Privacy Policy

This policy covers the personal data we process when you use drivingtest.irish — when you create an account, practise, take mock exams, buy Pro, or contact us.

drivingtest.irish is responsible for ("controls") that data and decides how it is used. If you have any question about this policy or your data, contact us at [email protected].

We collect only what we need to run the service:

• Account data: your name, email address and chosen interface language.
• Learning data: your practice answers, mock-exam attempts and scores, bookmarks, streaks and progress statistics.
• Payment data: which plan you bought and whether the payment succeeded. If you turn on automatic renewal, we also keep references to your subscription and customer record at Stripe (never your card details); Stripe keeps your payment method so it can charge each renewal. Your card number is entered directly on our payment provider's systems and is never seen or stored by us. If you allowed analytics, the payment record also holds your Google Analytics browser and visit IDs — they travel with the payment so the purchase can be credited to your visit — and if you allowed advertising, a copy of the Google cookies your browser sent when you started the checkout, which we delete as soon as the purchase has been reported (see "How long we keep your data").
• Cancellation data: if you cancel a purchase, the name and email address you enter, which purchase you cancelled, when you sent the cancellation and what we refunded. With each purchase we also record when you asked at checkout for your Pro to start straight away.
• Support data: the messages and details you send us when you ask for help or request a refund.
• Technical data: IP address, browser and device type, approximate region, and basic activity logs, used to keep accounts secure and prevent abuse. This includes two short device codes ("dt_fp", "dt_dc", see the Cookie Policy) calculated from your browser and device settings and stored with your account, plus a simplified form of your email address (for example ignoring dots and any "+" suffix). We use these three only to protect the Service — to apply the one-free-trial-per-person rule and to detect repeat or bulk sign-ups — and never for advertising, profiling, or tracking you across other websites.
• Diagnostics data: if something breaks on your device — for example a question image fails to load — we record a short technical report (the affected question, your browser and device type, screen size and connection type) so we can find and fix the problem. Reports you send us through the "suggest a fix" form also include your browser type. Diagnostics data is deleted automatically after 30 days.
• Analytics data, if you allow it: Google Analytics collects usage statistics (the pages you visit and what you do on them, device and browser type, approximate region) and, while you are signed in, your account ID — an internal code, not your name or email address — so that visits from your different devices can be linked to your account.
• Session recordings, if you allow them: Microsoft Clarity records what our pages show you and how you use them — clicks, taps, scrolling, mouse movement and the page content around them — as recordings and heatmaps. What you type into form fields, numbers and email addresses are hidden; other text on the page, such as your name, is recorded.
• Advertising data, if you allow it: Google Ads receives the fact that you signed up, started a free trial, started a checkout or bought a plan (with its price), with the ad click ID if you came from one of our Google ads. We also note how you first found the site (the campaign details and ad click ID in the link, the referring website and the first page you opened) and save that with your account if you create one.
• Measurement without cookies, whatever you choose: the Google tag sends Google limited information without cookies — the page you view, the referring website, your browser and device type, your IP address (used to estimate your region), and actions such as signing up, starting a checkout or finishing a mock exam with its score. If you buy a plan without having allowed analytics, we still report the purchase to Google Analytics with its plan, price and our payment reference, but with no account ID and no browser identifier. See the Cookie Policy.
• Your cookie choice: which of the three choices you allowed, when, and under which version of these texts. We keep that record because we have to be able to show that we asked (GDPR Article 7(1)); it is tied to a random code in your consent cookie, and to your account if you were signed in at the time.

If you sign in with Google or Apple, we receive only your name and email address from that account (with Apple, this can be a private relay address if you choose to hide your email).

Under the GDPR we rely on:

• Performance of a contract — to create and run your account and provide practice, exams and progress tracking.
• Legitimate interests — to keep the service secure, prevent fraud and abuse (including the device codes described in the Cookie Policy), fix problems, improve the product, and to measure without cookies how the site and our ads perform where you have not allowed analytics or advertising — always in a way that does not override your rights. You can object to processing based on legitimate interests: write to [email protected].
• Legal obligation — to handle a cancellation (confirming it to you and refunding you) and to keep records of payments and cancellations for tax, accounting and consumer-law purposes.
• Consent — for analytics, session recordings and advertising measurement, each of which you allow separately in the cookie banner or on the Cookie Policy page, and for example optional emails. You can withdraw consent at any time with the same switches, as easily as you gave it, without affecting processing already carried out.

We use your data to: create and secure your account; provide practice, mock exams and progress tracking; remember your language and settings; process your Pro purchase and handle cancellations and refunds; answer your support requests; detect and prevent fraud, abuse and technical problems; understand how the site is used and which of our ads bring sign-ups and purchases; and meet our legal obligations.

Some abuse checks run automatically. When you register, we compare the device codes and the simplified form of your email address against recent sign-ups to work out whether the free trial has already been claimed by the same person. This decides one thing only — whether that account receives the free trial. It never blocks your account, never restricts the rest of the Service, and you can ask us to look at it again at [email protected].

We do not sell or rent your personal data, and we do not share it with third parties for their own marketing, with one exception that is your own choice: if you allow session recordings or advertising measurement, Google and Microsoft may also use the data their tools collect on our site for their own purposes, including personalised advertising, under their own policies (policies.google.com/technologies/partner-sites and privacy.microsoft.com/privacystatement). We do not make decisions with legal effects about you by purely automated means.

