ExameroWho we are
Examero (“Examero”, “we”, “us”) is an online GMAT® preparation service available at www.gmatexamero.com, including the course, the practice platform and related emails (together, the “Service”).
The Service is operated by Ilya Shnip, a sole proprietor registered in the Polish Central Register and Information on Economic Activity (CEIDG), NIP 1133180272, REGON 542796686, ul. Józefa Sierakowskiego 4 lok. 262, 03-712 Warsaw, Poland. He is the controller of your personal data under the EU General Data Protection Regulation (GDPR, known in Poland as RODO) and, for users in India, the Data Fiduciary under the Digital Personal Data Protection Act, 2023.
This policy explains what personal data we collect when you visit our website, create an account, study on the platform or buy a plan; why we use it; who we share it with; how long we keep it; and the rights you have. It forms part of our Terms and Conditions.
We have not appointed a Data Protection Officer, as the law does not require one for a business of our size and type. For any privacy question, write to info@gmatexamero.com.
Personal data we collect
We collect only what we need to provide and improve the Service. Most of it comes from you directly or is created as you study.
Information you give us
- Account details: your name, email address and password when you sign up. Passwords are handled by our sign-in provider, Memberstack, and stored only in hashed form — we never see them.
- Study preferences: your target score, planned test date, the days and hours you can study, and similar settings used to build your study plan.
- Messages: what you send us by email or through the support page, including attachments.
- Feedback and testimonials: reviews and comments you share with us. We publish a testimonial only with your permission.
Information created as you use the platform
- Learning activity: lessons started and completed, quiz and practice answers, time spent per question, diagnostic test and mock exam results, predicted scores and study plan progress.
- AI Tutor conversations: the questions you ask the AI Tutor and its answers (see section 4).
- Account status: your plan, trial dates, usage limits and sign-in history.
Payment information
Payments are processed by Stripe through our membership provider, Memberstack. We receive the plan, price, currency, date, billing country, payment status and a transaction reference. We never receive or store your full card number, expiry date or security code.
Technical information
When you visit the website, your browser automatically sends technical data such as your IP address, browser and device type, operating system, language, the pages you view and the site that referred you. We use your IP address to estimate your country — only to show prices in your local currency — and we do not store your precise location.
Information from advertising platforms
If you reach us through an ad on Google or Reddit, these platforms may tell us that a visit or sign-up came from a particular campaign (see section 8). We do not buy personal data from data brokers.
Please don’t share sensitive information — such as health details — in AI Tutor chats or support messages. We don’t need it to help you with the GMAT.
How we use your data and why
The table shows each purpose, the data it needs and the legal basis we rely on under the GDPR.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account; give you access to lessons, the question bank, mock exams and analytics | Account details, learning activity, account status | Performance of a contract (Art. 6(1)(b)) |
| Build and adapt your study plan, score predictions and performance reports | Study preferences, learning activity | Performance of a contract (Art. 6(1)(b)) |
| Take payments, issue invoices and keep accounting records | Payment information, account details | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Send service emails: sign-up confirmation, password resets, receipts, trial and plan notices | Account details, account status | Performance of a contract (Art. 6(1)(b)) |
| Send study reminders and occasional offers, such as discount codes | Account details, learning activity | Legitimate interests (Art. 6(1)(f)), or consent where the law requires it |
| Answer questions and handle complaints and refund requests | Messages, account details | Contract and legitimate interests (Art. 6(1)(b) and (f)) |
| Show prices in your local currency | Approximate country from your IP address | Legitimate interests (Art. 6(1)(f)) |
| Keep the Service secure and prevent fraud and abuse of free trials | Technical information, account status | Legitimate interests (Art. 6(1)(f)) |
| Improve lessons, questions and features using aggregated or de-identified statistics | Learning activity, technical information | Legitimate interests (Art. 6(1)(f)) |
| Measure how well our ads work | Technical information, advertising identifiers | Consent where required (Art. 6(1)(a)) |
| Publish testimonials | Your name or initials and your feedback | Consent (Art. 6(1)(a)) |
| Comply with the law and establish or defend legal claims | Any data relevant to the matter | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (section 10). Where we rely on consent, you can withdraw it at any time; this does not affect processing that took place before. Your account details are needed to provide the Service — without them we can’t create your account.
