Privacy policy

Who I am

This website (lucasrey.com) and the ESAT practice app for Android and iOS are operated by Lucas Rey. For privacy enquiries, email lucas@lucasrey.com.

From 28 October 2026 the ESAT and TMUA practice accounts, and the passes on them, are run from mintnib.com, by me, the same controller. Mintnib’s privacy notice alone describes and governs them, on either site and in the app. This policy covers everything else on lucasrey.com.

What data I collect

Depending on how you use the site or the app, I may process:

  • Contact details: name, email address, and message content when you submit an enquiry form or email me directly;
  • Booking data: name, email, lesson scheduling, and related notes if you use the private student booking portal (by invitation only) or book a mock interview on this site;
  • Timed practice data: if you start a timed paper or the diagnostic, the email address you give, which paper you sat, which option you chose on each question and whether it was right, and how long the attempt took. Reading the questions, the worked solutions and the mark schemes needs no address and collects nothing;
  • Practice account: what an ESAT or TMUA practice account holds, on either site or in the app, is set out in Mintnib’s privacy notice, which governs it;
  • Book purchase: if you buy The ESAT Move Register, the sale is made by Lemon Squeezy rather than by me. From it I receive your name, your email address, your country, and which edition you bought with the order reference and the amount. Your card details never reach me at any point;
  • Technical data: on the website, IP address, browser type, and pages visited, via analytics cookies only if you consent. The app contains no analytics and no advertising.

The app talks only to my own servers, lucasrey.com and mintnib.com, over an encrypted connection. It asks for no access to your device beyond the internet connection it needs, and it does not collect your location, contacts, messages, calendar, health data, browsing history or any advertising identifier. I do not share app data with anyone.

Why I use your data

  • Respond to enquiries: teaching, research, consulting, speaking, or collaboration requests (contractual steps or legitimate interest).
  • Run the booking portal: schedule and manage lessons for invited students, and mock interviews booked on this site (contract / legitimate interest).
  • Count portal visits: how many times invited students open the booking portal each week, so I can see whether it is useful and improve it (legitimate interest). Each visit is counted on my server under a code worked out from your account and the week, which names nobody, changes every week and cannot be turned back into your name without my server's secret key. Only weekly totals are ever read, with any figure under 5 hidden, and the counts are deleted after 13 weeks. Nothing is stored in your browser for this.
  • Send feedback: if you use the Send feedback button in the booking portal, I receive your message, the time, the name of the page you sent it from and the device and browser details your browser reports, with a note of which student record it belongs to, so that I can reply or fix what you report (legitimate interest). Your booking link, IP address and email are not stored with it. Messages are kept for up to 365 days and are deleted with the rest of your data if you ask me to erase it.
  • Questions before the first lesson: the booking portal may ask a few questions before our first lesson, such as your school year, your subjects, what you would like help with, any important dates and, for students under 18, the name and email of a parent or guardian to copy into lesson arrangements. Only your school year and subjects, and what you would like help with, are needed. I use your answers to plan our lessons (legitimate interest). They are kept with your student record, seen only by me, and deleted two years (730 days) after you last change them, or sooner if you ask me to erase your data. Please leave out health details; we can talk about anything like that on a call.
  • Operate the website: strictly necessary cookies and security (legitimate interest).
  • Send you your result: when you give an address to start a timed paper, I email you the marked paper. That is a message you asked for (contractual steps or legitimate interest), not marketing.
  • Improve the questions: your answers are kept so I can see which questions are working and which are not, for example how many candidates get one right and which wrong option pulls them. This is about the QUESTION rather than about you: the answers are stored separately from your address and carry no name, no email and no IP (legitimate interest). We use anonymised, aggregated usage, with small groups suppressed, to improve the questions and the product.
  • Learn from how students practise: I learn from how the practice questions, the app and my own lessons are used, only in aggregate. Names and contact details play no part: they are removed from lesson notes before analysis, and the practice data is counted without them. I only ever look at counts across several students, never at one person (legitimate interest).
  • Look after a book purchase: answer questions about it, put right a lost order page or a refund, and keep track of who holds a Tutor edition licence, which is granted to one named tutor (contractual steps and legitimate interest). I do not use a book buyer's address to market to them. Each later edition is part of your purchase: I email it to you when it is ready, until you tell me you would rather stop, and it is on your own order page too. If you would like to hear about papers and teaching, you can ask for that on the site.
  • Passes for state-school students: when a teacher asks for passes, I keep the school's name, the teacher's work email address, how many passes were asked for and the codes sent, to send the codes and to keep an honest count of what was given (legitimate interest). The teacher is asked nothing about any student. When a student opens a pass with a code, their pass records which code opened it, as any pass records how it was paid for. The request records are deleted two years after the request.
  • Keep a record of each sale: I keep purchase records to meet my tax and accounting obligations (legal obligation), and when an order uses a discount code I record the code, so that I can pay commission to the partner it belongs to (legitimate interest). A copy of each email the site sends you about a purchase (the book's welcome, and a pass's opening email without its sign-in button) is kept in my own mailbox, so that I can answer a question about it (legitimate interest).
  • Ask for a review: when lessons with me end or pause, the site may reply once in our most recent email conversation, to the people already in it, asking you to leave a review on Trustpilot. It then reads the emails Trustpilot sends me about new reviews, and matches each to a student by name or email address, so that I can note whether a review came and how many stars it gave (legitimate interest). It is asked once and never again.
  • The newsletter: only if you tick the box for it (consent). It is separate from everything above and stopping one does not stop the other.
  • News of the book, courses and mentorship: only for people who tick "Send me news of the book, courses and one-to-one mentorship" (consent). What it sends: an email announcing The ESAT Move Register and my courses, followed by four weekly emails, and occasional news after that, which may include my one-to-one project mentorship. If you ticked the earlier box, "Send me news of the book and courses", you get no mentorship news unless you tick the new one. A tick on the newsletter or timed-paper form here counts only once you confirm it from a single email I send you; a tick that is never confirmed is deleted after 30 days. A tick in your ESAT practice account counts at once. I record the choice, the wording you agreed to, where it was made and when, and keep a yes until you stop or ask me to erase it (with a practice account, it also goes when the account does). The news emails themselves go out only between 8am and 9pm in your own time zone (UK time if I do not know it), and every one of them has a one-click stop; the single confirming email is sent when you ask for it and carries no stop link, because nothing follows unless you confirm. Giving an address for a timed paper, or joining the newsletter, does not on its own sign you up to it.
  • Analytics: understand how the website is used via Google Tag Manager, only with your consent.

