Privacy Notice
Version 2026-10-21 · in effect from 21 Oct 2026
This notice explains what personal data Yosei collects when you use our exam-preparation service, why we collect it, how long we keep it and what you can ask us to do about it. It is written for the General Data Protection Regulation (EU) 2016/679.
1. Who is responsible
Tutul B.V. is the controller of the personal data described here. We are a private limited company (besloten vennootschap) incorporated in the Netherlands, with our registered office at Achterweg 22, 2376 AX Nieuwe Wetering, the Netherlands, registered with the Netherlands Chamber of Commerce (Kamer van Koophandel) under number 12345678. Yosei is the service we operate. You can reach us at soumitra@itutul.com for anything in this notice, including to exercise any of the rights in section 6.
Because we are established in the Netherlands, our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Hoge Nieuwstraat 8, 2514 EL The Hague, the Netherlands — autoriteitpersoonsgegevens.nl. We are established inside the European Union, so we are not required to appoint a representative under Article 27 GDPR and have not appointed one. We have not appointed a Data Protection Officer; we are not required to.
2. What we collect, why, and on what legal basis
If you use the Service without an account
Free practice without an account stores nothing about you. We create no record, no profile and no history — there is no database row to delete afterwards. The only thing we keep is a short-lived, hashed abuse-prevention counter (section 2, “Keeping the Service working”), which is not linked to any account.
If you have an account
| What | Why | Legal basis |
|---|---|---|
| Your email address | It is your account identity: it signs you in, it is how we send you service messages, and it is how we find your account when you contact support | Performance of our contract with you — Art 6(1)(b) |
| Your first and last name, if you give them — both optional — and your avatar, language and time zone | To address you by name and show the interface the way you prefer | Art 6(1)(b). We do not require a name: nothing in the Service needs one |
| Email confirmation state, password hash, and any second factor you enrol | To sign you in and to keep your account secure | Art 6(1)(b) and our legitimate interest in preventing account abuse — Art 6(1)(f) |
| Which version of our Terms you accepted, and when | To be able to show what was agreed between us. This is evidence of our contract, not consent, and we do not record your IP address for it | Art 6(1)(b), and Art 6(1)(c)/5(2) accountability |
| Your practice: sessions, answers, marks, timings, flags, and the analytics we derive from them | To deliver the Service — to run a session, mark it, show your results and show you how you are doing | Art 6(1)(b) |
| Your preferences: last-used exam, session setup choices, and any exam date you tell us you are working towards | To pick up where you left off and to support your study plan | Art 6(1)(b) |
| Your access record for each exam: whether you have a trial or paid access, and when it started and ends | To give you what you are entitled to, and to prevent repeated trials | Art 6(1)(b), and Art 6(1)(f) for abuse prevention |
| If you start registering and never confirm your address: a marker that you began | To finish or clean up an incomplete registration | Steps taken at your request before entering a contract — Art 6(1)(b) |
If you buy access
Our payment provider processes your payment details — we never see or store your card number — and we keep a record of what was sold, the amounts, the tax applied and the provider’s reference for it. We keep those records because tax and accounting law requires us to (Art 6(1)(c)); they contain no name, email address or postal address.
We also record that you asked us to open access immediately and acknowledged that this ends your right of withdrawal, together with the date and the version of the Terms you bought under. Consumer law requires us to be able to show this, so we keep it for as long as a claim about the purchase could be brought (Art 6(1)(c)). We send you the same statement by email at the time, so you hold a copy too.
Keeping the Service working
We apply rate limits to sign-in, registration and question-serving requests, to make bulk collection and password-guessing impractical. The counter is keyed on a one-way hash of your network address or account identifier, held only in a temporary cache, and expires with the limit window. It is never written to our database, never joined to your account and never logged.
We use an error-monitoring service so we can find and fix faults. Error reports are configured not to include your email address, your network address, cookies or request bodies. Despite that, a report can occasionally contain personal data that happened to appear in an error message. This is our legitimate interest in operating a working, secure service — Art 6(1)(f).