Your study plan, score predictions and recommendations are generated automatically from your activity. They are study aids only and do not produce legal or similarly significant effects on you.
AI features
Examero uses AI models to generate performance reports, explain mistakes and power the AI Tutor.
- What we send: your request, the GMAT question and explanation it relates to, and the relevant performance statistics, such as accuracy and timing by topic. We don’t include your name or email address.
- Who processes it: our AI model provider, [AI provider, e.g. OpenAI], acting on our behalf as a processor. Under its business terms, data sent through its API is not used to train its models.
- How long we keep it: AI Tutor conversations and generated reports are stored with your account so you can return to them, and are deleted with it. The AI provider may keep requests for a limited period only to monitor abuse.
- Accuracy: AI-generated content can contain mistakes. Treat it as study guidance, not as an official score or GMAC information.
Who we share data with
We do not sell or rent your personal data. We share it only with:
- Service providers that host, run and support the Service for us, listed below. They act as our processors under data processing agreements, may use your data only on our instructions and must keep it secure.
- Authorities, courts and professional advisers, where the law requires it or to establish or defend legal claims.
- A buyer or successor, if Examero is sold, merged or reorganised. This policy would continue to protect your data, and we would tell you in advance.
| Provider | What it does for us | Location |
|---|---|---|
| Webflow | Website hosting and content | USA |
| Memberstack | Sign-up, log-in, membership plans and checkout | USA |
| Xano | Database and back end that store your learning data and study plan | [Xano server region] |
| Stripe | Payment processing and fraud prevention | USA, EU |
| Cloudflare | Content delivery, security, and detecting your country for local-currency prices | Global network |
| [AI provider, e.g. OpenAI] | AI Tutor and AI performance reports | [region] |
| [email service] | Sending service emails and study reminders | [region] |
| [video hosting, e.g. Vimeo] | Streaming lesson videos | [region] |
| Google Fonts | Delivering the website font (your browser sends your IP address to Google when it loads) | USA, EU |
| jsDelivr | Delivering open-source code for the animated page background | Global network |
| Google Ads | Measuring ad conversions | USA, EU |
| Measuring ad conversions | USA |
Stripe also processes some payment data as an independent controller, for example to prevent fraud and meet its legal obligations, under its own privacy policy.
International data transfers
Some of the providers above process data outside the European Economic Area (EEA), mainly in the United States. When we transfer personal data outside the EEA, we make sure it is protected by:
- an adequacy decision of the European Commission, including the EU–U.S. Data Privacy Framework for providers certified under it; or
- the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.
You can ask us for more information or a copy of the relevant safeguards (section 15).
How long we keep your data
We keep personal data only as long as we need it for the purposes above or as the law requires.
| Data | How long we keep it |
|---|---|
| Account and learning data | While your account exists. If you ask us to delete your account, we do so within 30 days. Accounts with no active plan and no sign-in for 24 months are deleted or anonymised. |
| Payment and invoice records | 5 years from the end of the calendar year in which the related tax was due, as required by Polish tax law. |
| Support messages | Up to 3 years after our last exchange, in case of follow-up questions or claims. |
| Email opt-out records | As long as needed to respect your choice. |
| Technical and security logs | Up to 12 months, unless needed longer to investigate a security incident. |
| Backups | Deleted data is removed from backups as they are overwritten in the normal backup cycle. |
We may keep aggregated statistics that no longer identify you — for example, to calibrate question difficulty.
Cookies and similar technologies
Cookies are small text files that a website stores in your browser. We also use local storage and session storage, which work in a similar way. We use three kinds:
- Essential — needed to sign you in, keep your session secure and run quizzes. They don’t require consent.
- Functional — remember choices such as the currency you see prices in.
