Privacy Policy

FásCliste ("we", "us", or "our") is the data controller for personal data collected through the FásCliste platform. We are based in Ireland and operate under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have as a data subject. Please read it carefully.

1. What Data We Collect

We collect the following categories of personal data:

2. How We Use Your Data

We use your personal data to:

• Create and manage your account
• Deliver the study platform features (notes, feedback, practice papers)
• Process payments and manage subscriptions
• Send transactional emails (e.g., email verification, billing receipts)
• Track your study progress and generate personalised study plans
• Provide AI-generated feedback on your practice answers
• Improve the platform through anonymised usage analytics (where you have consented)
• Comply with legal obligations, including GDPR audit logging

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Contract (Art. 6(1)(b)): Processing necessary to provide the Service under our agreement with you — account management, study features, payment processing.
• Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, and product improvement (where these do not override your rights).
• Consent (Art. 6(1)(a)): Optional analytics and non-essential communications — only where you have opted in.
• Legal obligation (Art. 6(1)(c)): Compliance with tax, financial, and regulatory requirements.

4. Special Category Data

We do not intentionally collect or process any special category data as defined under GDPR Article 9 (e.g., health data, racial or ethnic origin, religious beliefs, or biometric data). Please do not include such information in your account or study submissions.

5. Data Retention

We keep your personal data for as long as your account is active, or as needed to provide the Service. Specifically:

• Account and usage data: retained while your account is active, then deleted 30 days after account deletion.
• Payment records: retained for 7 years to comply with Irish tax law.
• Audit logs: retained for 12 months, then automatically purged.
• Practice answers submitted for AI feedback: retained for the lifetime of your account unless you request earlier deletion.

6. Data Sharing & Processors

We do not sell your personal data. We share it only with trusted third-party processors who help us deliver the Service, all of whom are bound by data processing agreements:

• Supabase — database hosting and authentication (EU data residency).
• Stripe — payment processing and subscription management.
• Resend — transactional email delivery (e.g., verification emails).
• AI sub-processor — used to generate study feedback. Your submitted answers may be processed by this provider under a data processing agreement that prohibits use of your content for model training. The current provider is named in the sub-processor register available on request at hello@fascliste.com.
• Cloudflare — CDN, DDoS protection, and Turnstile bot verification (processes IP addresses).

We may also disclose data if required by law, court order, or to protect the rights and safety of our users.

7. Your Rights Under GDPR

As a data subject, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure:Request deletion of your data ("right to be forgotten") where there is no overriding legal basis for retention.
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Ask us to limit how we process your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time via your account settings.

To exercise any of these rights, email us at data@fascliste.com. We will respond within 30 days.

8. Cookies

We use a minimal set of cookies required to operate the platform:

• Session cookies: Essential for authentication and keeping you logged in. These are deleted when you close your browser or log out.
• Cloudflare Turnstile: A privacy-friendly bot detection service used on sign-up and login forms. It may set a cookie to verify you are human. No advertising profiles are created.

We do not use advertising cookies or third-party tracking cookies. If you enable optional analytics, a first-party analytics cookie may be set — you can opt out at any time in your account settings.

9. Under-18s

FásCliste is designed for secondary school students, many of whom may be under 18. We take the privacy of young people seriously.

Users under 16 must have parental or guardian consent before creating an account. We do not use data from under-18 users for advertising, profiling, or any purpose other than delivering the educational Service.

If you are a parent or guardian and believe your child has created an account without consent, please contact us at data@fascliste.com and we will delete the account promptly.

10. Contact Us

For any privacy-related enquiries, data subject requests, or concerns:

FásCliste — Data Team
Ireland
Email: data@fascliste.com

11. Supervisory Authority

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Irish supervisory authority:

Data Protection Commission (DPC)
21 Fitzwilliam Square South, Dublin 2, D02 RD28
Website: dataprotection.ie