Staff accounts
If you hold a staff account with us rather than a learner account, we also require your first and last name and record an audit trail of the administrative actions you take. We do this so that actions affecting other people’s data can be attributed to a person — Art 6(1)(f).
3. What we deliberately do not do
- No marketing. We send no marketing email, hold no marketing consent, and operate no mailing list. Our email to you is transactional only: confirmations, security notices, expiry warnings and receipts.
- No tracking of visitors. We set only the strictly necessary cookies described in section 7. We use no analytics, advertising or social-media tracking cookies, and no third-party trackers.
- No profiling that affects you legally. Our analytics and adaptive practice choose which questions to show you next, based on your own answers. Nothing in the Service makes an automated decision that produces legal effects for you or similarly significantly affects you.
- We do not sell your data, and we do not use it to train machine-learning models.
- We do not ask for your country of residence or record where you registered from.
4. Who else processes your data
We use a small number of service providers who process personal data on our instructions, under a written data processing agreement. They are:
- a payment provider (Stripe), for payments and payment-related tax records;
- an email provider (Brevo, France), to deliver transactional email;
- an error-monitoring provider (Sentry), on its EU region;
- an uptime-monitoring provider (UptimeRobot), which checks that the site responds and receives no personal data in doing so;
- our hosting provider, which hosts the application and its database in the EU.
Some of these providers are established outside the EU or use group companies that are. Where personal data is transferred outside the EU or EEA, we rely on an adequacy decision where one applies, and otherwise on the European Commission’s standard contractual clauses. You can ask us for details.
Beyond these providers, we disclose personal data only where the law requires it, or to establish, exercise or defend legal claims.
5. How long we keep things
| What | How long |
|---|---|
| Your account, profile, preferences and Terms acceptance record | Until you delete your account |
| An incomplete registration you never confirmed | 14 days, then the placeholder account and the marker are deleted |
| Practice data tied to paid access, after that access expires | 120 days, during which you can still see your statistics, then permanently deleted |
| Practice data tied to a trial, after the trial ends | 30 days, then permanently deleted |
| Records of sales, for tax and accounting | 7 years, or up to 10 years where EU VAT rules require it. These survive account deletion but are stripped of any link to you |
| Administrative audit records of staff actions | 24 months. They contain no name, email address or exam content — only internal identifiers |
| Abuse-prevention counters | Minutes to an hour, by cache expiry |
| Error reports | Our monitoring provider’s retention period |
6. Your rights
You have the right to:
- access the personal data we hold about you (Art 15);
- correct it if it is wrong or incomplete (Art 16) — you can edit your profile yourself at any time;
- delete your account and your personal data (Art 17), subject to the sale records we are legally required to keep, which we keep without any link to you;
- receive a copy of the data you gave us and the data your use of the Service generated, in a structured, machine-readable format (Art 20);
- restrict our processing in the circumstances the Regulation allows (Art 18);
- object to processing we carry out on the basis of our legitimate interests (Art 21).
Write to soumitra@itutul.com and we will respond within one month. We may need to verify that the request comes from you.
If you are not satisfied, you can complain to a data protection supervisory authority — normally the one in the EU country where you live or work, or our lead supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), whose details are in section 1.
7. Cookies
We set only cookies that are strictly necessary for the site to work: a session cookie that keeps you signed in, and a cross-site request forgery token that protects forms you submit. Both are exempt from the consent requirement, which is why we show no cookie banner asking you to choose. We store your light or dark theme preference in your browser; that never reaches our servers as personal data.
8. Changes to this notice
This notice is versioned, and its version is independent of our Terms of Service: updating it does not change anything you have agreed to, and does not require you to accept our Terms again. When we change it we publish a new version with a new date, and we tell you if the change is significant. The version in effect appears at the top of this page.