Privacy Policy
What personal data we hold about you, why we hold it, who sees it, and what you can ask us to do with it.
Last updated: 23 October 2026
Who is responsible
EDUSTRIM LTD, registered number 17375480, of 15a Durants Park Avenue, Enfield, EN3 7ED, United Kingdom, is the data controller for personal data described here.
Contact for data protection matters: contact@edustrim.com
What we collect
When you register: email address, and, if you give them, first name, last name and phone number.
When you buy: billing address including city, region, postcode and country. Card details go directly to our payment provider and never reach us.
When you use the service: your simulated trades, the rationales you write, course progress and exercise answers, sign-in count and last sign-in time, the last day you used the service, which days you used it during your first four weeks, and the type of device you use — phone, tablet or desktop only, with no device fingerprinting.
When we email you: whether a message was delivered and whether you opened it. When we decide not to send you a marketing email, we record which email it was, when, and why — for example, that you had not opted in. That record does not include your email address.
How you reached us: If you arrive from one of our Google or Meta ads and accept advertising measurement, we record the click identifier the ad adds to the link, and for a Meta ad your browser and device type as your browser reports it. We tell Google the click identifier and the time you confirmed your account. We tell Meta the click identifier, the time you signed up or paid, your browser and device type and, for a payment, its amount and currency. We send nothing else: no name, email address, phone number or IP address. We delete these 100 days after you signed up, or straight away if you refuse measurement later, using "Cookie settings". The basis is your consent.
Why, and on what basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Providing your account and the service | Registration details, trades, progress | Performance of a contract |
| Taking payment and issuing receipts | Billing details, purchase records | Performance of a contract |
| Service emails — verification, receipts, password reset | Email address | Performance of a contract |
| Marketing emails | Email address, name | Consent, which you can withdraw at any time |
| Recording why a marketing email was not sent | Which email, when, and the reason | Legitimate interests: keeping our email system working correctly, and being able to show that we send marketing email only to people who opted in |
| Measuring which of our ads lead to sign-ups and payments | The ad's click identifier; for a Meta ad, your browser and device type | Consent, which you can withdraw at any time |
| Keeping records for accounting and tax | Purchase records | Legal obligation |
| Improving the platform | Aggregated usage, device type | Legitimate interests |
| Preventing abuse and fraud | Account and usage data | Legitimate interests |
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
Marketing
We only send marketing email if you have opted in. Service emails — account verification, receipts, password resets — are sent regardless, because they are necessary to provide what you asked for.
You can withdraw consent at any time, from the account area or the unsubscribe link in any marketing email. Withdrawal takes effect immediately.
Who we share it with
- Stripe — to process payments
- Resend — to send email
- Google — only if you accept advertising measurement, and only the ad's click identifier, to count which of our ads led to sign-ups
- Meta — only if you accept advertising measurement: the ad's click identifier, your browser and device type, and the time and amount of a sign-up or payment, to count which of our ads led to them
- Vercel, and Supabase (hosted in Ireland) — to run the service
- Professional advisers and authorities — where legally required
We do not sell your personal data. What goes to advertising companies, Google and Meta, is described above under "How you reached us", and only with your consent.
How long we keep it
Account data for as long as your account exists, and 12 months after closure. Purchase records for six years to meet accounting requirements — after account deletion, these are detached from your identity rather than deleted. Marketing consent records for as long as needed to show consent was given. Records of marketing emails we decided not to send, for 90 days. Ad click identifiers, and the browser and device type kept with a Meta click, for 100 days after you signed up, or until you refuse advertising measurement.
Your rights
Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. You may also withdraw consent where consent is the basis.
Where the table above gives legitimate interests as the basis, you can object to that processing at any time by writing to contact@edustrim.com. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.
You can export your data and request deletion from the account area. For anything else, contact contact@edustrim.com. We respond within one month.
If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.
Security
Data is encrypted in transit and at rest. Access is limited to those who need it. Card details never touch our systems.
Children
The service is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has registered, contact us and we will delete the account.