Privacy Policy

The controller of your personal data is [legal name, to be completed], [registered address, to be completed]. You can reach a human at support@cfaquiz.com about anything on this page.

Only what the product needs to work. There is no advertising, no profiling for marketing, and nothing is sold to anyone.

• Your account, email address, and a display name if you give one. Your password is stored only as a hash; we never see it.
• Your practice, which questions you answered, what you chose, whether it was right, how long you took, what you bookmarked. This is the product: it is what produces your progress, your review queue and your weak-topic analysis.
• Your subscription, plan, status, renewal date, and the customer identifier Stripe gives us. Card numbers are entered on Stripe's page and never reach our servers.
• Support, the messages you send us and our replies.
• Usage events, coarse in-app events (a page opened, a quiz started) and client-side errors, so we can see what breaks. No third-party analytics or advertising trackers are loaded.

When you choose a password we test it against the Have I Been Pwned breach corpus. Only the first five characters of its SHA-1 hash leave your browser, and several hundred candidate hashes come back for your device to compare locally. The password itself, and any hash that could identify it, never leave your device.

We set no advertising or analytics cookies, so there is no consent banner to click away. Your signed-in session and a few interface preferences are kept in your browser's local storage, which is what makes staying logged in possible; clearing your browser data signs you out.

These companies process data on our instructions, under a data processing agreement. Where a provider is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

Account and practice data stay while your account exists. Delete the account and they go with it, except invoices and payment records, which tax law requires us to keep for ten years, and support threads, which we keep for two years in case a dispute comes back. Usage events are kept in a form tied to your account and are removed with it.

Under the GDPR you can ask for a copy of your data, correct it, have it deleted, take it elsewhere in a portable format, restrict how we use it, or object to a particular use. Write to support@cfaquiz.com and we will answer within 30 days. You can also complain to your national data protection authority, in Italy, the Garante per la protezione dei dati personali.

Running your account and giving you what you paid for is performance of a contract. Keeping the sign-in form free of automated attacks, fixing errors, and preventing abuse is our legitimate interest. Invoice retention is a legal obligation. If we ever want to send you something that is not a service message, we will ask for consent first, separately.

CFA Quiz is for candidates preparing a professional exam and is not directed at children. Do not create an account if you are under 16.

If this notice changes in a way that affects you, we will say so by email before it takes effect. The date at the top is always the version in force.