Privacy Policy

1. Who we are

This Privacy Policy explains how Gormley Capital Holdings, Inc., doing business as FinTestPrep(“FinTestPrep,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information when you use the FinTestPrep website, web application, and related services.

2. Information we collect

Depending on how you use FinTestPrep, we may collect the following categories:

• Account information: email address, display name, authentication identifiers, account status, and password-related authentication data handled by our authentication provider.
• Learning information: subject selection, exam course, exam date and selected exam topics, readiness estimates, lessons viewed, question attempts, submitted answers, correctness, mastery estimates, review schedules, XP, levels, streaks, session history, and related learning progress.
• Subscription and transaction information: plan type, subscription status, payment-provider customer and subscription identifiers, purchase history, and related billing metadata. Complete card numbers are generally processed by our payment provider rather than stored by FinTestPrep.
• Device and technical information: browser and device characteristics, timestamps, service logs, diagnostic information, security events, and network information such as IP addresses that may appear in normal hosting, authentication, or security logs.
• Timezone and settings: browser-reported timezone, active subject, and similar account settings.
• Communications: messages you send to support, feedback, and other correspondence with us.

3. How we collect information

We collect information:

• directly from you when you create or manage an account, submit answers, make a purchase, change settings, or contact us;
• automatically when you use the Service, including through authentication cookies, local storage, server logs, and similar technologies needed to operate the product; and
• from service providers involved in authentication, hosting, payments, email delivery, and related infrastructure.

4. Why we use information

We may use personal information to:

• create, authenticate, secure, and maintain your account;
• deliver lessons, practice sessions, reviews, challenge questions, and other learning functionality;
• grade responses and calculate progress, mastery, XP, streaks, and review schedules;
• sync learning history across devices;
• provide paid subscriptions and manage billing status;
• send account verification, password reset, security, billing, legal, and other necessary service communications;
• detect, investigate, and prevent fraud, abuse, unauthorized access, and security incidents;
• debug, maintain, improve, and measure the reliability of the Service;
• respond to support requests and feedback;
• comply with law and enforce our Terms; and
• protect the rights, safety, and property of FinTestPrep, our users, and others.

5. Legal bases for processing in the EEA and UK

If European Economic Area, United Kingdom, or similar data-protection law applies, our legal bases may include:

• Contract: processing needed to create and operate your account and provide the Service you request.
• Legitimate interests: securing, maintaining, debugging, improving, and preventing abuse of the Service, where those interests are not overridden by your rights.
• Consent: where we specifically ask for consent, such as for nonessential technologies if we introduce them.
• Legal obligation: processing necessary to comply with applicable law, legal process, accounting, tax, or regulatory requirements.

6. How we disclose information

We may disclose personal information to:

• Service providers: companies that help us provide hosting, databases, authentication, email delivery, payment processing, security, and similar infrastructure.
• Payment providers: to process subscriptions, payments, refunds, and billing-management requests.
• Professional advisers: lawyers, accountants, insurers, auditors, or similar advisers when reasonably necessary.
• Authorities and legal recipients: when required by law, legal process, or when reasonably necessary to protect rights, safety, security, or prevent fraud.
• Business transaction participants: in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to applicable law.
• Others at your direction: when you ask us or give us permission to do so.

7. Service-provider categories

We use service providers and processors to help operate FinTestPrep. Depending on the function, these providers may support cloud hosting, databases, authentication, email delivery for account communications, payment processing, security, and infrastructure.

We may change providers as the Service evolves. We limit provider access to information reasonably necessary for the service they perform and use contractual or other safeguards where required by applicable law.

8. No sale of learner data or third-party targeted advertising

As of the effective date of this Policy, FinTestPrep does not sell personal information as “sale” is defined under applicable privacy law and does not share personal information for cross-context behavioral advertising or targeted advertising.

We also do not use a learner’s answers, mastery history, or study progress to serve third-party behavioral advertisements.

If these practices materially change, we will update this Policy and provide any notice or choice required by applicable law.

9. Cookies, local storage, and tracking signals

FinTestPrep uses technologies necessary to operate the Service, including authentication cookies and local storage used for session continuity, account functionality, subject selection, and first-run learning flows.

