Privacy Policy
Last updated: 24 September 2026
Controller: CIPLYIO SRL, a company registered in Romania with the Trade Registry under no. J2026046950008, fiscal code (CUI) 55319024, EUID ROONRC.J2026046950008 ("we"). Contact: support@ciply.io. We collect the minimum needed to sell and deliver study materials.
What we collect and why
- Account data (email, name if provided) — to operate your account and deliver purchases. Legal basis: contract.
- Purchase and entitlement records (what you bought, when, your access period, and the time you first accessed each product — the fact our Refund Policy turns on) — to provide access and support, apply the refund policy, and for our legal bookkeeping. Legal basis: contract, legal obligation. Payment details are handled by Link (Sold through Link, LLC), a Stripe company, as merchant of record; we never see your card number.
- Proof of access — the first time you open a product you bought (your first practice session or your first PDF download), we record your IP address, your browser's user-agent, what you opened and when. We keep one such record per product. It lets us show that a product was delivered and used if a payment or refund is disputed. Legal basis: legitimate interest (defending legal claims).
- Content watermarking — every copy of purchased content we deliver (question banks, PDFs) embeds an identifier linked to your account, so that leaked copies can be traced to their source. This is disclosed in the Terms as well. Legal basis: legitimate interest — protecting our content and our honest customers against unlawful redistribution.
- Email subscriptions — only when you explicitly ask to be notified. Legal basis: consent; unsubscribe any time.
- Course launch emails. We send an email when a new ciply.io course launches. Courses include practice exams on ciply.io and video courses we publish on Udemy. We store your address, when and where on the site you signed up, the exam of the page you signed up on (if any), the exact wording you agreed to, and when you confirmed. You confirm by clicking a link we email you, unless you sign up with your own signed-in account email, which is already verified. We note the exam of the page so that we can later tell which launches are most relevant to you. It does not change what you signed up for.
- Exam-change alerts and "notify me" requests (address, topic) — only the emails you asked for.
- Abuse protection on sign-up forms — to stop automated misuse, we keep a one-way code made from your IP address. It changes every day, so it can't be linked to you from one day to the next, and we never store the IP address itself. Legal basis: legitimate interest.
- Usage analytics — via Plausible, which is cookieless and does not track you across sites; we see aggregate page and event counts, not persistent personal profiles. Legal basis: legitimate interest.
- Ratings and reviews — if you choose to rate a pack you bought, we store your star rating, any text you write, and a shortened form of your name (for example "John S.") to show beside it. Only verified purchasers can rate, and we read written reviews before they appear. We do not store anything about how you scored. You can edit or withdraw yours at any time, and it is deleted with your account. Legal basis: consent.
- Practice progress — your attempt history is stored locally in your browser (IndexedDB), not on our servers, in the current version.
Cookies
We use only strictly-necessary cookies (authentication/session, set by Clerk). Our analytics (Plausible) uses no cookies. There is no advertising or cross-site tracking on ciply.io — which is why you don't see a cookie banner.
Processors
| Service | Purpose | Region |
|---|---|---|
| Clerk | Authentication (account, email, sign-in) | USA (SCCs) |
| Database hosting | Purchases, entitlements, ratings, email subscriptions | EU — Frankfurt |
| Link (Sold through Link, LLC) | Merchant of record (payment, billing, tax, receipts) | USA (SCCs) |
| Vercel | Hosting and content delivery | EU functions (Frankfurt) |
| Plausible | Privacy-friendly, cookieless analytics | EU |
| Resend | Transactional emails, and the course launch emails you ask for | USA (SCCs) |
Retention & deletion
Delete your account at any time from your account menu: your identity data is erased at our authentication provider, our user record is marked deleted, and everything you contributed — your email subscriptions, your ratings and reviews, and any exam requests you voted for — is removed. Purchase records are retained as required for tax and accounting law. Notification subscriptions are deleted on unsubscribe. A course launch sign-up that is not confirmed within 14 days is deleted. We delete the IP address and user-agent from a proof-of-access record 12 months after it is made. What you opened and when stays with your purchase records, also after you delete your account, because it is part of the record of the sale.
Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority (in Romania: ANSPDCP). Write to support@ciply.io and we'll act on it.