- Advertising measurement — tell us whether a visit from an ad led to a sign-up. Where the law requires consent, we use them only if you agree.
| Name | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
_ms-mid and other _ms- items | Memberstack | Keeps you signed in and secures your session | Essential | Until you log out or the session expires |
practice-session-id | Examero (local storage) | Remembers which quiz or practice session you opened | Essential | Until your next session replaces it |
__cf_bm | Cloudflare | Tells people and bots apart to protect the website | Essential | 30 minutes |
__stripe_mid__stripe_sid | Stripe | Fraud prevention during checkout | Essential | 1 year 30 minutes |
xp-geo | Examero (local storage) | Remembers your approximate country to show local-currency prices | Functional | 24 hours |
xp-currency | Examero (session storage) | Remembers the currency chosen during your visit | Functional | Until you close the tab |
_gcl_au | Google Ads | Measures ad conversions | Advertising | 90 days |
_rdt_uuid | Measures ad conversions | Advertising | 90 days |
You can block or delete cookies in your browser settings. Blocking essential cookies will stop log-in and practice sessions from working. You can also limit ad personalisation in your Google and Reddit account settings.
Emails
We send two kinds of email:
- Service emails — account confirmation, password resets, receipts and important notices about your trial, your plan or this policy. They are part of the Service, so they keep coming while you have an account.
- Study reminders and offers — for example, a nudge when you haven’t studied for a while, a reminder before your trial ends, or a discount code. Every such email has an unsubscribe link, and you can also opt out by writing to us.
Our email service may tell us whether an email was opened or a link was clicked. We use this only to make our emails more useful.
Your rights
Because Examero is operated from Poland, the GDPR applies to how we handle your data, wherever you live. You have the right to:
- Access — get a copy of your data and information about how we use it.
- Rectification — correct inaccurate or incomplete data. You can update most account details yourself in your account settings.
- Erasure — ask us to delete your data, for example by closing your account.
- Restriction — ask us to limit how we use your data while a concern is being checked.
- Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider.
- Objection — object to processing based on legitimate interests and, at any time, to direct marketing.
- Withdraw consent — at any time, without affecting processing that took place before.
- Complain — to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also contact the authority in the EU country where you live or work.
To exercise your rights, email info@gmatexamero.com from the address linked to your account. We reply within one month; for complex requests we may extend this by up to two more months and will tell you why. We may ask you to confirm your identity. Exercising your rights is free.
Users in India
If you use Examero in India, we process your digital personal data under the Digital Personal Data Protection Act, 2023 and the rules made under it. We process it for the purposes in this policy on the basis of the consent you give when you create an account, or for other uses the Act permits. You have the right to:
- obtain a summary of the personal data we process, the processing activities and the identities of those we share it with;
- have your personal data corrected, completed, updated or erased;
- withdraw your consent at any time, as easily as you gave it — we will then stop processing your data unless the law requires otherwise, though we may no longer be able to provide the Service;
- have your grievances addressed; and
- nominate another person to exercise your rights in the event of your death or incapacity.
Grievance contact: Ilya Shnip, info@gmatexamero.com. We aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Children
Examero is intended for people aged 16 and over, as set out in our Terms and Conditions. We do not knowingly collect personal data from children under 16. Where the law sets a higher age for consenting to data processing — in India, for example, this applies to everyone under 18 — you may use Examero only with the consent of your parent or legal guardian. If you believe a child has given us personal data, contact us and we will delete it.
How we protect your data
We protect your data with technical and organisational measures appropriate to the risk, including:
- encryption in transit (HTTPS/TLS) across the website and the platform;
- hashed passwords and secure session tokens managed by Memberstack;
- access to production data limited to the operator, protected by strong passwords and two-factor authentication where available;
- established providers with recognised security certifications.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the competent authority and, where required, you, without undue delay.
Changes to this policy
We may update this policy when the Service or the law changes. The “Last updated” date at the top shows when it was last revised. If we make significant changes, we will tell you by email or on the website before they take effect. Earlier versions are available on request.
Contact us
Questions about your data, or want to exercise your rights? We read every message.
Ilya Shnip (Examero)
ul. Józefa Sierakowskiego 4 lok. 262
03-712 Warsaw, Poland