Privacy Policy
Last updated: 28 July 2026
This Privacy Policy explains what personal data Theory Academy collects, why we collect it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR). We are committed to protecting your personal data and processing it lawfully, fairly and transparently.
1. Who is responsible for your data (controller)
The data controller for personal data processed through the Platform is Theory Academy, operated from Ireland. For any privacy question, or to exercise your rights, contact us at privacy@theory-academy.com. We handle enquiries by email and do not currently operate a public postal address. If we appoint a data protection officer or EU representative, their details will be published here.
2. Scope
This policy applies to personal data we process when you visit our websites, apply for the Closed Beta, create an account, or use the Platform. It does not apply to third-party services that have their own privacy policies.
3. What personal data we collect
We collect: (a) account data — your name, email address, chosen country and learning language, and account settings; (b) beta-waitlist data — the name and email you submit to register interest, and the source of the registration; (c) learning data — your lesson and question activity, answers, scores, mock-exam results, progress and readiness metrics; (d) communications and consents — your marketing preferences, cookie choices, support messages, and records of the consents you give; (e) payment data (when paid plans are active) — billing information handled by our payment provider; we receive limited transaction and subscription details but not your full card number; and (f) technical data — IP address, device and browser information, approximate location derived from IP, and analytics events, collected via cookies and similar technologies where you consent.
4. How we collect it
We collect data directly from you (when you register, create an account, or contact us), automatically as you use the Platform (through cookies and similar technologies, subject to your consent), and from our service providers (for example, our payment provider confirms a payment status).
5. Why we process your data and our legal bases
We process personal data on the following legal bases under Article 6 GDPR: (a) to create and operate your account and provide the Platform — performance of a contract; (b) to manage the beta waiting list and send you an invitation — your consent and/or our legitimate interest in running the beta; (c) to send marketing or product emails — your consent, which you can withdraw at any time; (d) to measure and improve the Platform through analytics — your consent for non-essential cookies, and our legitimate interest in aggregated insights; (e) to keep the Platform secure and diagnose errors — our legitimate interest in security and reliability; (f) to take payments and keep accounting records (when paid plans are active) — performance of a contract and compliance with legal obligations; and (g) to comply with the law and defend legal claims — compliance with a legal obligation and our legitimate interests. Where we rely on legitimate interests, we balance them against your rights.
6. Cookies and similar technologies
We use cookies and similar technologies that are strictly necessary to run the Platform and, only with your consent, Google Analytics to understand how visitors use it. Google Analytics may collect device and browser information, approximate location derived from IP, pages viewed, and interactions such as sign-up and checkout events. Advertising storage and personalisation are disabled. You can accept or reject analytics via our cookie banner and change your choice at any time using the analytics preference below. Rejecting analytics does not affect access to core functionality.
7. Marketing communications
We send marketing emails only where you have opted in. Every marketing email includes an unsubscribe link, and you can withdraw consent at any time by using it or contacting us. We may still send you essential service messages (for example, about your account, security, or beta invitation) on the basis of our contract or legitimate interest.
8. Who we share your data with (processors)
We do not sell your personal data. We share it with trusted service providers who process it on our behalf under data-processing agreements and only on our instructions: Supabase (database, authentication and hosting, EU region); Stripe (payment processing, when paid plans are active); Resend (transactional and marketing email delivery); Google Analytics (consent-based website and product analytics); Sentry (error monitoring, EU region); and Vercel (application hosting, EU region). We may also disclose data where required by law, to enforce our Terms, or in connection with a business transfer, subject to appropriate safeguards.
9. International transfers
We aim to keep your personal data within the European Economic Area (EEA). Where a provider processes data outside the EEA, we ensure appropriate safeguards are in place, such as an adequacy decision or the European Commission's Standard Contractual Clauses, and additional measures where necessary. You can contact us for more information about these safeguards.
10. How long we keep your data
We keep personal data only as long as necessary for the purposes described: account and learning data for as long as your account is active and for a reasonable period afterwards; beta-waitlist data until you are invited, you withdraw, or it is no longer needed; analytics data for a limited retention period; and financial and tax records for the period required by law (generally up to six years). When data is no longer needed, we delete or anonymise it.
11. How we protect your data
We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls and row-level security in our database, and restricting access to those who need it. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of a personal-data breach where the law requires.
12. Your rights
Subject to the conditions in the GDPR, you have the right to: access your personal data; have inaccurate data corrected; have your data erased; restrict or object to processing; data portability; and, where processing is based on consent, to withdraw consent at any time without affecting prior processing. To exercise any right, contact privacy@theory-academy.com. We will respond within one month (extendable where permitted) and will not charge a fee unless your request is manifestly unfounded or excessive. You can also export your learning data from within the Platform.
13. Automated decision-making and personalisation
The Platform personalises your study experience — for example, by recommending topics or questions based on your performance. This personalisation does not produce legal or similarly significant effects on you within the meaning of Article 22 GDPR. We do not use your data for automated decisions that have such effects, and we do not carry out profiling for advertising.
14. Children
The Platform is intended for users aged 16 and over and is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact privacy@theory-academy.com and we will delete it.
15. Your right to complain
If you have concerns about how we handle your personal data, please contact us first at privacy@theory-academy.com. You also have the right to lodge a complaint with a supervisory authority — in Ireland, the Data Protection Commission (www.dataprotection.ie) — or with the authority in your country of residence or work.
16. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by a notice on the Platform or by email before they take effect. The "last updated" date shows when this policy was last revised.
17. Contact
For any privacy matter, including exercising your rights, contact us at privacy@theory-academy.com. Controller: Theory Academy, operated from Ireland.
Analytics preference
Current choice: not chosen yet