Mindset Prep
Log in Start free trial

Legal

Privacy Policy.

Effective 3 June 2026 · Operated by Mindset Cyber Pty Ltd (Australia)

Who we are

Mindset Prep is an ISO certification exam-prep app provided by Mindset Cyber Pty Ltd, an Australian company (ABN 55 668 364 261). We can be reached at hello@mindsetprep.com.au.

What we collect

  • Account. Your email address when you sign up. We use passwordless magic-link sign-in (and optional Google or Apple OAuth), so we never see or store a password.
  • Profile. Your display name (optional), time zone, locale, chosen target exam, target exam date, and the answers to the onboarding archetype questionnaire that personalises the experience.
  • Study activity. Question attempts, card reviews, time spent, mock exam results, and a mistake bank built from your wrong answers. This is used to compute your Readiness Score, schedule spaced-repetition reviews, and surface weak topics.
  • Device. A push-notification token if you grant permission, your IANA time zone so reminders fire at your local hour, and basic app-version metadata.
  • Billing. Your subscription status. On the web app this comes from Stripe, and your payment-card data is held by Stripe and never touches our servers. In our iOS and Android apps, in-app purchases are processed by Apple or Google and we receive only the resulting entitlement status (via RevenueCat) - we never see your card.
  • Product analytics. Inside the app we use PostHog to record which screens you visit and which buttons you tap (for example, viewing the trial paywall or finishing a mock exam), linked to your user ID once you sign in. We do not record your screen on mobile, and exam questions and your answers are never captured.
  • AI interactions. The prompts and responses from features like the Tutor and Coach are logged so we can monitor cost, refine quality, and back-trace any unusual output. They are linked to your user ID and the question or session they relate to.
  • Ad attribution. If you arrive from a Google Ads click or any campaign link with UTM tags, we store the click identifier (gclid for Google, msclkid reserved for Bing) and any UTM parameters in a first-party cookie scoped to mindsetprep.com.au. When you sign up, that record is written to your account so we can attribute the conversion back to the campaign that brought you in and so paid-search bidding can optimise. It is never used to build a profile of you, and the only third party we share it with is Google Ads itself - and only as a conversion callback tied to the click id you arrived with, never your identity.

How we use it

  • To run the service: schedule reviews, compute readiness, send reminders.
  • To improve the product: aggregate statistics on what learners find hardest.
  • To prevent abuse: rate-limit AI features and detect account-sharing patterns.
  • To bill you: pass subscription state between Stripe and your account.

We do not sell your personal information. We do not share identifiable data with advertisers or data brokers, and we run no cross-site tracking. The only advertising-related data we send to a third party is the one-way conversion callback to Google Ads described above - no email, no name, just the click identifier you arrived with. Inside the app we use PostHog for product analytics - which screens you visit and which buttons you tap - so we can see where the study flow is confusing and fix it; we do not record your screen on mobile, and exam content is never captured. The public marketing site additionally uses Google Analytics and Microsoft Clarity to understand which pages visitors land on, which links they click, and which sections need clearer copy. Details below.

Who we share it with

  • Supabase (managed Postgres + auth) hosts your account and study data.
  • Stripe processes web payments and stores your card details.
  • Apple and Google process in-app purchases made through their app stores, and RevenueCat relays the resulting subscription entitlement to us. We never receive your card details for in-app purchases.
  • PostHog receives the in-app product-analytics events described above (screens visited, buttons tapped), linked to your user ID. Exam content and your answers are never sent to PostHog.
  • OpenRouter (and the upstream model providers it routes to, currently Anthropic, OpenAI, and Google) processes the prompts we send for Tutor and Coach features. These providers do not train on Mindset Prep traffic.
  • Resend sends transactional email (sign-in links, billing notices, reminders).
  • Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS) deliver push notifications.
  • Cloudflare hosts this marketing site and provides Turnstile bot-protection on the contact form.
  • Google Analytics (GA4) measures aggregate page views, traffic sources, and conversion events on the public marketing site only. IP addresses are anonymised before they reach Google. GA4 does not run inside the Mindset Prep app.
  • Microsoft Clarity records anonymised session interactions (clicks, scrolls, heatmaps) on the public marketing site only, so we can see where copy is unclear and improve it. Clarity does not run inside the Mindset Prep app.
  • Google Ads receives conversion-attribution events (trial started, trial converted) tagged with the click identifier you arrived with, so bidding can optimise for the campaigns that bring in real users. The events do not include your email, name, or any other direct identifier - only the pseudo-anonymous click id, a GA4 client id, and the converted value where applicable.

We may also disclose information when required by Australian law or to protect the safety of our users.

Where it's stored

User data is stored in Supabase's US-East region. Australian customers' data crosses borders to the US and is held there under standard cloud-provider safeguards. If you require data residency in Australia, contact us before subscribing.

How long we keep it

We keep your account data while your account is active. If you delete your account from Settings, we delete your auth record, profile, study history, mistake bank, AI logs, and subscription record. Some anonymised, aggregate-only telemetry may remain. Billing records are kept for seven years to meet Australian tax law.

Your rights

  • Access. Email us and we will provide a copy of the personal information we hold about you.
  • Delete. Settings → Account → Delete account inside the app, at any time. Deleting your account removes your data from our systems but does not by itself stop an Apple or Google subscription - if you bought through an app store, also cancel that subscription in your iPhone Settings → Apple ID → Subscriptions (or Google Play) so you are not billed again.
  • Correct. Email us if anything is wrong.
  • Complain. Australian users can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Cookies

On the public marketing site we set:

  • Cloudflare Turnstile cookies on the contact form (bot-protection).
  • Google Analytics (GA4) cookies for aggregated traffic measurement. IPs are anonymised. No remarketing cookies.
  • Mindset Prep attribution cookie (mp_attribution) - a first-party cookie set only if you arrive from an ad click or tagged campaign URL, capturing the gclid and any UTM parameters so we can attribute your eventual signup back to the campaign. 90-day lifetime, scoped to mindsetprep.com.au, cleared after signup.
  • Microsoft Clarity cookies for anonymised session and heatmap recording on the marketing site only.

If your browser sends a "Do Not Track" signal, GA4 and Clarity do not initialise. You can also block these cookies through your browser settings without affecting access to the site. Inside the Mindset Prep app we set a Supabase authentication session cookie, a short-lived onboarding cookie, and a PostHog product-analytics cookie that links your in-app events to your account. No advertising cookies, no cross-site tracking, anywhere.

Children

Mindset Prep is intended for adults studying for professional certification exams. We do not knowingly collect data from anyone under 16.

Security

All traffic uses HTTPS. Authentication is handled by Supabase Auth (magic-link plus optional Google or Apple OAuth) - we do not store passwords. Our service-role Supabase key is held only on our server and never shipped to the browser or the mobile app.

Changes to this policy

We will post any material changes here with a new effective date and notify active users by email.

Contact

Mindset Cyber Pty Ltd
hello@mindsetprep.com.au
Or via our contact form.