Privacy policy
Last updated: September 29, 2026
1. Who we are
This policy applies to the Exam Arena mobile app (iOS and Android) and the web service app.examarena.com, both operated by ARENA, registered in France under SIREN 934 277 344, with its registered office at 229 rue de Solférino, 59000 Lille, France.
ARENA is the data controller under the GDPR.
For any privacy-related question:
- Email: contact@examarena.com
- Mail: ARENA, 229 rue de Solférino, 59000 Lille, France
2. What data do we collect?
We only collect data needed to run the service and improve your experience. We never sell your data.
2.1 Identity and contact data
- First name, last name (provided at signup or via Sign In with Apple / Google)
- Email address
- Profile picture (optional)
2.2 Authentication data
- Password (stored hashed and salted by Supabase, never accessible in clear text)
- Apple / Google identifier if you use Sign In with Apple or Google
2.3 Technical identifiers
- Internal user ID (randomly generated UUID)
- Device token for push notifications (Firebase Cloud Messaging), only if you accept notifications
2.4 Product usage data
- Exercise attempts (questions, answers, scores, time spent)
- Lessons read and completion status
- Sport sessions completed
- Selected preparation, priority subjects, exam date entered during onboarding
- The result of a quiz taken on a partner site, when you arrive from that site: site name, quiz identifier and title, score, breakdown by subject and quiz date (never your answers). It is attached to your account when you create one or log in.
2.5 Payment data
- Subscription status (free, premium, expiration dates)
- Stripe (web) or RevenueCat (iOS / Android) technical identifiers
- Payment history (amount, currency, date, status, billing country)
We never store credit card numbers on our servers. They are processed directly by Stripe, Apple, or Google depending on the payment channel.
2.6 Preference data
- Selected language
- Email notification preferences
2.7 Marketing and attribution data
- Acquisition source (UTM parameters:
utm_source,utm_medium,utm_campaign,utm_term,utm_content) - Landing page, referrer
- Ad click identifiers:
gclid(Google Ads),gbraid/wbraid(Google iOS) - Apple Search Ads attribution (campaign and ad identifiers, no Apple user identifier)
3. Why we collect this data
| Data | Purpose | GDPR legal basis |
|---|---|---|
| Email, name, password | Account creation, authentication | Performance of the contract |
| User ID, Apple / Google identifiers | Link your data to your account | Performance of the contract |
| Product usage data | Save and display your progress | Performance of the contract |
| Payment data | Manage your subscription, support, accounting obligations | Contract + legal obligation |
| Push device token | Notify you about free credits and active offers | Consent (OS-level prompt) |
| Email + subscription status | Send transactional emails (welcome, receipts, password reset) | Performance of the contract |
| Email + payment behavior | Reminder email if you started a payment without completing it | Legitimate interest (help you resume your purchase) |
| Aggregated usage data | Understand how the service is used, prioritize improvements | Legitimate interest |
| UTM, click IDs, ASA attribution | Measure the effectiveness of our marketing campaigns | Legitimate interest |
| Language, preferences | Personalize your interface | Performance of the contract |
There is no advertising profiling.
4. Who we share data with
Your data is hosted and processed by providers selected for their GDPR compliance. Each provider in the table below acts as a data processor under the GDPR, bound to us by a Data Processing Agreement (DPA).
| Provider | Role | Hosting country | Safeguards |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | France (Paris, eu-west-3) |
DPA + Standard Contractual Clauses |
| Vercel Inc. | Web application hosting | United States (global edge network) | DPA + Standard Contractual Clauses |
| Stripe Payments Europe Ltd | Web payment processing | Ireland / United States | Stripe DPA + Standard Contractual Clauses |
| RevenueCat Inc. | In-app purchase management (iOS / Android) | United States | Standard Contractual Clauses |
| Apple Inc. | Sign In with Apple, App Store, Apple Search Ads, iOS push notifications | United States | Apple DPA |
| Google LLC | Sign In with Google, Firebase Cloud Messaging, Google Ads, Google Play | United States | Standard Contractual Clauses |
| Resend Inc. | Transactional email delivery | United States | Standard Contractual Clauses |
| Umami (self-hosted) | Cookieless web analytics | United States (Vercel) | Standard Contractual Clauses |
The providers of the AI assistant are listed in section 13.
We never sell your data to third parties for advertising purposes.
Transfers outside the European Union
Some of the providers in the table above are based in the United States. These transfers are governed by the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) and, where applicable, by the EU-US Data Privacy Framework for certified providers.
