Skip to content
TestPrep

Privacy

Privacy and Cookie Policy

This policy explains how TestPrep Istanbul processes personal data through this website and its education services. We do not use a general contact form; initial enquiries may be made by WhatsApp or phone.

Last updated: November 5, 2026

1. Scope and controller

TestPrep Istanbul is the controller for the processing described here. Privacy requests may be sent to info@testprepeurope.com.

2. Data we process

  • Name, contact details and message content you provide through WhatsApp, phone or email.
  • Identity, contact, program, lesson and progress details required for accounts, purchases and education delivery.
  • The leaderboard in your dashboard shows your points and place. Your name (first name and surname initial) appears only if you turn this on yourself; otherwise other students see only a number in place of your name.
  • Private group of 3–6 students: if you wish, the names and email addresses of the friends enrolling with you, written in the optional field at checkout. We use them only to place you in the same group, and students in that group see each other's names. Their phone numbers are not requested.
  • Transaction and invoice references. Stripe processes card details; we do not directly store full card numbers.
  • IP address, device/browser, security and error logs. Google Analytics visit measurements are collected after permission in the EU/EEA, the United Kingdom, Switzerland and Turkey, and by default elsewhere until you turn analytics off. Analytics data from Microsoft Clarity (clicks, scrolling and mouse movements) is collected only after permission everywhere.

3. Collection, purposes and legal grounds

Data comes from your direct communications, account and payment activity, lesson use and necessary technical logs. We use it to deliver and schedule services, process payments, provide support, secure the platform and meet legal duties. Where required, marketing and non-essential analytics rely on consent. Contract performance, legal obligation, establishment of rights and balanced legitimate interests may also apply.

Account security: to keep each account to one session at a time and to prevent account sharing and bulk copying of our content, when you sign in we record one-way hashed digests of your browser's user agent and of your network block (the first three parts of your IP address), your session identifier, the site you signed in on, and when a session was closed because of a sign-in on another of our sites or another device. A new sign-in to your account closes all your other sessions. We do not store your IP address or browser string themselves for this purpose and we do not use device fingerprinting. These records are deleted 90 days after last use. Legal basis: performance of our contract with you and our legitimate interest in keeping accounts secure.

Exam security: So that one account cannot quietly serve several students, we note an irreversible digest of your IP address and browser when you start a practice test or open the question bank (never the address in readable form) and erase it 90 days later (legal basis: our legitimate interest).

4. Providers and international transfers

Hosting (Vercel), database and sign-in (Supabase), Stripe, WhatsApp/Meta, the AI model providers we route TestPrep AI Tutor requests through (OpenAI; no payment or government-ID data is sent), Microsoft Clarity (only after consent) and Google Analytics (after consent in the EU/EEA, the United Kingdom, Switzerland and Turkey, and by default elsewhere until you turn it off) may process data within their roles and terms. Stripe.js loads only when a checkout opens and uses its own cookies to prevent fraud. International transfers are subject to applicable KVKK/GDPR requirements and valid transfer mechanisms. Your use of WhatsApp is also governed by WhatsApp’s privacy terms.

Stripe also stores the order details we send with each payment, which may include: product, amount, the subjects or dates chosen and the time the sale terms were accepted; the payer's name and email; the student's name, email and phone where the form asks for them, plus the parent's when a parent registers; a friend note for a private group of 3–6 students, if written; and your account ID if you are signed in.

When you pay for a group course, a private group of 3–6 students or private lessons, we ask whether you have a parent or guardian. About your parent, only your answer and, if you say Yes, your parent's email address travel with your payment, through Stripe, to TestPrep's main site (testprep.com.tr), which uses them only to send your parent the lesson reports. This site does not keep the address and never emails your parent. If a parent fills in the order, their name, email address and phone number appear on the receipt and the sale documents as the payer's.

AI study plan: When you finish a practice test, we send your answers (right or wrong), your topic and section results, your timing and your scores from that test to the AI model provider we use (MiniMax), to write your personal study plan. Your name, email address and payment details are not sent.

5. Cookie choices

Necessary cookies support security, sessions and saved preferences. In the EU/EEA, the United Kingdom, Switzerland and Turkey, analytics storage permission is denied until you accept; in every other country it is granted by default and you can turn it off at any time, and your refusal is remembered. Advertising storage permissions are denied in every case. You can change your choice at any time through the “Cookie preferences” link in the site footer, the button in this section or your account menu.

If you do not allow analytics, no analytics cookie is written to your device and no identifier that recognises you again is used; the page view is reported to Google Analytics as an anonymous signal that is not linked to your identity. Ad personalization stays off in every case.

Microsoft Clarity loads only when you allow analytics (“Accept all”); if you do not, it does not load at all. Clarity builds heatmaps and session recordings from clicks, scrolling and mouse movements on our pages, so we can see where the site is hard to use. Ad storage is always passed to Clarity as denied. When you withdraw your permission, Clarity is told and its cookies are deleted. Microsoft keeps session recordings for 30 days, and recordings picked as a random sample or marked by us for up to 9 months.

The cookies and browser storage (sessionStorage) entries the site uses are listed below. Browser storage entries are kept only in the open tab and are deleted when the tab is closed.

While you take an AP practice test, your answers are kept in your browser until the test ends, so that they are not lost if the page reloads; they are deleted when you hand the test in.

Embedded content in blog posts (Spotify, YouTube, Google Maps) does not load until you allow it: a box naming the provider and a “Load content” button is shown in its place. When you allow embedded content, or press that button, the content loads directly from the provider and the provider may use its own cookies; we do not write those cookies and we do not set how long they last.

Some images in blog posts come from Pexels (images.pexels.com) and Giphy (media.giphy.com) instead: these images load with the post without waiting for your permission, and the request goes directly to the provider.

