Privacy policy

Who I am

This website (lucasrey.com) and the ESAT practice app for Android and iOS are operated by Lucas Rey. For privacy enquiries, email lucas@lucasrey.com.

What data I collect

Depending on how you use the site or the app, I may process:

  • Contact details: name, email address, and message content when you submit an enquiry form or email me directly;
  • Booking data: name, email, lesson scheduling, and related notes if you use the private student booking portal (by invitation only) or book a mock interview on this site;
  • Timed practice data: if you start a timed paper or the diagnostic, the email address you give, which paper you sat, which option you chose on each question and whether it was right, and how long the attempt took. Reading the questions, the worked solutions and the mark schemes needs no address and collects nothing;
  • ESAT practice account, on the website or in the app: your email address; your password, kept only as a hash and never in readable form, or, if you sign in with Google, your Google account id instead; your name, if you give it; the optional profile details you choose to enter (date of birth, sex or gender, school, course, year group, the sitting you are aiming for, and a weekly goal); a profile photo, if you upload one on the website; the questions you were shown, the option you chose on each one, how long you took, and the progress and statistics worked out from them; any short note you choose to keep on a question you got wrong, and the reason you tap for it from a short fixed list (for example that you misread the question or ran out of time), which only you see, which come back to you when that idea returns for review, and which are kept on your account and deleted with it; and a record of the devices the account is used on (a random token kept as a hash, the browser or system name such as “Chrome on Windows”, and when it was last used). If you buy a pass, I also record what you bought, the payment reference and the amount;
  • Book purchase: if you buy The ESAT Move Register, the sale is made by Lemon Squeezy rather than by me. From it I receive your name, your email address, your country, and which edition you bought with the order reference and the amount. Your card details never reach me at any point;
  • Technical data: on the website, IP address, browser type, and pages visited, via analytics cookies only if you consent. The app contains no analytics and no advertising.

If you sign in with Google, Google tells me your name, your email address and your Google account id, and I keep nothing else; I use them only to create and sign in your account.

Reminders are off until you turn them on for a device. If you do, your browser or phone gives me an address that its own push service (Google, Apple, Mozilla or Microsoft) uses to deliver them, with keys that encrypt each reminder so only that device can read it. I keep that address only while reminders are on for that device, and delete it when you turn them off, sign out there, remove the device from your account, or delete your account. A reminder says only what the app already shows you: how many questions are due for review, how far you are from your weekly goal, or the day your pass ends. At most one a day, and never between 9pm and 8am.

The app talks only to lucasrey.com, over an encrypted connection. It asks for no access to your device beyond the internet connection it needs, and it does not collect your location, contacts, messages, calendar, health data, browsing history or any advertising identifier. I do not share app data with anyone.

Why I use your data

  • Respond to enquiries: teaching, research, consulting, speaking, or collaboration requests (contractual steps or legitimate interest).
  • Run the booking portal: schedule and manage lessons for invited students, and mock interviews booked on this site (contract / legitimate interest).
  • Operate the website: strictly necessary cookies and security (legitimate interest).
  • Send you your result: when you give an address to start a timed paper, I email you the marked paper. That is a message you asked for (contractual steps or legitimate interest), not marketing.
  • Improve the questions: your answers are kept so I can see which questions are working and which are not, for example how many candidates get one right and which wrong option pulls them. This is about the QUESTION rather than about you: the answers are stored separately from your address and carry no name, no email and no IP (legitimate interest). We use anonymised, aggregated usage, with small groups suppressed, to improve the questions and the product.
  • Tune how review is scheduled: to tune how review is scheduled, I fit a model to students’ answer sequences under a pseudonym, on my own computer, with no name or email; the file is deleted after the fit, and only the model’s settings are kept (legitimate interest).
  • Learn which pages bring students: when you create an ESAT practice account, I note which page of this site you came from, for example the diagnostic or a guide, or, if you followed one of my own links on another site, that link's short name, for example mintnib. It is kept with your account as a short name. I use it only in counts across at least 10 accounts, to see which pages and links help students start practising, and never to look at one person (legitimate interest, my own analytics). It is deleted with your account.
  • Publish statistics about the ESAT: I publish which ESAT topics students find hardest, built from all students’ practice answers together. Each figure covers at least 20 students, no one is named, and nothing published can be traced back to you (legitimate interest).
  • Learn from how students practise: I learn from how the practice questions, the app and my own lessons are used, only in aggregate. Names and contact details play no part: they are removed from lesson notes before analysis, and the practice data is counted without them. I only ever look at counts across several students, never at one person (legitimate interest).
  • Look after a book purchase: answer questions about it, put right a lost order page or a refund, and keep track of who holds a Tutor edition licence, which is granted to one named tutor (contractual steps and legitimate interest). I do not use a book buyer's address to market to them. Each later edition is part of your purchase: I email it to you when it is ready, until you tell me you would rather stop, and it is on your own order page too. If you would like to hear about papers and teaching, you can ask for that on the site.
  • Passes for state-school students: when a teacher asks for passes, I keep the school's name, the teacher's work email address, how many passes were asked for and the codes sent, to send the codes and to keep an honest count of what was given (legitimate interest). The teacher is asked nothing about any student. When a student opens a pass with a code, their pass records which code opened it, as any pass records how it was paid for. The request records are deleted two years after the request.
  • Keep a record of each sale: I keep purchase records to meet my tax and accounting obligations (legal obligation), and when an order uses a discount code I record the code, so that I can pay commission to the partner it belongs to (legitimate interest). A copy of each email the site sends you about a purchase (the book's welcome, and a pass's opening email without its sign-in button) is kept in my own mailbox, so that I can answer a question about it (legitimate interest).
  • Tell you about papers and teaching: I may occasionally email you about the papers and teaching I offer (legitimate interest). You can stop this at any time, in one click, using the link in any such email, and you do not have to give a reason.
  • The newsletter: only if you tick the box for it (consent). It is separate from everything above and stopping one does not stop the other.
  • Analytics: understand how the website is used via Google Tag Manager, only with your consent.

Running your ESAT practice account

An account, on the website or in the app, is used to sign you in, to mark your answers and show your statistics, to apply the device limit on a pass, and to protect the questions, which are unpublished and written for this site. Every question served is recorded against the account it was shown to.

I, Lucas Rey, run lucasrey.com and tutor on it, and I can see your practice results to support you: each attempt, question by question, with the answer you chose, whether it was right and how long it took. They are not shared with anyone outside lucasrey.com.

A free account works on any number of devices. While a pass is live, the account keeps to four devices, so one pass is not shared.

If you ask for the free bursary pass, the proof you send is used only to check eligibility and is deleted once your pass is granted.

Your free trial, and stopping repeat free trials. Each account can try the full ESAT pass free once, for the length shown in your account when it starts, with no payment and no card. It starts by itself the first time you open ESAT practice signed in to a free account that has not had it, and you can also start it yourself wherever it is offered. To make sure each person has it only once, when it starts I keep a scrambled code (a one-way hash) made from your device, your email address and, if you use it, your Google or Apple sign-in, together with the network address it started from and a small code stored in your browser. These codes cannot be turned back into your details, and I use them for one thing only: checking that the same person does not start the trial again with a new account. I also count trial starts by email domain, as numbers only. The legal basis is my legitimate interest in preventing abuse of a free offer. The codes are kept for as long as the free trial is offered, and never shared or used for anything else.

Usage figures, only if you agree. The ESAT practice app and the web pass may ask once whether you would like to help improve them by sharing which screens and buttons you use. Nothing is collected unless you say yes, and you can change your answer at any time in Profile. If you say yes, the app keeps a short note of your session on your device: which screens you opened and roughly how long you stayed on each, which named buttons you pressed, taps that reached no button, repeated quick taps on the same place, and any error messages shown. It sends that note at the end of the session (and every ten minutes in a long one), then forgets it. It never includes your answers, anything you type, where on the screen you tap, or anything about your device. On my server each note is only added into daily totals, such as how many times a screen was opened that day, together with the app version and the platform; the totals carry no name, email, account, device or IP address, and no time finer than the day. Daily totals are deleted after 400 days. Saying no later stops collection straight away, but it cannot remove totals already added, because nothing in them identifies you. Any figure I look at is shown only where at least 10 students or sessions are counted, and my own and test accounts are never counted (your consent).

Refer a friend. If a friend you invited buys their first pass with the code they were given, I keep a one-way, keyed fingerprint of the email address that paid, and of the friend’s account email, so each email can count once. Your invite link records that your friend’s account came from you, and your friend’s account holds their personal discount code, created in my store (Lemon Squeezy), until it expires. When they buy, the free week added to your pass is recorded against their order. I cannot turn a fingerprint back into an address. Each is deleted after two years. I do not keep any IP address or device information for this (legitimate interest).

How long I keep data

An ESAT practice account is kept while it exists. You can delete it yourself, on the website or in the app, under Profile, Delete my account; this page explains how, including what to do if you cannot sign in. Deleting it erases at once: the login (your email address, the password hash and any Google account id), your name and profile details, the photo, the device records, every answer you gave, every free and unfinished attempt, and your newsletter subscription. If you had given the same address to sit a timed paper, emails to it stop and the record is marked so that nothing further is sent.

