Privacy policy

Proficiam provides diagnostic, readiness-estimate, study-result logging, weekly review, and flexible study-planning tools for finance certification candidates.

This policy explains how Proficiam collects, uses, shares, retains, and protects personal data when you use our website, diagnostic, account, subscription, billing, support, and paid platform features.

The controller of your personal data is the company identified in the 'Who you are contracting with' block at the top of this page. 'Proficiam' is a trading name of that company.

For privacy questions, rights requests, account deletion requests, or data export requests, contact contact@proficiam.com.

Account and identity data: name, email address, password hash, email verification state, authentication state, notification preferences, account lifecycle state, and support communications.

Diagnostic data: exam level, exam timing, available study hours, study style, finance-industry experience, self-assessed readiness, topic confidence, difficult topics, historical attempts, stated outcomes, and selected reasons for mistakes.

You can run the diagnostic without an account. If you do, we store your answers and the resulting readiness output against a random session identifier rather than your identity, together with a claim token that lets you attach the result to an account later. We do not ask for your name or email to run it, and we do not use these answers for advertising. Before your answers are submitted we show you this notice in short form and ask you to confirm you are 18 or over; we record the time of that confirmation. An unclaimed diagnostic session is deleted automatically 30 days after it is created. If you create an account and claim the session, it becomes part of your account data and follows the account retention rules below.

Study data: topic-readiness estimates, study actions, completion data, minutes logged, quality ratings, accuracy and confidence, missed-plan data, external source labels and references, practice and mock results, reasons for mistakes, weekly review reflections, goals, and readiness estimates.

Billing data: selected plan, subscription status, pending plan state, Stripe customer identifiers, checkout session identifiers, billing portal events, invoices, charge status, and limited payment metadata. Payment card numbers and full payment credentials are handled by Stripe and are not stored by Proficiam.

Technical and security data: IP address, approximate location inferred from IP, browser and device details, request logs, cookie identifiers, CSRF tokens, security events, error logs, rate-limit data, and operational telemetry needed to run, secure, debug, and protect the service.

Optional content: feedback, survey answers, support messages, testimonials, or other information you choose to provide. Do not submit official exam questions, proprietary prep-provider content, sensitive financial account information, health data, government identifiers, or other unnecessary sensitive information.

We collect data directly from you when you create an account, complete a diagnostic, log a study result, complete weekly reviews, contact support, or manage billing.

We generate data from your use of Proficiam, including readiness scores, topic-readiness estimates, overall estimates, plan adjustments, summaries of what your results show, and security logs.

We receive limited billing and subscription data from Stripe, and may receive technical, analytics, delivery, or security data from infrastructure, email, analytics, monitoring, and support providers.

To create, authenticate, operate, secure, and support your account.

To provide diagnostics, topic-readiness views, study plans, weekly reviews, readiness estimates, explanations of your results, plan adjustments, and subscription features.

To process subscriptions, reconcile Stripe billing events, prevent duplicate subscriptions, provide billing portal access, handle refunds or chargebacks, and maintain tax and accounting records.

To send service communications such as verification emails, password reset messages, billing notices, security notices, product changes, and review reminders.

To monitor reliability, debug errors, measure product performance, prevent abuse, enforce our terms, protect users and Proficiam, and improve the service.

To send optional product, educational, or marketing communications where permitted. You can opt out of non-essential emails.

Contract: to provide the account, diagnostic, study, subscription, and support services you request.

Legitimate interests: to secure the platform, prevent misuse, debug and improve reliability, understand product performance, maintain business records, develop the service, communicate with users, and protect legal rights, provided those interests are not overridden by your rights and freedoms.

Consent: for optional marketing, testimonials, non-essential cookies, or other processing where consent is required.

Legal obligation: where we need to keep records, respond to lawful requests, or comply with tax, accounting, consumer, or payment obligations.

We use strictly necessary cookies and browser storage for authentication, CSRF protection, session security, saving an in-progress diagnostic, and checkout continuity. These do not require consent because the service you asked for cannot work without them.

The only non-essential technology we use is Google Analytics 4, for aggregate product measurement. It is switched off by default. No analytics script is loaded and no analytics request leaves your browser unless you turn analytics on in our cookie banner or cookie settings. You can change or withdraw that choice at any time using the 'Cookie settings' link in the footer, and withdrawing is as easy as giving consent.

Our Cookie Policy lists every cookie and browser-storage item we use, its provider, its purpose, and how long it lasts.

Blocking strictly necessary cookies may prevent login, checkout, dashboard access, billing management, CSRF protection, or account management from working correctly.

Where required by applicable law, we will respect legally recognized opt-out preference signals for sale, sharing, or targeted advertising if we engage in those activities.

