Privacy Policy

1. Who we are

Wombat Preparation (“we”, “us”) runs wombatpreparation.com and the Wombat Trainer desktop app, and is the data controller for the personal data described here. Our address is Rusaliyski prohod 1, 1407 Sofia, Bulgaria. For any privacy request, email support@wombatpreparation.com.

2. Data we collect

• Account: your email address and sign-in credentials. Our authentication provider, Clerk, collects and secures them on our behalf; we never see or store your password.
• Purchases: Stripe collects and processes your billing details. We store the amount, the currency and the Stripe reference, not your card number.
• Licensing: a hashed device token, the device name, platform and app version for each computer you activate, so we can enforce one active device at a time.
• Usage: the timestamps of your play sessions and the results you sync from the app (date, duration, score, game variant and the session’s detailed payload), so your dashboard can show your progress.
• Support: anything you send us by email.

3. How we use it

To create and secure your account, verify your email, process payments and refunds, issue and revoke device licences, show your session history and progress, answer support requests, and detect abuse of the licensing system. We do not sell your data, and we do not use it for third-party advertising.

4. Legal bases (GDPR)

We process your account and licence data because we need it to perform our contract with you. Fraud prevention and service security rest on our legitimate interest. Where the law requires consent, for example for marketing email (which we do not currently send), we will ask first.

5. Who we share it with

Clerk (accounts and sign-in), Stripe (payments), Resend (transactional email about your account and licence) and Scaleway (database and file hosting for the app downloads, in the EU). Each of them processes data only as needed to provide its service to us, under its own data-processing terms.

6. International transfers

Our hosting is in the EU. Where a processor above transfers data outside the EU/EEA, it relies on appropriate safeguards such as the EU Standard Contractual Clauses.

7. How long we keep it

We keep account and purchase data while your account is active, and afterwards for as long as tax, accounting and other legal obligations require. You can ask us to delete your account at any time; some purchase records must still be kept by law.

8. Your rights

Under the GDPR you can ask to access, correct, delete or export your data, restrict or object to some processing, and withdraw consent where we rely on it. Email support@wombatpreparation.com. If you are not satisfied with our response, you can complain to your local data protection authority; in Bulgaria that is the Commission for Personal Data Protection (cpdp.bg).

9. Cookies

We use essential cookies set by Clerk to keep you signed in to your dashboard. They are not used for advertising or third-party tracking, and they are not set until you sign in.

10. Security

Clerk handles authentication, including password storage, sessions and email verification. Device tokens are stored only as SHA-256 hashes, never in plain text. The site is served over HTTPS.

11. Children

The service is for candidates preparing for professional selection tests and is not directed at children under 16.

12. Changes

We will update this page if what we collect or how we use it changes; check the “last updated” date above.