We share data only with the service providers that help us run drivingtest.irish, and only as far as each one needs it. Hetzner, Resend and Google Analytics act only on our instructions, under contracts that require them to protect your data. Stripe, Revolut, Cloudflare, YouTube, the sign-in and push providers, Google Ads and Microsoft Clarity also decide some uses of the data themselves, as their own policies describe — that is noted below:

• Hosting and database — our servers and database are hosted in the European Union (Hetzner, Germany).
• Site delivery and security — Cloudflare carries all traffic to and from the site and protects it from attacks. On the email sign-up and sign-in forms, Cloudflare Turnstile checks that you are a person, not a bot; Cloudflare also uses these checks to improve its own bot detection.
• Payments — Stripe and Revolut process card payments and handle the card data we never see; they also use payment data for their own fraud prevention and to meet their legal obligations. If you allowed analytics, a Stripe payment also carries your Google Analytics browser and visit IDs, so the purchase can be linked to your visit.
• Sign-in — Google or Apple, only if you choose to sign in with that account.
• Email delivery — Resend sends transactional emails such as password resets.
• Notifications — if you turn on push reminders, your browser's push service (for example Google, Apple or Mozilla) delivers them; the message content is encrypted.
• Embedded videos — YouTube (Google) plays the videos on our pages; only when you press play does your browser connect to YouTube, which then receives your IP address and technical data about your device and decides some uses of that data itself under Google's privacy policy.
• Analytics — only if you allow it: Google Analytics (Google Ireland Ltd) processes usage statistics for us. Without that permission it still receives the cookieless signals and the anonymous purchase and refund reports described above.
• Session recordings — only if you allow them: Microsoft Clarity (Microsoft Ireland Operations Ltd) records how our pages are used. Microsoft also uses that data for its own purposes, including advertising.
• Advertising measurement — if you allow it, Google Ads (Google Ireland Ltd) receives sign-up, free-trial, checkout and purchase events — with the ad click ID, if you came from one of our ads — and may also use them for its own purposes, including personalised advertising. Without that permission, sign-up, free-trial and checkout events may still reach Google Ads, but with no cookie and nothing stored on your device, and purchases are not reported to it at all.

We may also disclose data if the law requires it, to enforce our Terms, or to protect the rights, safety and security of our users or the service. If the service is ever transferred to a new owner, data may transfer with it under this policy.

Our hosting and database are in the European Union. Some providers may process limited data outside the European Economic Area — for example Cloudflare, our payment, sign-in and email providers, and Google and Microsoft, which transfer data from their Irish companies to Google LLC and Microsoft Corporation in the United States. Where that happens, we rely on appropriate safeguards: an EU adequacy decision for the destination country where one applies (for the United States, the EU–US Data Privacy Framework, for providers certified under it), and otherwise the European Commission's Standard Contractual Clauses. Write to [email protected] if you would like a copy of the safeguards for a particular provider.

We keep your account and learning data for as long as your account is active. You can delete your account at any time from Settings; when you do, we erase your personal data within 30 days, except where we are required to keep some of it longer.

We keep records of payments and cancellations — without your account email, or the name and email address you gave when cancelling, which are removed when you delete your account — for as long as tax, accounting and consumer-protection law requires (generally up to 6 years).

The security data stored with your account — the two device codes, the IP address you registered from, and the simplified form of your email address — is kept for as long as your account exists and is erased when you delete it. Other security and abuse logs are kept for a short period and then deleted.

Measurement data: how you first found the site, if saved with your account, is erased when you delete your account. The copy of your Google cookies kept with a payment is deleted as soon as the purchase has been reported, or after 30 days at the latest; the Google Analytics browser and visit IDs that travelled with the payment stay in the payment record, and at Stripe, for as long as payment records are kept. Google Analytics keeps the details of individual visits and actions for 2 months, and data linked to your cookies or account ID for 14 months — a period that starts again each time you come back; summary statistics that do not identify you are kept longer. Microsoft Clarity keeps recordings for 30 days, and heatmaps, favourites and a random sample of recordings for up to 9 months. Deleting your account does not delete what Google or Microsoft have already received; data they use for their own purposes is kept under their own policies.

The record of your cookie choice is kept while that choice can still be relied on and for a year afterwards, so we can show what was agreed and when.

Diagnostics data (technical error reports such as failed image loads, and the browser details attached to feedback) is deleted or anonymised automatically after at most 30 days.

We take reasonable technical and organisational measures to protect your data: traffic is encrypted in transit with HTTPS, passwords are stored only as salted one-way hashes (never in readable form), payment-card data is handled by certified payment providers and never touches our servers, and access to our systems is restricted and logged.

No online service can be guaranteed completely secure, but we work to detect, contain and respond to security problems, and we will notify you and the relevant authority of a personal-data breach where the law requires it.

Under the GDPR you have the right to: be informed about how your data is used; access a copy of your data; have inaccurate data corrected; have your data erased; restrict or object to certain processing; data portability; and withdraw consent where processing is based on it.

To exercise any of these rights, email [email protected]. We will respond within one month. Using your rights is free, and we will never penalise you for it.

If you believe we have not handled your data properly, you have the right to complain to the Irish Data Protection Commission (www.dataprotection.ie), or to the data-protection authority in your own EU country.

We use essential cookies that are necessary for the site to work — to keep you signed in, remember your language, store your cookie choice and protect the service from abuse. Three further things are off until you allow them, each separately: analytics (Google Analytics), session recordings (Microsoft Clarity) and advertising measurement (Google Ads, together with a cookie that remembers how you found us). The site works fully if you allow none of them. Even then, the Google tag sends limited information without cookies. Full details, and the switches to change your choice, are in our Cookie Policy.

drivingtest.irish is intended for people preparing for the driver theory test and is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time — for example if we add a feature or change a provider. When we make a material change we will update the "last updated" date below and, where appropriate, tell you. If a change affects something you consented to, we ask you again rather than rely on the answer you gave before. Continued use of the service after an update means you accept the revised policy.

For any privacy question, or to exercise your rights, contact us at [email protected].