Privacy Policy

1.1 Information You Provide

We collect information you provide directly when you:

• Create an account — name, email address, and profile image (via OAuth providers like Google, LinkedIn, or GitHub)
• Set up your profile — optional username, bio, LinkedIn URL, and GitHub URL
• Make a purchase — billing information is handled by our payment processor; we only store a reference ID, not your full card details
• Contact us — name, email, and message content

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage data — questions attempted, answers submitted, time taken, scores, XP earned, and features accessed
• Device and browser information — browser type and version, operating system, device type
• Log data — IP address, pages visited, referring URL, timestamps
• Cookies and similar technologies — session tokens and preference cookies (see Section 5)

1.3 Information from Third Parties

When you sign in with Google or GitHub, we receive your name, email address, and profile picture from those providers. We do not receive your password or financial information from them. Your use of those services is governed by their own privacy policies.

We use the information we collect to:

• Create and manage your account and authenticate you
• Provide, maintain, and improve the Service, including tracking your progress, awarding XP, and personalizing your experience
• Process subscription payments securely through our payment processor
• Generate AI-powered performance reports based on your interview answers
• Send transactional emails (account confirmations, password resets, receipts)
• Send marketing messages only where you separately opt in or another lawful basis applies, with a free opt-out method in every message
• Respond to your support requests, bug reports, and feature requests
• Monitor and analyze usage patterns to improve platform performance and identify bugs
• Detect and prevent fraudulent activity and enforce our Terms of Service
• Comply with applicable legal obligations

Depending on the activity and your location, we rely on one or more of:

• Contract performance — account, subscription and core learning features
• Legal obligations — tax, accounting, consumer, security and authority requests
• Legitimate interests — service security, fraud prevention and proportionate improvement
• Establishment or protection of rights — disputes, chargebacks and abuse investigations
• Consent — optional marketing, non-essential cookies or transfers where legally required

For Türkiye, processing is carried out under the applicable conditions in Articles 5 and 6 of Law No. 6698 (KVKK), matched to each processing activity rather than relying on blanket consent.

We do not sell your personal data. We may share your information in the following limited circumstances:

• Service Providers — We share data with trusted third-party vendors who assist us in operating the Service, including the active merchant-of-record payment provider, OpenAI (AI features), Resend (transactional contact delivery), configured OAuth providers, and our configured hosting and database providers. We limit data to what is reasonably necessary for each function.
• Third-party provider rules: Payment, authentication, email, hosting, analytics and AI providers may process data under their own terms, privacy notices, security measures, retention rules and legal obligations. Their availability, verification checks, fraud controls or policy changes may affect parts of the Service.
• Leaderboard— Your public username, or a shortened display name such as "Alex M." when no username is set, may appear with your XP and learning statistics. Full names and profile photos are not shown to other users on the leaderboard.
• Legal Requirements — We may disclose your information if required by law, subpoena, or to protect our legal rights or the safety of others.
• Business Transfers — In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections.

We retain your personal data for as long as your account is active or as needed to provide the Service. Following a verified deletion request, account data is deleted or anonymized within a reasonable operational period, normally 30 days, except for backups and records that must be retained for tax, accounting, consumer protection, payment disputes, fraud prevention or establishment of legal claims. Those records are isolated and deleted when the applicable retention period ends.

Aggregated, anonymized data (e.g., total questions solved across the platform) may be retained indefinitely for analytics purposes.

We currently use the following types of cookies:

• Essential cookies — Required for authentication and session management. You cannot opt out of these without losing access to the Service.

You can control cookies through your browser settings. Disabling essential cookies may impair your ability to use the Service. Non-essential analytics or advertising technologies will not be enabled for visitors who require consent until an appropriate consent control is available. See our Cookie Policy.

We implement industry-standard security measures to protect your personal data, including:

• TLS/HTTPS encryption for all data transmitted between your browser and our servers
• Encrypted storage of sensitive data
• OAuth-based authentication (passwords are never stored by us)
• Access controls limiting which team members can access production databases
• Regular security reviews and dependency updates

No system is completely secure. While we strive to protect your information, we cannot guarantee absolute security, uninterrupted access, or that a third-party provider will never experience an incident or outage. If you believe your account has been compromised, please contact us immediately at info@getsqlmaster.com.

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Update inaccurate or incomplete information via your profile settings or by contacting us
• Deletion — Request deletion of your account and personal data by emailing info@getsqlmaster.com
• Portability — Request an export of your data in a machine-readable format
• Opt-out of marketing emails— Click "Unsubscribe" in any marketing email or update your notification preferences in account settings
• Restrict processing — In certain circumstances, request that we limit how we use your data

To exercise any of these rights, email us at info@getsqlmaster.com. We will respond within 30 days. We may need to verify your identity before processing requests.

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16 without legally valid parental authorization. If we discover that a child has provided data contrary to applicable law, we will take appropriate deletion or restriction steps. If you believe we have collected such data, please contact us at info@getsqlmaster.com.

Our service providers may process information in countries outside your own. Where required, transfers use an applicable adequacy decision, standard contract, binding corporate rules or another recognized safeguard. For transfers subject to KVKK, we apply the transfer mechanism required by Article 9 and related regulations; explicit consent is used only where legally appropriate, not as a blanket substitute for available safeguards.

Individuals protected by KVKK may apply to the data controller concerning the rights in Article 11, including learning whether data is processed, requesting information, correction or deletion where conditions are met, learning recipients, objecting to certain automated outcomes, and claiming compensation for unlawful processing. Applications may be sent using the contact methods below. We respond within the statutory period after identity verification.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete, the right to opt out of sale (we do not sell your data), and the right not to be discriminated against for exercising these rights. To submit a verified consumer request, contact us at info@getsqlmaster.com.

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including the rights to access, rectify, erase, and port your data, as well as to object to or restrict processing. Our lawful basis for processing your data is typically your consent (for optional features), contract performance (for providing the Service you subscribed to), and legitimate interests (for analytics and security). Contact us at info@getsqlmaster.com to exercise your GDPR rights.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will notify you by updating the effective date at the top of this page and, where appropriate, by email or in-app notice. Your continued use of the Service after the effective date of an updated policy constitutes your acceptance of those changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: