PassiPRO Privacy Policy
Last updated: October 12, 2026
1. Who we are
PassiPRO ("we," "us," "our") is operated by PassiPRO Oy, business ID (Y-tunnus) 3508778-3, registered at Evästie 4 B 12, 01360 Vantaa, Finland. We are the data controller for the personal data described in this policy.
For anything related to your data or this policy, contact us at support@passipro.com. This inbox also serves as our privacy/data protection contact point.
This policy covers passipro.com (our marketing site), app.passipro.com (the logged-in application) and the PassiPRO mobile app for Android and iOS.
2. What data we collect
We collect only what we need to run the Service:
| Data | Why we collect it |
|---|---|
| Email address | Account login, communication about your account/purchases |
| Password (stored as a salted hash, never in plain text) | Authenticating you |
| Username | Identifying you within the app (e.g., on progress screens) |
| Quiz and exam scores, per-question answer history | Showing your progress, powering the practice-test features you use to study |
| Course purchase records (course, access tier, payment timestamp, access expiry date) | Granting and enforcing your access pass, order history, refund handling |
We do not collect any special-category data (health information, biometric data, racial or ethnic origin, religious beliefs, etc.). We do not use any advertising trackers.
Across both passipro.com and app.passipro.com, we use Umami, a privacy-focused analytics tool, to understand aggregate traffic (page views, referring site, browser/device type, country) and to count how often certain things happen — an account was created, a quiz was completed, a purchase went through — so we know how the product is actually used. Umami does not use cookies, and these events don't carry your identity, quiz score, or any other personal detail with them — just that the event happened; see Section 5.
When anyone finishes a quiz or practice exam, signed in or not, we also save an anonymous result: the course, the type of quiz, the score, whether it reached the pass mark, and the time. It is not linked to you, your account, your IP address or your device. We publish figures from these results on our website, such as recent free quiz scores and how scores are spread.
When you create an account, on the website or in the app, we use Cloudflare Turnstile to check that you're a person and not an automated program. The check runs in your browser (in the app, in a small embedded browser on the sign-up screen) and sends Cloudflare technical information about your browser or device and your connection, such as your IP address. We don't receive or store this information; we only receive Cloudflare's answer, which we check once when your account is created.
We do not collect your full payment card details — those go directly to Stripe, our payment processor (see Section 5).
The PassiPRO mobile app
The mobile app uses the same account as app.passipro.com: you can create an account in the app or on the web, and sign in to either with the same email address and password. When you create an account in the app, we also record that it was created there, when you accepted our Terms of Service and this policy, and whether you agreed to receive marketing emails. The app saves the same data as the web application, namely your quiz and exam results and answer history, plus the anonymous result described above.
On your phone, the app keeps your login session and your language choice in the device's secure storage (the Keychain on iOS, the Keystore on Android). Signing out or deleting your account removes the login session from the phone.
The app does not use Umami or any other analytics, shows no advertising, and does not access your location, contacts, camera, photos or advertising ID. Apple and Google may collect information such as download counts and crash reports under their own privacy policies.
3. How we use your data
We use your data to:
- Create and maintain your account, and let you log in.
- Process your purchases and grant/enforce time-limited access to course content.
- Track your quiz and exam progress so you can see how you're doing.
- Handle refund requests under our money-back guarantee.
- Respond to support requests you send us.
- Send you study tips and news about PassiPRO by email, only if you agreed to this when you signed up. Every such email has an unsubscribe link, and you can also withdraw by emailing support@passipro.com.
- Meet legal obligations (e.g., financial recordkeeping for payments — see Section 6).
We do not sell your personal data, and we do not use it for advertising or share it with third parties for their own marketing purposes.
4. Legal basis for processing (GDPR)
Since we're processing data of individuals in the EU, here's the legal basis for each use:
- Account data (email, password, username): necessary to perform our contract with you (providing the Service you signed up for).
- Quiz/exam scores and answer history: necessary to perform our contract (the core study features you're using the Service for).
- Purchase records: necessary to perform our contract, and necessary to comply with our legal obligations (tax/financial recordkeeping).
- Support communications: our legitimate interest in responding to you, and/or performance of our contract.
