Privacy policy

Who I am

This website (lucasrey.com) and the ESAT practice app for Android and iOS are operated by Lucas Rey. For privacy enquiries, email lucas@lucasrey.com.

What data I collect

Depending on how you use the site or the app, I may process:

  • Contact details: name, email address, and message content when you submit an enquiry form or email me directly;
  • Booking data: name, email, lesson scheduling, and related notes if you use the private student booking portal (by invitation only);
  • Timed practice data: if you start a timed paper or the diagnostic, the email address you give, which paper you sat, which option you chose on each question and whether it was right, and how long the attempt took. Reading the questions, the worked solutions and the mark schemes needs no address and collects nothing;
  • ESAT practice account, on the website or in the app: your email address; your password, kept only as a hash and never in readable form, or, if you sign in with Google, your Google account id instead; your name, if you give it; the optional profile details you choose to enter (date of birth, sex or gender, school, course, year group, the sitting you are aiming for, and a weekly goal); a profile photo, if you upload one on the website; the questions you were shown, the option you chose on each one, how long you took, and the progress and statistics worked out from them; any short note you choose to keep on a question you got wrong, and the reason you tap for it from a short fixed list (for example that you misread the question or ran out of time), which only you see, which come back to you when that idea returns for review, and which are kept on your account and deleted with it; and a record of the devices the account is used on (a random token kept as a hash, the browser or system name such as “Chrome on Windows”, and when it was last used). If you buy a pass, I also record what you bought, the payment reference and the amount;
  • Book purchase: if you buy The ESAT Move Register, the sale is made by Lemon Squeezy rather than by me. From it I receive your name, your email address, your country, and which edition you bought with the order reference and the amount. Your card details never reach me at any point;
  • Technical data: on the website, IP address, browser type, and pages visited, via analytics cookies only if you consent. The app contains no analytics and no advertising.

If you sign in with Google, Google tells me your name, your email address and your Google account id, and I keep nothing else; I use them only to create and sign in your account.

Reminders are off until you turn them on for a device. If you do, your browser or phone gives me an address that its own push service (Google, Apple, Mozilla or Microsoft) uses to deliver them, with keys that encrypt each reminder so only that device can read it. I keep that address only while reminders are on for that device, and delete it when you turn them off, sign out there, remove the device from your account, or delete your account. A reminder says only what the app already shows you: how many questions are due for review, how far you are from your weekly goal, or the day your pass ends. At most one a day, and never between 9pm and 8am.

The app talks only to lucasrey.com, over an encrypted connection. It asks for no access to your device beyond the internet connection it needs, and it does not collect your location, contacts, messages, calendar, health data, browsing history or any advertising identifier. I do not share app data with anyone.

Why I use your data

  • Respond to enquiries: teaching, research, consulting, speaking, or collaboration requests (contractual steps or legitimate interest).
  • Run the booking portal: schedule and manage lessons for invited students (contract / legitimate interest).
  • Operate the website: strictly necessary cookies and security (legitimate interest).
  • Send you your result: when you give an address to start a timed paper, I email you the marked paper. That is a message you asked for (contractual steps or legitimate interest), not marketing.
  • Improve the questions: your answers are kept so I can see which questions are working and which are not, for example how many candidates get one right and which wrong option pulls them. This is about the QUESTION rather than about you: the answers are stored separately from your address and carry no name, no email and no IP (legitimate interest).
  • Publish statistics about the ESAT: I publish which ESAT topics students find hardest, built from all students’ practice answers together. Each figure covers at least 20 students, no one is named, and nothing published can be traced back to you (legitimate interest).
  • Look after a book purchase: answer questions about it, put right a lost order page or a refund, and keep track of who holds a Tutor edition licence, which is granted to one named tutor (contractual steps and legitimate interest). I do not use a book buyer's address to market to them. Later editions reach you on your own order page rather than by email, so there is nothing you need an email from me to receive, and if you would like to hear about papers and teaching you can ask for that on the site.
  • Keep a record of each sale: I keep purchase records to meet my tax and accounting obligations (legal obligation), and when an order uses a discount code I record the code, so that I can pay commission to the partner it belongs to (legitimate interest).
  • Tell you about papers and teaching: I may occasionally email you about the papers and teaching I offer (legitimate interest). You can stop this at any time, in one click, using the link in any such email, and you do not have to give a reason.
  • The newsletter: only if you tick the box for it (consent). It is separate from everything above and stopping one does not stop the other.
  • Analytics: understand how the website is used via Google Tag Manager, only with your consent.

Running your ESAT practice account

An account, on the website or in the app, is used to sign you in, to mark your answers and show your statistics, to apply the device limit on a pass, and to protect the questions, which are unpublished and written for this site. Every question served is recorded against the account it was shown to.

A free account works on any number of devices. While a pass is live, the account keeps to four devices, so one pass is not shared.

If you ask for the free bursary pass, the proof you send is used only to check eligibility and is deleted once your pass is granted.

Your free 24 hours, and stopping repeat free trials. Each account can try the full ESAT pass free once, for 24 hours, with no payment and no card. It starts by itself the first time you open ESAT practice signed in to a free account that has not had it, and you can also start it yourself wherever it is offered. To make sure each person has it only once, when it starts I keep a scrambled code (a one-way hash) made from your device, your email address and, if you use it, your Google or Apple sign-in, together with the network address it started from and a small code stored in your browser. These codes cannot be turned back into your details, and I use them for one thing only: checking that the same person does not start the trial again with a new account. I also count trial starts by email domain, as numbers only. The legal basis is my legitimate interest in preventing abuse of a free offer. The codes are kept for as long as the free trial is offered, and never shared or used for anything else.

How long I keep data

An ESAT practice account is kept while it exists. You can delete it yourself, on the website or in the app, under Profile, Delete my account; this page explains how, including what to do if you cannot sign in. Deleting it erases at once: the login (your email address, the password hash and any Google account id), your name and profile details, the photo, the device records, every answer you gave, every free and unfinished attempt, and your newsletter subscription. If you had given the same address to sit a timed paper, emails to it stop and the record is marked so that nothing further is sent.

What is kept, and why: your contact record (name and email address) stays; email me from that address and I will remove it too, unless you have paid for a pass. If you paid for a pass, I also keep the pass itself (what you bought, the payment reference and the amount) and the attempts you finished on it, with their answers erased, so that only the dates and the counts remain. With your contact record, they are the record of a purchase and of what was delivered for it, and I keep them for as long as tax and accounting law requires me to. No answer you gave is kept in any case.

If you bought the book, I keep the order (the edition, the amount, the order reference and the email address it was bought with) while it is needed to look after the purchase and, for the Tutor edition, the licence, and then delete it. The book itself lives on your Lemon Squeezy order page rather than with me, so nothing I delete here takes the book away from you.

Whether you bought a pass or the book, I also keep a record of the sale (your name, your email address, the order reference, the product, the amount paid, any discount code used and any refund) for as long as tax and accounting law requires me to.

Timed practice records, the address and the answers, are kept while they are useful for the purposes above and are removed on request. I retain contact and booking records for as long as needed to manage the relationship and meet legal obligations. Analytics data retention follows Google’s policies when analytics cookies are enabled.

Third-party services

I use trusted providers that may process data on my behalf or as independent controllers, including:

  • Netsons (Netsons s.r.l., Italy), which hosts the website, its WordPress installation and its database, and whose mail server I use when Brevo cannot deliver a message;
  • Brevo, which sends the site's emails: account and sign-in emails, booking confirmations, results and replies to the contact form;
  • Google, for Google Tag Manager and Google Analytics, only if you consent to analytics cookies, which may involve transfers outside the UK/EEA with appropriate safeguards;
  • Google sign-in, only if you choose to sign in with Google;
  • Lemon Squeezy (sold through Link, LLC, United States), if you buy a pass or the book: Lemon Squeezy sells it to you as merchant of record. It is the seller named on your receipt and it handles the VAT, so it is a data controller in its own right and its own privacy policy governs what you give it. Your card details go to Lemon Squeezy and never reach me. It tells me your name, your email address, your country, what you bought, the order reference and the amount, and I use the email address to switch a pass on for the account with that address. Lemon Squeezy stores its data in the United States, with the safeguards its privacy policy sets out, such as standard data protection clauses;
  • Revolut, for a pass bought before 23 September 2026: you paid through Revolut's own payment page, so your card details went to Revolut and never to me; I received the payment and its reference;
  • jsDelivr, a content delivery network that serves the software which draws mathematical formulas (MathJax) to your browser, on pages that show formulas.

See my cookie policy for cookie-specific detail.

Stopping emails, and what happens to your address

There are two separate things you may be receiving, and they stop in different ways. The difference is real and I would rather set it out than let one sentence cover both.

  • The newsletter, if you ticked the box for it. Every issue carries a one-click unsubscribe link. Unsubscribing deletes your address from the newsletter list rather than keeping it on a suppression list. A consequence worth knowing: because nothing is kept, I have no record telling me not to add you again, so if you sign up a second time you will be added again.
  • Emails about papers and teaching, if you gave an address to sit a timed paper. Every such email carries a one-click link that stops them. This one suppresses rather than deletes: the row recording that you sat a paper is kept, marked so that nothing further is sent to you, because your answers are attached to it and deleting the row would delete the record of the attempt as well. If you would rather the whole record went, ask me and it will.

Your result email is neither of these. It is sent because you asked for it when you started, and there is nothing to unsubscribe from.

Your rights

Under UK GDPR you may request access, correction, erasure, restriction, objection, or portability of your personal data, and withdraw consent at any time without affecting prior lawful processing. Contact lucas@lucasrey.com.

Complaints

You may lodge a complaint with the UK Information Commissioner’s Office (ICO): ico.org.uk.

Updates

Last updated: 3 October 2026.