Effective date: September 10, 2026. This policy describes how MS Exam Lab (msexamlab.com), operated by Data Citadel LLC, collects, uses, and protects your information.
We do not collect sensitive categories of data and do not run advertising or analytics trackers.
Contract performance (accounts, content delivery, billing), legitimate interest (security, abuse prevention, service improvement), and consent (optional features like the public leaderboard).
We do not sell your data — ever. We share it only with processors needed to run the service: Stripe (payments), our email provider (transactional email such as password resets), Google (OAuth sign-in), and our hosting provider. We may also disclose information where required by law.
We use a single essential session cookie (a signed JSON Web Token, up to 30 days) to keep you signed in. No advertising, tracking, or analytics cookies.
Account and practice history are kept while your account is active. Password-reset tokens expire after one hour. Deleting your account deletes your data (see section 6). After deletion we retain no personal data in our own systems; Stripe retains transaction/invoice records on its platform as payment processors are legally required to for tax and accounting purposes.
You may request access, correction, and deletion of your data. GDPR users additionally have portability and objection/restriction rights; CCPA/CPRA users have the right to know, delete, and opt out of any "sale" — which we do not engage in.
Self-service, available right now from your profile page: Download my data exports your profile, subscription status, and full practice history as JSON (rate-limited to 3 downloads per day); Delete my account permanently removes your profile, practice history, leaderboard presence, and billing links, and cancels any active subscription (password or fresh Google sign-in required to confirm). For other rights, email [email protected] from your account email. We respond within 30 days.
The service is not directed at children under 13, and we do not knowingly collect their personal information.
Passwords are bcrypt-hashed, sessions use signed tokens, and traffic is served over HTTPS.
Material changes are announced via a site notice and email where available. The effective date reflects the current version.
Data Citadel LLC — operating MS Exam Lab. Privacy questions: [email protected]. See also our Terms of Service.