TestPrep

Privacy

Privacy and Cookie Policy

This policy explains how TestPrep Istanbul processes personal data through this website and its education services. We do not use a general contact form; initial enquiries may be made by WhatsApp or phone.

Last updated: October 8, 2026

1. Scope and controller

TestPrep Istanbul is the controller for the processing described here. Privacy requests may be sent to info@testprepeurope.com.

2. Data we process

  • Name, contact details and message content you provide through WhatsApp, phone or email.
  • Identity, contact, program, lesson and progress details required for accounts, purchases and education delivery.
  • Transaction and invoice references. Stripe processes card details; we do not directly store full card numbers.
  • IP address, device/browser, security and error logs. Analytics data is collected only after permission.

3. Collection, purposes and legal grounds

Data comes from your direct communications, account and payment activity, lesson use and necessary technical logs. We use it to deliver and schedule services, process payments, provide support, secure the platform and meet legal duties. Where required, marketing and non-essential analytics rely on consent. Contract performance, legal obligation, establishment of rights and balanced legitimate interests may also apply.

4. Providers and international transfers

Hosting (Vercel), database and sign-in (Supabase), Stripe, WhatsApp/Meta and, only after consent, Google Analytics may process data within their roles and terms. Stripe.js loads only when a checkout opens and uses its own cookies to prevent fraud. International transfers are subject to applicable KVKK/GDPR requirements and valid transfer mechanisms. Your use of WhatsApp is also governed by WhatsApp’s privacy terms.

5. Cookie choices

Necessary cookies support security, sessions and saved preferences. Analytics storage permission is denied by default; advertising storage permissions are denied in every case. You can change your choice at any time through the “Cookie preferences” link in the site footer, the button in this section or your account menu.

If you do not allow analytics, no analytics cookie is written to your device and no identifier that recognises you again is used; the page view is reported to Google Analytics as an anonymous signal that is not linked to your identity. Ad personalization stays off in every case.

The cookies and browser storage (sessionStorage) entries the site uses are listed below. Browser storage entries are kept only in the open tab and are deleted when the tab is closed.

Embedded content in blog posts (Spotify, YouTube, Google Maps) does not load until you allow it: a box naming the provider and a “Load content” button is shown in its place. When you allow embedded content, or press that button, the content loads directly from the provider and the provider may use its own cookies; we do not write those cookies and we do not set how long they last.

Some images in blog posts come from Pexels (images.pexels.com) and Giphy (media.giphy.com) instead: these images load with the post without waiting for your permission, and the request goes directly to the provider.

  • tp_cookie_consent (TestPrep Istanbul, cookie): stores your cookie choice (“Necessary only” or “Accept all”). Category: necessary. Duration: 180 days.
  • sb-<project-ref>-auth-token (Supabase, cookie; may be split into numbered parts for long sessions): written only when you sign in and keeps your account session. Category: necessary. Duration: 400 days; deleted when you sign out.
  • sb-<project-ref>-auth-token-code-verifier (Supabase, cookie): completes the link in sign-up confirmation and password reset emails securely. Category: necessary. Duration: deleted when the link is used, at most 400 days.
  • __stripe_mid, __stripe_sid (Stripe, cookies): written by Stripe.js only when a checkout opens, to prevent payment fraud. Category: necessary. Duration: __stripe_mid 1 year, __stripe_sid 30 minutes. Stripe may also use cookies on its own domains; see Stripe’s cookie policy.
  • _ga, _ga_9VHG9H0MHJ (Google Analytics 4, cookies): measure visits. Written only when you allow analytics cookies and deleted when you withdraw permission. Category: analytics. Duration: 2 years.
  • tp_purchase_<id> (TestPrep Istanbul, sessionStorage): prevents the same purchase from being reported to Google Analytics twice after a payment; <id> is the payment’s Stripe reference. Category: necessary. Duration: until the tab is closed.
  • exit-intent-shown (TestPrep Istanbul, sessionStorage): makes sure the exit-intent window is shown only once per session. Category: necessary. Duration: until the tab is closed.
  • qbank-<exam>-config (TestPrep Istanbul, sessionStorage): carries the topic and settings you chose in a question bank to the practice screen. Category: necessary. Duration: until the tab is closed.
  • gre-pt-start:<…> (TestPrep Istanbul, sessionStorage): lets a GRE practice test continue the same attempt when the page is reloaded. Category: necessary. Duration: until the tab is closed.
  • act-sim:<…> (TestPrep Istanbul, localStorage): keeps your answers, flags and timings in the ACT practice-test section you are working on, and your draft essay in the Writing section, in your browser, so a page reload does not lose them. Category: necessary. Duration: deleted when the section ends.
  • Spotify (Spotify, embedded content): the Spotify player in some blog posts. Category: embedded content. Duration: set by Spotify; see Spotify’s cookie policy.
  • YouTube (Google, embedded content): YouTube videos in some blog posts. Category: embedded content. Duration: set by Google; see Google’s cookie policy.
  • Google Maps (Google, embedded content): maps in some blog posts. Category: embedded content. Duration: set by Google; see Google’s cookie policy.
  • images.pexels.com (Pexels, image): images in some blog posts. When a post opens, the image loads directly from Pexels and Pexels receives that request; with its response Pexels sends the __cf_bm and _cfuvid cookies for the pexels.com domain. Category: image loaded with the page. Duration: __cf_bm 30 minutes, _cfuvid until the browser is closed; set by Pexels, see Pexels’ privacy policy.
  • media.giphy.com (Giphy, image): animated images in some blog posts. When a post opens, the image loads directly from Giphy and Giphy receives that request. Category: image loaded with the page. Duration: how long the request is kept is set by Giphy; see Giphy’s privacy policy.

6. Retention and security

We keep data only as long as needed for its purpose and applicable legal or financial duties. It is then deleted, destroyed or anonymized. We use access controls, transfer security and provider restrictions appropriate to the processing.

An account that has not been used for 90 days is deleted, together with its learning data. We email you 14 days before that happens, giving the date. Signing in, or simply using your dashboard, before that date keeps your account. Staff accounts and any account with a purchase are never deleted this way, and nothing you have paid for is ever deleted.

7. Your rights

Under KVKK Article 11 and, where applicable, GDPR, you may have rights to information, access, correction, deletion, objection and withdrawal of consent. Send a request capable of verifying your identity to info@testprepeurope.com.

8. Updates

We update this policy when services or legal requirements change. The current version and update date are published on this page.