5. How long we keep your data
| Category | Retention |
|---|---|
| Active account | As long as your account is open |
| Deleted account | Permanently erased within 30 days of your deletion request, except for AI assistant conversations and usage data (section 13) |
| Payment data | 10 years from invoicing (French accounting and tax obligation) |
| Technical logs (sent emails, push notifications) | 12 months |
| Marketing attribution data (UTM, click IDs) | 13 months |
| Exercise attempts and progress | For the duration of your account, deleted with the account |
6. Your rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access: get a copy of your data. By request to contact@examarena.com.
- Right to rectification: update your data via My account > Profile.
- Right to erasure: delete your account via My account > Account > Delete my account. Your data is then erased within 30 days, except for data we are required to keep by law (payments) and for AI assistant conversations and usage data (section 13).
- Right to data portability: receive your data in a structured format. By request to contact@examarena.com.
- Right to object: object to processing based on our legitimate interest by emailing contact@examarena.com.
- Right to restrict processing: restrict the use of your data, by emailing the same address.
- Right to withdraw consent: for push notifications, from your device settings. For marketing emails, via My account > Notifications.
We respond to any request within one month at the latest.
If you disagree with our response, you can lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris, France, www.cnil.fr) or with your local supervisory authority.
7. Cookies and trackers
On app.examarena.com
- Session cookies (Supabase): strictly necessary for authentication. Exempt from consent under CNIL guidance 2020-091.
- Umami Analytics: anonymous audience measurement, no cookies, no fingerprinting, self-hosted instance operated by ARENA. Compliant with the CNIL audience measurement exemption.
- ea_vid: a randomly drawn identifier, set by our servers on your first visit and kept by your browser for one year. It says nothing about you and can only be read by our servers, never by the scripts on the page. It serves a single purpose: showing you the same version of the site on every visit, the current one or the new one, while we compare the two. The version you see is recorded in our audience measurement. The identifier itself is not stored in any of our databases, is not shared with anyone, and is used neither for advertising nor to follow you on other sites.
- ea_vid_new: a cookie whose value is "1", set together with ea_vid and deleted within 10 minutes at the latest. It contains no identifier. It only tells our servers that your device is new, so that our audience measurement counts each new device only once, in each version of the site.
- ea_entry_prep: a cookie with no identifier, holding only the preparation you picked when answering the arrival questions. Your browser keeps it for 30 days at most, and our servers read it so that we do not ask you those questions again. Deleted as soon as you sign out, and when your account is deleted.
- ea_entry_logged_out: a one-hour cookie holding no data at all, set when you sign out or delete your account. Our servers read it so that the arrival questions are not shown to you right after you leave.
In the mobile app
- No third-party cookies. No advertising SDK (no Facebook Pixel, no Google Analytics, no Hotjar).
- On iOS, the Apple AdServices framework is used once at install time to measure the effectiveness of our Apple Search Ads campaigns, anonymously and without any advertising identifier (no IDFA).
- Push notifications are enabled only with your explicit consent via the iOS / Android system prompt.
Local storage in your browser
Before you even have an account, your browser keeps a few details on your device, and on your device only. They are sent to our servers only when you create an account, so that your answers can be attached to it.
- ea_entry_answers_v1: your answers to the arrival questionnaire (country, preparation, priority subject, timeframe).
- ea_entry_intent_v1: the page you were opening when we asked you for an account.
- ea_external_result_v1: the result of a quiz taken on a partner site (site, quiz, score, breakdown by subject), kept for seven days at most.
- ea_entry_arrival_answered: the fact that you just answered the arrival questions, so we do not ask them again right after. Cleared when you close the tab.
- personality-draft:…: the draft of a personality test in progress, so you can resume it.
They are wiped from your device as soon as you sign out, and when your account is deleted.
We do not use any advertising tracking cookies, so no cookie consent banner is shown on the v2 app.
8. Security
- Encrypted connections in HTTPS / TLS 1.3.
- Passwords hashed and salted by Supabase Auth (bcrypt).
- Strong authentication available via Sign In with Apple or Google.
- Data access protected by PostgreSQL Row Level Security.
- Daily encrypted backups at Supabase.
- In case of a data breach posing a risk to your rights, we will notify you without delay, as required by Article 34 of the GDPR.
9. Minors
The service is open from age 15, the minimum digital consent age in France. For users between 15 and 18, registration is under the responsibility of their legal guardians.
10. Changes
We may update this policy from time to time. Any substantial change will be notified by email and / or in the app. The last update date appears at the top of this page.
11. Contact
For any question:
- Email: contact@examarena.com
- Mail: ARENA, 229 rue de Solférino, 59000 Lille, France
12. Personality test and interview preparation
Section added on 28 July 2026. It supplements sections 2 to 5 for a service released after they were written.
What we collect
If you take the personality test, we keep your 120 answers, the scores computed from them, and the written summary shown to you on screen. We also keep the date on which you agreed to have your answers analysed.
If you receive an interview preparation, we keep the document written for you, together with any feedback you leave about it.
What this document is not
It is neither a diagnosis, nor medical advice, nor an official psychological assessment. It predicts neither your score nor a panel's decision. It describes tendencies, to help you prepare for an interview.
Why we process them
To deliver the service you subscribed to, and to improve the quality of the preparations we write.
For how long
| Category | Duration |
|---|---|
| Test answers, scores and summary | For the lifetime of your account |
| Written interview preparation | For the lifetime of your account |
| Feedback left on your preparation | For the lifetime of your account |
This data is erased along with your account. It is not retained under any legal obligation.
Who has access
The team members. This data is neither sold, nor passed to a third party, nor shared with the body running the exam you are preparing for.
Your rights
The rights described in section 6 apply to this data as to the rest. You may in particular request a copy of your preparation, or its erasure, by writing to contact@examarena.com.
13. AI assistant
Section added on 29 September 2026. It supplements sections 2 to 6 for the AI assistant, released after they were written.
On some preparations, an assistant answers your questions about the exam or selection process you are preparing for. It can also suggest what to work on. It is only available to signed-in users.
Its answers are written automatically by an artificial intelligence model, based on excerpts from our documentation. They may contain errors. Check any important information against the official source.
What we process
- The messages you write and the assistant's answers.
- The title of each conversation, made of the first words of your first message.
- If you ask what to work on: the exercise category where your results are weakest, your score in that category, the content suggested to you and, where applicable, the number of free credits you have left.
- A count of the messages sent during the day, to apply the daily limit.
- Usage data: opening the assistant, sending a message, clicking a suggestion, reaching the daily limit. It does not contain the text of your messages.
Do not write personal information the assistant does not need, such as your contact details, your health, or your family or financial situation.
Why we process it
| Processing | GDPR legal basis |
|---|---|
| Answering your questions, saving your conversations, suggesting what to work on | Performance of the contract |
| Measuring use of the assistant, limiting the number of messages per day | Legitimate interest |
What is sent to the AI models
With each message, we send the model that writes the answer:
- your latest exchanges with the assistant, 12 messages at most, including the suggestion details described above;
- the name of the preparation and the language of the answer;
- excerpts from our documentation on the preparation;
- the assistant's instructions.
We do not add your name, your email address or your account identifier. Only what you write yourself can contain them.
Your latest message is also sent to a second model. It converts it into a series of numbers, used to find the relevant excerpts of our documentation.
The content suggested to you is chosen by our own rules, based on your results. It is not chosen by the AI model.
Providers
| Provider | Role |
|---|---|
| Vercel Inc. | Gateway to the AI models (Vercel AI Gateway) |
| Writing the answers (Gemini model), through the Gemini API or Vertex AI depending on the gateway's routing | |
| OpenAI or Microsoft (Azure OpenAI) | Converting your latest message into a series of numbers (OpenAI embedding model), depending on the gateway's routing |
For each request, the gateway chooses which of these providers processes it.
Your conversations are stored in our database, hosted by Supabase (section 4).
This processing may take place outside the European Union.
For how long
| Category | Duration |
|---|---|
| Conversations | Until you delete them. They are not erased with your account (see below) |
| Assistant usage data | For the lifetime of your account, then in pseudonymised form after its deletion, for our statistics |
To delete a conversation, open My conversations with the history icon at the top of the assistant, then use the bin icon next to the conversation. It is then deleted from our database. If the assistant is no longer offered on your preparation, write to us at contact@examarena.com to have them deleted. They are also deleted if we remove the preparation they belong to.
Deleting your account does not erase your conversations. They remain stored, attached to your account, from which we remove your name and your email address. They are therefore pseudonymised, not anonymised: what you wrote in them is kept as is. If you want them erased, delete them before deleting your account.
Who has access
In the app, your conversations are only visible from your account. An Exam Arena administrator who signs in to your account, for example to assist you, can see them; each such sign-in is logged. No other screen in our admin area displays their content. Team members who administer the database can also technically access them.
Age
The assistant is open under the same age conditions as the rest of the service (section 9).
Your rights
The rights described in section 6 apply to this data as to the rest. You may in particular request a copy of your conversations by writing to contact@examarena.com.