PassiPRO Privacy Policy
Last updated: July 31, 2026
1. Who we are
PassiPRO ("we," "us," "our") is operated by PassiPRO Oy, business ID (Y-tunnus) 3508778-3, registered at Evästie 4 B 12, 01360 Vantaa, Finland. We are the data controller for the personal data described in this policy.
For anything related to your data or this policy, contact us at support@passipro.com. This inbox also serves as our privacy/data protection contact point.
This policy covers passipro.com (our marketing site) and app.passipro.com (the logged-in application).
2. What data we collect
We collect only what we need to run the Service:
| Data | Why we collect it |
|---|---|
| Email address | Account login, communication about your account/purchases |
| Password (stored as a salted hash, never in plain text) | Authenticating you |
| Username | Identifying you within the app (e.g., on progress screens) |
| Quiz and exam scores, per-question answer history | Showing your progress, powering the practice-test features you use to study |
| Course purchase records (course, access tier, payment timestamp, access expiry date) | Granting and enforcing your access pass, order history, refund handling |
We do not collect any special-category data (health information, biometric data, racial or ethnic origin, religious beliefs, etc.). We do not use any advertising trackers.
Across both passipro.com and app.passipro.com, we use Umami, a privacy-focused analytics tool, to understand aggregate traffic (page views, referring site, browser/device type, country) and to count how often certain things happen — an account was created, a quiz was completed, a purchase went through — so we know how the product is actually used. Umami does not use cookies, and these events don't carry your identity, quiz score, or any other personal detail with them — just that the event happened; see Section 5.
We do not collect your full payment card details — those go directly to Stripe, our payment processor (see Section 5).
3. How we use your data
We use your data to:
- Create and maintain your account, and let you log in.
- Process your purchases and grant/enforce time-limited access to course content.
- Track your quiz and exam progress so you can see how you're doing.
- Handle refund requests under our money-back guarantee.
- Respond to support requests you send us.
- Meet legal obligations (e.g., financial recordkeeping for payments — see Section 6).
We do not sell your personal data, and we do not use it for advertising or share it with third parties for their own marketing purposes.
4. Legal basis for processing (GDPR)
Since we're processing data of individuals in the EU, here's the legal basis for each use:
- Account data (email, password, username): necessary to perform our contract with you (providing the Service you signed up for).
- Quiz/exam scores and answer history: necessary to perform our contract (the core study features you're using the Service for).
- Purchase records: necessary to perform our contract, and necessary to comply with our legal obligations (tax/financial recordkeeping).
- Support communications: our legitimate interest in responding to you, and/or performance of our contract.
5. Who we share data with (sub-processors)
We use a small number of infrastructure providers to run PassiPRO. We don't sell your data to anyone — these are service providers processing data on our behalf:
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database and authentication | EU (AWS eu-west-1, Ireland) |
| Stripe | Payment processing | EU (contracting entity: Stripe Payments Europe, Limited, Ireland) — Stripe's global card-network and fraud-prevention infrastructure may still process data outside the EU under Stripe's own Standard Contractual Clauses |
| Vercel | Application hosting | EU (serverless function region pinned to Sweden) |
| Zoho Mail | Business email (e.g., support@passipro.com) | EU (Zoho's EU data center) |
| Umami | Analytics across passipro.com and app.passipro.com — aggregate traffic plus counts of key events (signup, quiz completed, purchase completed). Cookie-free; events carry no personally identifying data, score, or purchase amount | EU |
Where any provider processes data outside the EU/EEA, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) as required by GDPR.
We do not use any advertising or cross-site tracking services.
6. How long we keep your data
- Paying users: we delete your personal data 6 months after your most recent paid access pass expires — that is, measured from the end of your last purchased access window, not from the date you paid for it. If you purchase again before deletion, the clock resets to your newest access expiry.
- Free/browsing-only accounts (no purchase ever made): we delete your personal data 12 months after your last access to the Service (e.g. your last login).
- Deletion mechanism: deletion is automated on a scheduled basis according to the periods above.
- Financial/payment records: Finnish accounting law requires transaction records — payment amount, date, and reference — to be kept for 6 years from the end of the accounting period they relate to, separately from the deletion schedule above. This obligation is met through our payment processor Stripe's own transaction records and our business's accounting records, not by PassiPRO's application retaining your account data past the periods described above. This is a separate legal requirement, not a choice we're making about your data.
You can ask us to delete your account and data earlier at any time — see Section 8.
7. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten"), subject to the financial recordkeeping exception in Section 6.
- Restrict or object to certain processing.
- Port your data — receive it in a structured, commonly used format to transfer elsewhere.
- Withdraw consent at any time, for any processing based on consent (this doesn't affect processing done before withdrawal, or processing based on other legal grounds like contract performance).
To exercise any of these rights, email support@passipro.com. We'll respond within the timeframes required by GDPR (generally one month).
You also have the right to lodge a complaint with your national data protection authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto).
8. Deleting your account
To request deletion of your account and personal data, email support@passipro.com. We'll delete your data except where we're required to retain limited financial records under Finnish accounting law (see Section 6).
9. Cookies
We use essential cookies required to keep you logged in and to operate checkout securely. We also use Umami analytics (see Section 2), which does not use cookies. We do not use advertising cookies. If that changes, we'll update this policy and, where required, ask for your consent first.
10. Children's privacy
The Service is intended for users aged 18 and older. We do not knowingly collect data from anyone below this age. If you believe a minor has created an account, contact us at support@passipro.com and we'll investigate and delete the account if appropriate.
11. Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect changes in our practices or the law. We'll update the "Last updated" date above, and for material changes we'll take reasonable steps to notify you (such as an email or in-app notice).
12. Contact us
For any privacy question, or to exercise your rights under Section 7, contact us at support@passipro.com.