We share personal data with service providers only where needed to operate, secure, improve, support, or bill for Proficiam. The providers we currently use are: Vercel (website hosting and content delivery), Google Cloud Platform (application hosting), Neon (managed PostgreSQL database), Stripe (payment processing, subscription billing, and the billing portal), Resend (transactional email such as verification, password reset, and billing notices), and Google Analytics 4 (aggregate product analytics, loaded only with your consent). We also use professional advisers where necessary.

If we add or replace a provider that processes personal data, we will update this list.

Service providers must process data under appropriate confidentiality, security, and data-processing obligations. Some providers, including payment processors, may also process limited data as independent controllers for fraud prevention, compliance, security, and legal obligations.

We may disclose data if required by law, to protect users or the service, to investigate abuse, or as part of a merger, acquisition, financing, or sale of assets.

Proficiam and its providers may process personal data in countries outside your country, including the United Kingdom, the European Economic Area, the United States, and other locations where our providers operate.

Where required, we rely on legally recognized transfer mechanisms and safeguards, such as adequacy regulations or decisions, the UK International Data Transfer Agreement or UK Addendum, the European Commission Standard Contractual Clauses, transfer risk assessments, and supplementary technical and organizational measures.

Payment processing, infrastructure, analytics, and email providers may maintain their own regional processing and transfer controls, which may be described in their own privacy terms.

Account data is retained while your account remains active and for a reasonable period after closure where needed for security, legal, tax, billing, or dispute-resolution purposes.

Diagnostic and study activity data is retained to provide your study history and readiness updates, unless you request deletion and we are not required to keep it.

Security logs, rate-limit data, operational logs, and backups are retained for limited periods based on reliability, fraud-prevention, abuse-prevention, incident-response, and backup needs.

Billing, transaction, refund, tax, accounting, fraud-prevention, and chargeback records may be retained longer where required or appropriate for legal compliance, audits, disputes, or legitimate business records.

When data is no longer needed, we delete, anonymize, aggregate, or securely isolate it in accordance with our retention practices and legal obligations.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent, or export your personal data.

You do not have to email us to exercise the main rights: your account settings include a self-service data export, which returns your account, diagnostic, study-result, and review data in a machine-readable file, and a self-service account deletion, which deletes your account and the personal data linked to it. Deletion also anonymises the consent records we keep for legal proof, so they no longer identify you.

You can also request account deletion, an export, or any other rights request by contacting contact@proficiam.com. We may need to verify your identity before fulfilling a request, and we will respond within one month unless the law allows an extension, which we would tell you about.

Some requests may be limited or refused where data is needed for security, fraud prevention, legal compliance, billing records, dispute handling, protection of others, freedom of expression, establishment or defence of legal claims, or other lawful reasons.

You may unsubscribe from non-essential emails through the email footer or by contacting support. You may still receive transactional, security, account, and billing notices.

If UK GDPR, EU GDPR, Swiss data protection law, or similar law applies, you may have rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

You may also have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office. In the EEA or Switzerland, you may contact your local data protection authority.

Proficiam's readiness scores, estimates, and plan recommendations are educational planning aids. They are not used to make legal, financial, employment, credit, insurance, or similarly significant decisions about you.

If a US state privacy law applies to Proficiam and to your data, you may have additional rights to know, access, correct, delete, obtain a portable copy, opt out of certain targeted advertising, opt out of sale or sharing, limit certain uses of sensitive personal information, and appeal a denied request.

Proficiam does not sell personal information for money. Proficiam does not currently share personal information for cross-context behavioural advertising as those terms are commonly used under California privacy law. If that changes, we will provide required notices and opt-out controls.

We do not knowingly sell or share personal information of consumers under 16. We do not offer financial incentives in exchange for personal information unless clearly described at the time of offer.

Categories of personal information we may collect include identifiers, commercial information, internet or network activity, approximate geolocation from IP, professional or educational information you provide, inferences from diagnostic and study activity, and sensitive account login credentials used only to secure your account.

Proficiam uses diagnostic answers and study results to generate readiness scores, topic-readiness estimates, overall estimates, and study recommendations.

These outputs are educational planning aids based on the information available. They are not guarantees of exam performance.

We use technical and organizational safeguards such as hashed passwords, secure cookies, CSRF protection, access controls, rate limiting, logging, encrypted transport, provider security controls, and operational monitoring.

No online service is perfectly secure. Please use a strong password, keep credentials confidential, and contact us promptly if you suspect unauthorized access.

If a personal data breach occurs, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the breach is likely to result in a risk to your rights and freedoms, and we will notify you without undue delay where the risk to you is high.

Proficiam is not directed to children and is intended for adults who are old enough to enter into a subscription contract in their jurisdiction. We do not knowingly collect personal data from children under 16 or any higher age that may apply where you live.

We may update this policy as the service, providers, or legal requirements change. Material changes will be posted on this page or communicated through the service where appropriate.

If a change requires consent under applicable law, we will seek that consent.