1. Who we are

This Privacy Policy explains how Utesto (referred to as "Utesto," "we," "us," or "our"), the operator of utesto.com (the "Service"), collects, uses, stores, and protects your personal data.

Utesto provides online mock tests, practice materials, and exam-preparation tools for the TOEFL® and CELPIP® examinations. We are the controller of the personal data described in this Policy.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

2. Scope and legal framework

We process personal data in accordance with applicable data-protection law. Where we offer the Service to users located in the European Economic Area (EEA) or the United Kingdom, we also apply the standards of the EU General Data Protection Regulation (GDPR) and UK GDPR to the extent they apply to that processing.

3. Information we collect

We collect the following categories of personal data:

a. Information you provide to us directly

Account data: name, email address, password (stored in encrypted form), and preferred language.
Profile and learning data: target exam (TOEFL/CELPIP), test attempts, answers you submit, scores, progress, and study history.
Communications: messages, support requests, feedback, and correspondence you send to us.

b. Information collected automatically

Usage data: pages viewed, features used, tests taken, time spent, and interaction events.
Device and technical data: IP address, browser type, operating system, device identifiers, and approximate location derived from your IP address.
Cookies and similar technologies: as described in Section 9.

c. Payment information

We do not collect or store your full payment card details. All payments are processed by our Merchant of Record, Paddle.com Market Limited ("Paddle"). When you make a purchase, your card and billing information is collected and processed directly by Paddle under Paddle's own privacy policy. We receive only limited transaction data from Paddle (for example, your name, country, the last four digits of your card, and subscription status) needed to provide and manage your account.

4. How we use your information

We use personal data for the following purposes and on the following legal bases:

Purpose	Legal basis
To create and manage your account and provide the Service	Performance of a contract
To deliver mock tests, grade attempts, and track your progress	Performance of a contract
To process subscriptions, renewals, and access rights (via Paddle)	Performance of a contract
To provide customer support and respond to your requests	Performance of a contract / legitimate interests
To send service-related notices (e.g. renewal reminders, security alerts)	Performance of a contract / legal obligation
To improve, secure, and develop the Service and prevent fraud or abuse	Legitimate interests
To send marketing communications (where permitted)	Consent (you may withdraw at any time)
To comply with legal, accounting, and tax obligations	Legal obligation

5. Fraud, abuse, and account-security processing

To protect the integrity of the Service and prevent misuse (including subscription abuse, sharing of accounts, and fraudulent refund or chargeback attempts), we may process account, usage, device, and transaction data to detect, investigate, and prevent such activity. This processing is based on our legitimate interest in protecting our business, our users, and the fairness of the Service.

6. Sharing your information

We do not sell your personal data. We share it only with:

Paddle (Merchant of Record): to process payments, subscriptions, refunds, taxes, and related billing communications.
Service providers (processors): hosting, cloud storage, analytics, email delivery, and customer-support tools that process data on our behalf under written agreements.
Professional advisers and authorities: where required to comply with law, respond to lawful requests, enforce our Terms of Use, or protect our rights, users, or the public.
Business transfers: in connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality safeguards.

7. International data transfers

Our providers (including Paddle and our hosting partners) may process data in various countries, including in the EEA, the United Kingdom, and elsewhere. Where personal data is transferred across borders, we take reasonable steps to ensure it is protected by appropriate safeguards consistent with applicable law.

8. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

Account and learning data: for the life of your account and for a reasonable period afterward.
Transaction and tax records: for the period required by applicable accounting and tax law.
Fraud- and abuse-prevention records: for as long as needed to protect the Service.

When data is no longer required, we delete or anonymise it.

9. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, measure and improve the Service, and support security. You can control cookies through your browser settings; disabling some cookies may affect how the Service works. Where required by law, we request your consent for non-essential cookies.

10. Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you;
Rectify inaccurate or incomplete data;
Erase your data ("right to be forgotten"), subject to legal retention requirements;
Restrict or object to certain processing;
Data portability, where applicable;
Withdraw consent at any time (this does not affect prior lawful processing);
Lodge a complaint with the data-protection supervisory authority in your jurisdiction.

To exercise any of these rights, contact us at support@utesto.com. We may need to verify your identity before responding, and we will respond within the timeframe required by applicable law.

11. Data security

We implement appropriate technical and organisational measures — including encryption of passwords, access controls, and secure hosting — to protect personal data against unauthorised access, loss, or misuse. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children's privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it. Users under the age of majority should use the Service only with the consent and supervision of a parent or legal guardian.

13. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you by email or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact:
Utesto
Email: support@utesto.com

Trademark notice

TOEFL® is a registered trademark of Educational Testing Service (ETS). CELPIP® is a registered trademark of Paragon Testing Enterprises. Utesto is an independent preparation service and is not affiliated with, endorsed by, or approved by ETS or Paragon Testing Enterprises. All trademarks are the property of their respective owners.