What is kept, and why: your contact record (name and email address) stays; email me from that address and I will remove it too, unless you have paid for a pass. If you paid for a pass, I also keep the pass itself (what you bought, the payment reference and the amount) and the attempts you finished on it, with their answers erased, so that only the dates and the counts remain. With your contact record, they are the record of a purchase and of what was delivered for it, and I keep them for as long as tax and accounting law requires me to. No answer you gave is kept in any case.

If you bought the book, I keep the order (the edition, the amount, the order reference and the email address it was bought with) while it is needed to look after the purchase and, for the Tutor edition, the licence, and then delete it. The book itself lives on your Lemon Squeezy order page rather than with me, so nothing I delete here takes the book away from you.

Whether you bought a pass or the book, I also keep a record of the sale (your name, your email address, the order reference, the product, the amount paid, any discount code used and any refund) for as long as tax and accounting law requires me to.

Timed practice records, the address and the answers, are kept while they are useful for the purposes above and are removed on request. I retain contact and booking records for as long as needed to manage the relationship and meet legal obligations. Analytics data retention follows Google’s policies when analytics cookies are enabled.

Teaching notes from lessons. If you book lessons with me directly, I may keep notes from them about the teaching itself: the topics covered, the mistakes that came up and the explanations that helped. Before a note is kept, I remove names, contact details, any health or special educational needs details and anything else that could identify anyone. I keep these notes for up to three years and use them only in my own internal tools, to improve my teaching materials and to train my own internal models (legitimate interest). The notes and those models are never shared or published, and never used to identify anyone. I retrain the models regularly, so notes past the three-year limit are removed from them as well. Notes I write myself about lessons booked through an agency are included on the same terms: names are removed first by a script on my own computer, they are kept for up to three years, they are used only in aggregate, and nothing from them is used in anything sent to that agency's clients.

Third-party services

I use trusted providers that may process data on my behalf or as independent controllers, including:

  • Netsons (Netsons s.r.l., Italy), which hosts the website, its WordPress installation and its database, and whose mail server I use when Brevo cannot deliver a message;
  • Brevo, which sends the site's emails: account and sign-in emails, booking confirmations, results and replies to the contact form;
  • Google, for Google Tag Manager and Google Analytics cookies, only if you consent to them, which may involve transfers outside the UK/EEA with appropriate safeguards. With that consent, a checkout and a purchase are also reported to Google Analytics through my own server, linked to your visit by the analytics id and never to your name or email address; my server keeps that id beside the checkout for no more than seven days. Separately, and whatever your choice, my server sends Google Analytics plain counts of passes started and ended, checkouts opened and purchases made, with the amount, the exam and the product: each under its own random id, linked to nobody, with no cookie and nothing read from your browser, and never with a name, an email address or an account;
  • Google sign-in, only if you choose to sign in with Google;
  • Lemon Squeezy (sold through Link, LLC, United States), if you buy a pass or the book: Lemon Squeezy sells it to you as merchant of record. It is the seller named on your receipt and it handles the VAT, so it is a data controller in its own right and its own privacy policy governs what you give it. Your card details go to Lemon Squeezy and never reach me. It tells me your name, your email address, your country, what you bought, the order reference and the amount, and I use the email address to switch a pass on for the account with that address. Lemon Squeezy stores its data in the United States, with the safeguards its privacy policy sets out, such as standard data protection clauses;
  • Revolut, for a pass bought before 23 September 2026: you paid through Revolut's own payment page, so your card details went to Revolut and never to me; I received the payment and its reference;
  • jsDelivr, a content delivery network that serves the software which draws mathematical formulas (MathJax) to your browser, on pages that show formulas.

See my cookie policy for cookie-specific detail.

Stopping emails, and what happens to your address

There are two separate things you may be receiving, and they stop in different ways. The difference is real and I would rather set it out than let one sentence cover both.

  • The newsletter, if you ticked the box for it. Every issue carries a one-click unsubscribe link. Unsubscribing deletes your address from the newsletter list rather than keeping it on a suppression list. A consequence worth knowing: because nothing is kept, I have no record telling me not to add you again, so if you sign up a second time you will be added again.
  • Emails about papers and teaching, if you gave an address to sit a timed paper. Every such email carries a one-click link that stops them. This one suppresses rather than deletes: the row recording that you sat a paper is kept, marked so that nothing further is sent to you, because your answers are attached to it and deleting the row would delete the record of the attempt as well. If you would rather the whole record went, ask me and it will.

Your result email is neither of these. It is sent because you asked for it when you started, and there is nothing to unsubscribe from.

Your rights

Under UK GDPR you may request access, correction, erasure, restriction, objection, or portability of your personal data, and withdraw consent at any time without affecting prior lawful processing. Contact lucas@lucasrey.com.

Complaints

You may lodge a complaint with the UK Information Commissioner’s Office (ICO): ico.org.uk.

Updates

Last updated: 17 October 2026.