Our Privacy Policy

Introduction

Welcome to Past Papers Academy ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website pastpapersacademy.com (the "Site").

By using our Site, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Site.

Types of Information We Collect

Information You Provide

We collect information that you voluntarily provide when you:

• Contact us: Name, email address, phone number, and message content via our contact form
• Subscribe to our newsletter: Email address for study tips and site updates
• Register for events: Name, contact details, and subject or level of study
• Use our AI chat assistant: Messages and academic questions you submit to the chat widget

Information Collected Automatically

When you visit our Site, we automatically collect certain information about your device and how you use the Site, including:

• Browser type and version
• Operating system
• IP address
• Pages visited and time spent
• Referring website or traffic source (including UTM parameters)
• Device identifiers
• An anonymous user identifier generated and stored in your browser (not linked to your identity)
• Study activity - past papers viewed or downloaded, topics browsed, videos watched, flashcard sessions
• Session recordings - with your consent, we record page interactions (scrolling, clicks, navigation) to improve the Site. All form input fields are masked and never recorded.
• Heatmap data - aggregated click and scroll patterns across pages

This information helps us improve our Site and provide better services to you.

How We Use Your Information

We use the information we collect for the following purposes:

1. To provide our services: Delivering access to past papers, revision notes, topical questions, videos, and other study materials
2. To improve our Site: Analysing usage patterns, session recordings, and heatmaps to optimise the user experience
3. To communicate with you: Responding to contact form enquiries, sending newsletter updates, and notifying you of events
4. To operate our AI chat assistant: Routing your questions to OpenAI's API to generate academic responses
5. To show relevant advertising: Displaying ads via Facebook (Meta) based on your interests and browsing behaviour, subject to your consent
6. To personalise content: Recommending relevant study materials based on your activity
7. To comply with legal obligations: Meeting regulatory requirements and protecting our rights

Information We Share

We do not sell your personal information. We may share your information in the following situations:

• With service providers: Companies that help us operate our Site - including PostHog, Cloudflare, Facebook (Meta), OpenAI, Trustpilot, and Stripe (see Third-Party Services below)
• For legal reasons: When required by law or to protect our rights
• With your consent: When you explicitly agree to share your information
• Business transfers: In connection with a merger, sale, or acquisition (if applicable)

Third-Party Services

We use the following third-party services to operate our Site:

PostHog (Analytics & Session Recording)

• Tracks page views, user interactions, and custom events (e.g. papers downloaded, topics viewed)
• Records user sessions (scrolling, clicks, navigation) with all form inputs masked
• Generates heatmaps and runs in-product surveys
• Data is processed on PostHog's EU servers (eu.i.posthog.com)
• Only activated with your consent (Analytics category)
• PostHog Privacy Policy

Cloudflare

• Hosts and serves the Site via Cloudflare Pages and CDN
• Stores analytics events and email subscriber data in our own Cloudflare D1 database
• Delivers media assets via Cloudflare R2 storage
• Cloudflare Web Analytics collects basic page metrics without tracking cookies (no consent required)
• Cloudflare Privacy Policy

Facebook (Meta) Pixel

• Displays interest-based advertising on Facebook and Instagram
• May use cookies to track visits across websites to build an interest profile
• Only activated with your consent (Marketing category)
• Meta Privacy Policy

OpenAI

• Powers the AI chat assistant on our Site
• Messages you send to the chat widget are transmitted to OpenAI's API to generate responses
• Do not include sensitive personal information in chat messages
• OpenAI Privacy Policy

Trustpilot

• Displays customer reviews and ratings on our Site via an embedded widget
• Trustpilot Privacy Policy

Stripe

• Payment processing for any future premium services
• We do not store your payment card details
• Stripe Privacy Policy

Google Fonts & Font Awesome

• Font and icon delivery via CDN - may log the requesting IP address
• No consent required (no tracking cookies set)

Cookies, Local Storage, and Tracking

We use cookies and browser local storage to provide Site functionality, remember your preferences, and (with your consent) analyse usage. A cookie consent banner lets you choose which categories to allow.

Cookie & Storage Categories

• Essential (always active): Required for basic Site functionality - your cookie preferences, anonymous identifier, and UI theme setting
• Analytics (opt-in): PostHog event tracking, session recordings, and heatmaps
• Marketing (opt-in): Facebook Pixel for personalised advertising

Keys Stored in Your Browser

• ppa_cookie_consent - Your cookie category choices (essential / analytics / marketing)
• ppa_anonymous_id - A random anonymous identifier used to distinguish sessions (not linked to your identity)
• ppa_subscribed - Flags whether you have subscribed to the newsletter (prevents re-showing the signup form)
• ppa_chat_history - Stores your local chat conversation history
• ppa_is_new - Flags whether this is your first visit
• theme - Remembers your dark/light mode preference

You can withdraw or change your consent at any time by clearing your browser's local storage and cookies, or by contacting us. Disabling essential storage may affect Site functionality.

Advertising

We use the Facebook (Meta) Pixel to show you relevant advertisements on Facebook and Instagram. This service may use cookies to track your visits to our Site and build an interest profile. It is only activated if you accept the Marketing cookie category.

Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (HTTPS/TLS) enforced via Cloudflare
• Data stored in Cloudflare-managed infrastructure with strict access controls
• Analytics data hosted in the EU (PostHog) or within Cloudflare's secure environment
• Regular review of third-party scripts and integrations
• Input masking in session recordings - form field content is never captured

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

Your Privacy Choices

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Data portability: Request a copy of your data in a structured format
• Opt-out of marketing: Unsubscribe from our newsletter or withdraw Marketing cookie consent at any time
• Withdraw analytics consent: Change your cookie preferences to disable PostHog session recording and event tracking

To exercise any of these rights, please contact us using the information provided in the "Contact Us" section below.

Children's Privacy

Our Site is intended for students preparing for Cambridge Checkpoint, IGCSE, AS-Level, and A2-Level examinations. While many of our users may be under 18, we do not knowingly collect personal information from children under 13 without parental consent.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us, and we will take steps to delete such information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:

• Posting the updated policy on this page
• Updating the "Effective Date" at the top
• Sending an email notification (for significant changes)

We encourage you to review this Privacy Policy periodically for any updates. Your continued use of the Site after any changes indicates your acceptance of the updated policy.

Contact Details

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: