Privacy

This is a practice tool for Red Seal exam preparation — anonymous by default. We built it so you don't have to hand over personal information to use it — and this page tells you exactly what does and doesn't happen when you do.

1. What we collect

From you directly

• An optional username and passphrase — if you want your progress to follow you across devices. No name or phone number is ever required or accepted. The passphrase is stored only as a one-way hash; we cannot read it.
• Optionally, a verified email — for passwordless sign-in. Instead of a passphrase, you can choose to sign in with a one-time link sent to your email. If you do, we store that email on your account so the link can sign you in and your progress can follow you across devices. This is entirely optional — username + passphrase still works, and you never need an email to practise. We never sell or share it, and you can delete your account (and the email) yourself at any time (Section 7).
• Practice progress — which questions you've answered, per-topic accuracy, mock-exam scores.
• Optional question ratings (1–5 stars) and a short answer to one engagement question ("what would help you feel confident about passing your exam?"). These are anonymous.

Your email — only if you choose to give it

You can optionally leave your email to hear from us when there's something genuinely worth your attention for your Red Seal — a new feature, something for your trade, or anything that helps you pass. This is entirely your choice: you never need an email to practise, and giving one unlocks nothing extra. If you opt in, we store your email, your trade (if known), and the time you consented. We never sell or share it; we only email about Red Seal–related updates; and every email has a one-click unsubscribe — or write to info@questionbankhub.com to be removed at any time.

Automatically — analytics (only if you consent)

If you click "Yes, help improve it" on the consent bar, two third-party tools load:

• Google Analytics 4 — anonymous usage events: screens visited, buttons tapped, mock exams started and completed. IP addresses are anonymised. No personal identity is passed to Google.
• Microsoft Clarity — heatmaps and session recordings showing where people tap and how they move through the app. Anything you type — including your username and passphrase fields — is automatically masked and never recorded. For example: if a button doesn't work or a screen layout confuses people, this is how we'd spot it.

If you click "No thanks," neither tool loads. Nothing from Google or Microsoft runs.

First-party usage log (always on)

We keep a small server-side log of usage signals — things like "a mock exam was started" or "consent choice recorded." Before you create an account these are tied only to an internal visitor id, never to a name or email. If you do create an account, activity recorded while you are signed in is linked to that account, because that is what makes your progress, your results and your unlock work at all. We use it to understand how the app is used in aggregate, and it involves no third-party cookie.

What we never do with it: sell it, share it with advertisers, or build a profile of you for anyone else.

Emails we send you

If you give us an email address, our email provider records when a message is delivered and whether it was opened (a small invisible image in the message). We use it for one thing: to tell whether an email was worth sending. We deliberately do not track link clicks — that would rewrite every link in the message to pass through a tracking redirect, and we would rather the link you see be the link you get. Every email carries a one-tap unsubscribe.

Payment information — only if you buy an unlock

If you purchase a trade unlock, payment is handled by Stripe. You enter your card details directly on Stripe's hosted checkout — QBH never receives or stores your full card number. From the transaction we receive a confirmation that you paid, the amount, the trade you unlocked, and a Stripe customer/charge reference; if you provide an email or billing name at checkout, Stripe processes it to send your receipt and prevent fraud. We use this only to grant your unlock, provide receipts and refunds, and keep records.

2. Why we collect it

• To improve the app — understand which topics are hardest, where the flow breaks, what to build next.
• To understand how apprentices study — so the tool gets better for everyone working toward their Red Seal.
• Not for ads. Not sold. Not shared with anyone except the service providers listed in Section 4 — the optional analytics tools and the infrastructure that runs the app (hosting, database, email) — strictly to operate the service.

3. Consent and how to withdraw it

Analytics are opt-in. Nothing loads until you say yes. You can change or withdraw your choice at any time:

• "Cookie settings" on the site — tap the Cookie settings link in the footer of any page to reopen the consent bar and change or withdraw your choice. If you withdraw after previously accepting, the page reloads so the analytics tools stop right away.
• Clear the consent cookie — open your browser's site data settings, clear storage for this site, and reload. The consent bar will reappear.
• Browser controls — block third-party cookies or use a content blocker (e.g. uBlock Origin). Clarity and GA4 will not load even if you previously accepted.

Withdrawing consent does not affect your practice progress, which is stored separately under your account.

4. Third-party processors

Google and Microsoft load only with your analytics consent. Vercel, Neon, and Resend are infrastructure needed to run the app and your account — Vercel always (it serves the site), Neon only if you create an account, Resend only if you opt in to email. We do not use any advertising networks, social-media pixels, or data brokers.

5. International data transfers

Google and Microsoft operate servers primarily in the United States. When you accept analytics, data is transferred to and processed in the US. Under Quebec Law 25 and PIPEDA (Canada's federal privacy law), we are required to tell you this. Google and Microsoft participate in the EU–US Data Privacy Framework for transfers from the European Economic Area.

Our infrastructure providers — Vercel (hosting), Neon (database), and Resend (email) — also operate primarily in the United States, so the app, your account data (if you create one), and any email you opt into are processed in the US.

Payments (Stripe). If you make a purchase, your payment information is processed by Stripe, primarily in the United States. Before relying on Stripe, we conducted an assessment of this cross-border transfer as required under Quebec Law 25, and we rely on Stripe's contractual safeguards.

6. How long data is kept

7. Your rights

Under PIPEDA and Quebec Law 25 (Law 25), you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Withdraw consent for analytics at any time (see Section 3).
• Delete your account and data — do it yourself anytime via the Delete account button in your account (we ask you to confirm; it can't be undone), or email us. This erases your account, your progress, and your email from every mailing list we keep. The one exception is the purchase record described in Section 6, which Canadian tax law requires us to retain.

EU/EEA visitors also have rights under the GDPR: data portability, erasure, restriction of processing, and the right to lodge a complaint with a supervisory authority.

Automated processing in payments. To prevent fraud, our payment processor (Stripe Radar) may use automated processing to assess the risk of a transaction. If a decision affecting you is made solely by automated means, you may contact us to request information about it and to ask that it be reviewed by a person.

To exercise any of these rights, email info@questionbankhub.com. We respond within 30 days.

8. Cookies and tracking technologies used

9. Contact

Privacy questions or requests: info@questionbankhub.com

This service is operated by Barron Systems Engineering Inc. (operating as Question Bank Hub), a Canadian corporation. We operate from Canada and follow PIPEDA and Quebec Law 25.

10. Who's responsible & breach response

Person in charge (Privacy Officer). The person accountable for QBH's handling of personal information is our Privacy Officer, reachable at info@questionbankhub.com (subject: "Privacy").

Breach response. We maintain a process to detect and respond to security incidents. If a breach of security safeguards creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada (and, for Quebec residents, to the Commission d'accès à l'information), notify you, and keep a record of the breach as required.