- Marketing emails: your consent, which you can withdraw at any time.
- Bot check when you create an account (Cloudflare Turnstile): our legitimate interest in protecting the Service, and the people whose email addresses could be misused, from automated sign-ups.
5. Who we share data with (sub-processors)
We use a small number of infrastructure providers to run PassiPRO. We don't sell your data to anyone — these are service providers processing data on our behalf:
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database and authentication | EU (AWS eu-west-1, Ireland) |
| Stripe | Payment processing | EU (contracting entity: Stripe Payments Europe, Limited, Ireland) — Stripe's global card-network and fraud-prevention infrastructure may still process data outside the EU under Stripe's own Standard Contractual Clauses |
| Vercel | Application hosting | EU (serverless function region pinned to Sweden) |
| Zoho Mail | Business email (e.g., support@passipro.com) | EU (Zoho's EU data center) |
| Umami | Analytics across passipro.com and app.passipro.com — aggregate traffic plus counts of key events (signup, quiz completed, purchase completed). Cookie-free; events carry no personally identifying data, score, or purchase amount | EU |
| Cloudflare (Turnstile) | Bot check when you create an account, on the website and in the app | Global network (Cloudflare, Inc., USA), under the EU Standard Contractual Clauses |
Where any provider processes data outside the EU/EEA, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) as required by GDPR.
We do not use any advertising or cross-site tracking services.
6. How long we keep your data
- Paying users: we delete your personal data 6 months after your most recent paid access pass expires — that is, measured from the end of your last purchased access window, not from the date you paid for it. If you purchase again before deletion, the clock resets to your newest access expiry.
- Free/browsing-only accounts (no purchase ever made): we delete your personal data 12 months after your last access to the Service (e.g. your last login).
- Deletion mechanism: deletion is automated on a scheduled basis according to the periods above.
- Financial/payment records: Finnish accounting law requires transaction records — payment amount, date, and reference — to be kept for 6 years from the end of the accounting period they relate to, separately from the deletion schedule above. This obligation is met through our payment processor Stripe's own transaction records and our business's accounting records, not by PassiPRO's application retaining your account data past the periods described above. This is a separate legal requirement, not a choice we're making about your data.
You can ask us to delete your account and data earlier at any time — see Section 8.
7. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten"), subject to the financial recordkeeping exception in Section 6.
- Restrict or object to certain processing.
- Port your data — receive it in a structured, commonly used format to transfer elsewhere.
- Withdraw consent at any time, for any processing based on consent (this doesn't affect processing done before withdrawal, or processing based on other legal grounds like contract performance).
To exercise any of these rights, email support@passipro.com. We'll respond within the timeframes required by GDPR (generally one month).
You also have the right to lodge a complaint with your national data protection authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto).
8. Deleting your account
You can delete your account yourself at any time: in the mobile app under Settings → Delete account, or in the web application at app.passipro.com under Settings. You'll be asked for your password, and your account, purchase records, quiz and exam results and answer history are then deleted straight away.
You can also ask us to delete your account by emailing support@passipro.com.
In both cases, limited financial records may be kept where Finnish accounting law requires it (see Section 6). If we have ever changed your course access by hand, for example to extend it as a goodwill gesture, our internal log of that change keeps your email address after your account is deleted, so we can account for every change we made.
9. Cookies
We use essential cookies required to keep you logged in and to operate checkout securely. We also use Umami analytics (see Section 2), which does not use cookies, and Cloudflare Turnstile on the sign-up form (see Section 2), which is used only to tell people from automated programs, not to track you. We do not use advertising cookies. If that changes, we'll update this policy and, where required, ask for your consent first. The mobile app does not use cookies.
10. Children's privacy
The Service is intended for users aged 18 and older. We do not knowingly collect data from anyone below this age. If you believe a minor has created an account, contact us at support@passipro.com and we'll investigate and delete the account if appropriate.
11. Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect changes in our practices or the law. We'll update the "Last updated" date above, and for material changes we'll take reasonable steps to notify you (such as an email or in-app notice).
12. Contact us
For any privacy question, or to exercise your rights under Section 7, contact us at support@passipro.com.