  • tp_cookie_consent (TestPrep Istanbul, cookie): stores your cookie choice (“Necessary only” or “Accept all”). Category: necessary. Duration: 180 days.
  • sb-<project-ref>-auth-token (Supabase, cookie; may be split into numbered parts for long sessions): written only when you sign in and keeps your account session. Category: necessary. Duration: 400 days; deleted when you sign out.
  • sb-<project-ref>-auth-token-code-verifier (Supabase, cookie): completes the link in sign-up confirmation and password reset emails securely. Category: necessary. Duration: deleted when the link is used, at most 400 days.
  • estate_dv, estate_dv_chk (TestPrep Istanbul, cookies; not readable by the page): written only when you sign in, for the security rule that keeps an account to one session at a time; estate_dv holds a hashed marker that your session is open and the only one, estate_dv_chk that an ended session was checked once. Category: necessary. Duration: estate_dv 7 days, estate_dv_chk 15 minutes.
  • estate_dv_ended, estate_dv_notice (TestPrep Istanbul, cookies): open the one-time notice shown when your session was closed by a sign-in on another device, or when your new sign-in closed your other sessions. Category: necessary. Duration: 15 minutes; deleted once the notice is shown.
  • estate_dv_outbox:<path> (TestPrep Istanbul, localStorage): keeps answers that could not be saved because your session was closed during a test, and sends them after you sign in again. Category: necessary. Duration: deleted once sent, at most 48 hours.
  • __stripe_mid, __stripe_sid (Stripe, cookies): written by Stripe.js only when a checkout opens, to prevent payment fraud. Category: necessary. Duration: __stripe_mid 1 year, __stripe_sid 30 minutes. Stripe may also use cookies on its own domains; see Stripe’s cookie policy.
  • _ga, _ga_9VHG9H0MHJ (Google Analytics 4, cookies): measure visits. In the EU/EEA, the United Kingdom, Switzerland and Turkey written only when you allow analytics cookies; in other countries written by default until you turn analytics off. Deleted when you withdraw permission or turn analytics off. Category: analytics. Duration: 2 years.
  • _clck, _clsk (Microsoft Clarity, cookies): let us see how the site is used through heatmaps and session recordings; _clck links your later visits to the same visitor, _clsk joins the pages of one visit into one recording. Written only when you allow analytics cookies and deleted when you withdraw permission. Microsoft may also use cookies on its own domains; Microsoft sets how long they last. Category: analytics. Duration: _clck 1 year, _clsk 1 day.
  • tp_purchase_<id> (TestPrep Istanbul, sessionStorage): prevents the same purchase from being reported to Google Analytics twice after a payment; <id> is the payment’s Stripe reference. Category: necessary. Duration: until the tab is closed.
  • ai-tutor-lesson-language, ai-tutor-lesson-mode, ai-tutor-voice (TestPrep Istanbul, localStorage): keeps the lesson language, lesson style and tutor voice you chose in a TestPrep AI Tutor lesson in your browser, so the next lesson does not ask again. Category: necessary. Duration: until you clear it.
  • exit-intent-shown (TestPrep Istanbul, sessionStorage): makes sure the exit-intent window is shown only once per session. Category: necessary. Duration: until the tab is closed.
  • qbank-<exam>-config (TestPrep Istanbul, sessionStorage): carries the topic and settings you chose in a question bank to the practice screen. Category: necessary. Duration: until the tab is closed.
  • gre-pt-start:<…> (TestPrep Istanbul, sessionStorage): lets a GRE practice test continue the same attempt when the page is reloaded. Category: necessary. Duration: until the tab is closed.
  • act-sim:<…> (TestPrep Istanbul, localStorage): keeps your answers, flags and timings in the ACT practice-test section you are working on, and your draft essay in the Writing section, in your browser, so a page reload does not lose them. Category: necessary. Duration: deleted when the section ends.
  • ap-sim:<…> (TestPrep Istanbul, localStorage): keeps your answers, flags and timings in the AP practice-test part you are working on, and the free-response answers you type, in your browser, so a page reload does not lose them. Category: necessary. Duration: deleted when the part ends.
  • Spotify (Spotify, embedded content): the Spotify player in some blog posts. Category: embedded content. Duration: set by Spotify; see Spotify’s cookie policy.
  • YouTube (Google, embedded content): YouTube videos in some blog posts. Category: embedded content. Duration: set by Google; see Google’s cookie policy.
  • Google Maps (Google, embedded content): maps in some blog posts. Category: embedded content. Duration: set by Google; see Google’s cookie policy.
  • images.pexels.com (Pexels, image): images in some blog posts. When a post opens, the image loads directly from Pexels and Pexels receives that request; with its response Pexels sends the __cf_bm and _cfuvid cookies for the pexels.com domain. Category: image loaded with the page. Duration: __cf_bm 30 minutes, _cfuvid until the browser is closed; set by Pexels, see Pexels’ privacy policy.
  • media.giphy.com (Giphy, image): animated images in some blog posts. When a post opens, the image loads directly from Giphy and Giphy receives that request. Category: image loaded with the page. Duration: how long the request is kept is set by Giphy; see Giphy’s privacy policy.

6. Retention and security

We keep data only as long as needed for its purpose and applicable legal or financial duties. It is then deleted, destroyed or anonymized. We use access controls, transfer security and provider restrictions appropriate to the processing.

An account that has not been used for 90 days is deleted, together with its learning data. We send an email to your confirmed email address 14 days before that happens, giving the date. Signing in, or simply using your dashboard, before that date keeps your account. Staff accounts and any account with a purchase are never deleted this way, and nothing you have paid for is ever deleted.

For an account deleted this way, we keep a record of the deletion (the email address; the dates the account was opened, last used and deleted; the number of practice tests deleted with it) for 2 years, then erase it.

We also use this record to stop a new account opened with the same email address from getting the free trial again. Anything you buy is not affected. Our legal basis is our legitimate interest in offering the free trial once per person.

The reports your tutor writes after private lessons, the lesson and weekly summaries sent to your parent, and your part of a group course's weekly report are kept until your account is deleted, and are deleted with it. Summaries already sent by email stay in the recipient's inbox.

7. Your rights

Under KVKK Article 11 and, where applicable, GDPR, you may have rights to information, access, correction, deletion, objection and withdrawal of consent. Send a request capable of verifying your identity to info@testprepeurope.com.

8. Updates

We update this policy when services or legal requirements change. The current version and update date are published on this page.