversations
-
The messages you type into the help bot, with its earlier replies in the same conversation, which are sent to Anthropic’s API to generate the reply. Do not put personal information in them.
In the course, while you are signed in, each question also sends an anonymous summary of your progress in the course you are studying, so that the bot can answer questions about it, such as what to study next or whether you are on track for your exam date. The summary has, for each exam domain and objective, its status, mastery estimate and lessons completed, and your readiness estimate, reviews due, recommended next step, streak, XP and rank, practice exam scores, Exam Day Plan and how well your confidence matches your accuracy. Times appear only as days ago or days left.
It does not include your name, email address, account number, IP address, time zone, purchases or payment details, or anything you have written, such as support messages. The bot is instructed to use your progress only when you ask about it. On the website and in the free trial, and when you are signed out, no progress is sent.
- Feedback
- If you choose to tell us whether you passed, your score, or a lesson rating, we store what you tell us. Publishing a testimonial only happens with your explicit consent.
2. Cookies and analytics
Essential cookies only. When you sign in, we set a sign-in cookie so that the server knows it is you. It is marked HttpOnly and Secure, is limited to our own site, and expires after 30 days without use. Signing in also sets a security cookie that marks your browser as one that has signed in to your account before, so that a flood of wrong passwords from elsewhere can't lock you out; it holds your account number and a random value signed by our server, and expires after 400 days. During checkout, a short-lived cookie (two hours) links your browser to the purchase so the welcome page can confirm it. That is all. We do not use advertising cookies, third-party trackers, pixels or fingerprinting.
Cookieless analytics. To count visitors and see which pages and features are used, the site sends small events to our own server (for example “pageview” or “checkout opened”). Unique visitors are counted with a hash of your IP address and browser identifier that rotates every day and cannot be reversed; the IP address itself is not stored. No profile is built and nothing is shared with advertising networks. If your browser sends the Global Privacy Control signal, these events are not sent at all.
3. Why we use it
- To provide the course you bought: your account, your progress and its sync, your access period. (Performance of a contract.)
- To take payment and keep records of it, including tax records we are legally required to keep. (Contract and legal obligation.)
- To answer you when you contact support or the help bot. (Contract and legitimate interest.)
- To run and improve the service: aggregate usage, which lessons confuse people, which questions have unusual error rates, whether campaigns work. (Legitimate interest.)
- To email you about your account: purchase confirmations, set-up and password-reset links, access ending. These are service emails, not marketing. We only send marketing email if you have opted in, and every such email has an unsubscribe link.
We do not sell personal information. The only thing we share for advertising is the Google Ads purchase report described under Attribution, which Global Privacy Control turns off.
4. Who processes it
A few companies process data on our behalf. Each is bound by a contract that limits what it can do with the data.
| Processor | What for | Where |
|---|---|---|
| Stripe (Stripe Payments Australia Pty Ltd, and its affiliate Sold through Link, LLC, “Link”) | Payments, tax, receipts, refunds, disputes and payment support, with Link as merchant of record. We send Stripe the plan you chose and, if you are signed in, your email address. Stripe’s privacy policy, which covers Link, applies to what it collects at checkout, and Link’s terms apply if you use a Link account. | Australia, the United States and other countries, including India |
| Resend | Sending our emails (confirmations, set-up links, password resets, notices, replies to support messages) and receiving the emails sent to our addresses, including support messages and their attachments. | United States |
| Anthropic | Generating help-bot replies from the messages you type and, in the course, the anonymous progress summary sent with them. | United States |
| DigitalOcean | Hosting the service and its database. | Sydney, Australia |
| Backblaze | Off-site backups of the database, sent to Backblaze over an encrypted connection and stored encrypted by Backblaze. | United States |
| Google Ads | Measuring our adverts: purchases that followed an advert click (the click id, time and amount), never with Global Privacy Control. | United States |
Because some of these are outside Australia and outside the European Economic Area and United Kingdom, your data may be transferred there. We rely on each provider’s contractual safeguards (including standard contractual clauses where they apply) for those transfers.
A copy of each new support message is also forwarded to the business owner’s personal Gmail mailbox, so that it is seen promptly. Google is not one of the processors above: Google’s own terms and privacy policy apply to the copies there, and Google may store them in the United States and other countries.
5. How long we keep it
- Account and progress: while your account exists. When your access ends, we keep them so you can renew and continue; you can delete the account at any time.
- Deleted accounts: the account, sessions, synced progress and support conversations are removed when you delete it. Purchase records are kept for as long as tax law requires (in Australia, generally five years), with your email removed from them.
- Backups: backups are kept for up to 30 days, so deleted data can persist in a backup for up to 30 days before it is gone.
- Support messages and bug reports: two years after a conversation’s last message, so that we can refer back to earlier conversations; messages filed as spam, 30 days. Copies in the owner’s Gmail mailbox are deleted when you ask us to delete your data. Resend’s retention of the emails it handles is governed by its terms.
- Help-bot conversations: we keep the questions, without your account or IP address, for 30 days to see what people ask; the answers and the progress summaries are not stored or logged. Anthropic’s retention is governed by its API terms.
- Analytics events: indefinitely in aggregate; the daily hash means events cannot be linked to you after the day they were recorded.
- Server logs: our servers keep technical logs of requests (IP address, browser user agent, the page requested and the response) for security and troubleshooting. They use a fixed amount of storage and are overwritten automatically as new entries arrive; sign-in cookies and the tokens in emailed links are removed from them, and they are never used for analytics or advertising.
6. Your rights
Wherever you live, you can:
- See and export everything we hold for you: your account page has a one-click download of your synced data and support conversations as JSON, and you can ask us for the rest.
- Correct your email address or password in the course’s settings.
- Delete your account and progress yourself, in the course under Settings → Account, or by asking us.
- Object to our use of your data for our legitimate interests, and opt out of any marketing email.
- Complain to a regulator.
Stripe and Link keep their own records of your payment as merchant of record. Deleting your Rabbit Courses account does not delete them; to see or delete them, ask Link through support.link.com.
If you are in Australia, we handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988, and you can complain to the Office of the Australian Information Commissioner. If you are in the European Economic Area or the United Kingdom, you have the rights set out in the GDPR and UK GDPR: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal effect (we make none). Your data-protection authority is the place to complain if we do not resolve your concern. To exercise any right, email support@rabbitcourses.com from the address on your account; we answer within 30 days.
7. Security
Connections are encrypted (HTTPS only), passwords are hashed with a memory-hard algorithm, sign-in is rate-limited, the server sends a strict content security policy, backups travel to Backblaze over an encrypted connection and are stored encrypted by Backblaze, and the production system is updated automatically. No system is perfect; if we discover a breach that affects your data, we will tell you and the relevant regulator as the law requires.
8. Children
The course is for adults and older students preparing for a professional exam. You must be at least 16 to hold an account, or have a parent or guardian’s consent. We do not knowingly collect data from younger children; if you believe we have, tell us and we will delete it.
9. Changes
If we change this policy in a way that matters, we will tell you by email or in the course before the change takes effect. The date at the top shows the last revision.
10. Contact
Rabbit Courses, a registered business name of Samuel John Eleveld, a sole trader in Australia (ABN 31 812 509 512): support@rabbitcourses.com.