Privacy Policy

This Privacy Policy explains what personal data CampusGate collects when you use our IMAT mock exam platform, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Turkish Data Protection Law (KVKK).

1. Data controller

The data controller is CampusGate, operating from Türkiye. For privacy enquiries contact [email protected].

2. Data we collect

Category	Examples	Lawful basis
Account data	Email, name, password (hashed)	Contract
Exam performance	Answers, time spent, score, behavioral analytics	Contract
Payment data	Processed by Stripe; we receive only metadata (last 4 digits, country)	Contract
Technical data	IP address, user agent, device, log files	Legitimate interest (security)
Cookie data	Session cookie, preferences, optional analytics	Consent (analytics) / Contract (session)

3. How we use your data

• To provide the mock exam service and AI-coach feedback
• To process payments via Stripe
• To prevent fraud, abuse, and security incidents
• To send transactional emails (purchase confirmation, password reset)
• To improve our question bank and platform reliability (aggregated analytics only)

4. Data sharing

We share data only with these processors:

• Stripe (payments) — under their privacy policy
• Cloudflare (CDN, security) — for IP and request log routing
• OpenAI / Anthropic (AI-coach feedback) — anonymized exam performance only; no personally identifying data is sent

We do not sell personal data. We do not share data with advertisers.

5. Data retention

• Account data: while account is active + 12 months
• Exam results: 24 months after exam date (for score-prediction calibration)
• Payment metadata: 10 years (Turkish tax law requirement)
• Server logs: 90 days

6. Your rights (GDPR / KVKK)

You have the right to access, rectify, erase, restrict processing, port your data, and object to processing. To exercise any right, email [email protected]. We respond within 30 days.

If you are an EU resident and believe we have not handled your request properly, you may complain to your national data protection authority. If you are in Türkiye, you may complain to the Personal Data Protection Authority (KVKK).

7. International transfers

Our servers are located in Türkiye and at Cloudflare's global edge. Data may be transferred outside the EEA when you use the platform. Such transfers rely on Standard Contractual Clauses or equivalent safeguards.

8. Cookies

We use:

• Strictly necessary cookies (session, CSRF) — required for the platform to function
• Functional cookies (language preference) — improve your experience
• We do not currently use third-party advertising or tracking cookies

9. Children

The platform is intended for users aged 16 and over. We do not knowingly collect data from anyone under 16. Contact us if you believe we have data on a minor.

10. Changes

We will update the "Last updated" date and post material changes on the homepage. Continued use of the platform after changes implies acceptance.