We do not currently use third-party advertising pixels or cross-site behavioral advertising technology in the Service.

Browser “Do Not Track” signals are not governed by a single universal technical standard. Because we do not currently sell personal information or use cross-site targeted-advertising technology, there is no advertising sale/share opt-out for such a signal to change. Where an applicable law requires recognition of a supported opt-out-preference signal for a covered activity, we will honor that requirement.

10. Account communications

We send necessary account communications such as verification, authentication, password-reset, security, billing, and important service notices.

11. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining account and learning history, complying with legal obligations, resolving disputes, enforcing agreements, and protecting the Service.

Our current retention framework is category-based. Active account and learning data is generally retained while the account exists and is removed from active application systems when the account is deleted, subject to limited backup, security, fraud, legal, and dispute-related retention. Support correspondence is generally retained for up to 24 months after resolution unless a longer period is needed for an active dispute or legal obligation. Routine application and security logs are generally retained for up to 12 months unless an incident, investigation, or legal obligation requires longer.

Transaction, tax, and billing records may be retained for up to 7 years or any longer period required by applicable law. Minimal records proving acceptance of Terms, subscription disclosures, and other contractual assent may also be retained for up to 7 years after account closure so we can establish what was agreed to without retaining the full learning account.

Backup copies may remain for a limited provider-controlled backup cycle after information is removed from active systems. Backups are not ordinarily restored except for disaster recovery, security, or legal purposes.

12. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, authenticated account access, encrypted network transport, restricted backend credentials, and security controls provided by our infrastructure providers.

No Internet service can guarantee absolute security. You are responsible for protecting your password and notifying us if you suspect unauthorized account access.

13. Children’s privacy

FinTestPrep is not intended for children under 13, and users must confirm they are at least 13 to create an account.

If we learn that we collected personal information from a child under 13 in circumstances where parental consent was required, we will take appropriate steps, including deleting the information where required by law.

A parent or guardian who believes a child under 13 provided personal information may contact us at fintestprep@fintestprep.com.

14. Your privacy choices and rights

Depending on where you live and which privacy laws apply to FinTestPrep, you may have the right to request access to personal information, correction, deletion, portability, restriction or objection to certain processing, or information about disclosures.

You may also have a right to appeal certain privacy-request decisions or to be free from unlawful discrimination for exercising privacy rights.

You can delete your FinTestPrep account through the account controls in Profile. You may also submit a privacy request by emailing fintestprep@fintestprep.com. We may need to verify your identity before completing a request. We will respond within the period required by applicable law.

15. California privacy disclosures

California law requires certain online services to disclose categories of personal information collected and categories of third parties with whom information is shared. Those disclosures are provided in Sections 2 and 6 of this Policy.

If FinTestPrep becomes subject to additional California Consumer Privacy Act requirements, eligible California residents may have rights to know, access, delete, correct, limit certain uses of sensitive personal information, and opt out of covered sales or sharing. We will provide any additional notices and request methods required if those obligations apply.

16. International users and transfers

FinTestPrep is operated by a United States company. If you access the Service from outside the United States, your information may be processed in the United States or other countries where we or our providers operate.

Where applicable law requires a mechanism for international transfers, we and our providers will use an appropriate legal mechanism or other permitted basis.

17. Data breach and legal notifications

If a security incident involving personal information occurs, we will investigate and provide notices to affected individuals, regulators, or others when required by applicable data-breach notification law.

18. Third-party links

The Service may contain links to third-party websites or services. Their privacy practices are governed by their own policies, not this Policy, unless they are acting as our service provider for a particular function.

19. Changes to this Policy

We may update this Privacy Policy as our practices, technology, or legal obligations change. The current Policy will display its effective date and version.

If a change materially affects how we use personal information, we may provide additional notice or obtain consent where required. Updating a privacy notice does not, by itself, create consent for processing that legally requires separate consent.

20. Contact us

Gormley Capital Holdings, Inc., d/b/a FinTestPrep
Privacy and legal: fintestprep@fintestprep.com
Product support: support@fintestprep.com