Practice accounts

How a practice account is used, what is seen of your results, the device limit, the free premium access, usage figures, reminders and refer a friend are set out in Mintnib’s privacy notice.

If you ask for the free bursary pass, the proof you send is used only to check eligibility, and it is deleted once it has been checked, granted or not, and leaves my mailbox within 30 days.

How long I keep data

How long a practice account is kept, what deleting it erases and what is kept after are set out in Mintnib’s privacy notice. You can delete it yourself, on either site or in the app, under Profile, Delete my account; this page explains how, including what to do if you cannot sign in.

If you bought the book, I keep the order (the edition, the amount, the order reference and the email address it was bought with) while it is needed to look after the purchase and, for the Tutor edition, the licence, and then delete it. The book itself lives on your Lemon Squeezy order page rather than with me, so nothing I delete here takes the book away from you.

Whether you bought a pass or the book, I also keep a record of the sale (your name, your email address, the order reference, the product, the amount paid, any discount code used and any refund) for as long as tax and accounting law requires me to.

Timed practice records, the address and the answers, are kept while they are useful for the purposes above and are removed on request. I retain contact and booking records for as long as needed to manage the relationship and meet legal obligations. Analytics data retention follows Google’s policies when analytics cookies are enabled.

Teaching notes from lessons. If you book lessons with me directly, I may keep notes from them about the teaching itself: the topics covered, the mistakes that came up and the explanations that helped. Before a note is kept, I remove names, contact details, any health or special educational needs details and anything else that could identify anyone. I keep these notes for up to three years and use them only in my own internal tools, to improve my teaching materials and to train my own internal models (legitimate interest). The notes and those models are never shared or published, and never used to identify anyone. I retrain the models regularly, so notes past the three-year limit are removed from them as well. Notes I write myself about lessons booked through an agency are included on the same terms: names are removed first by a script on my own computer, they are kept for up to three years, they are used only in aggregate, and nothing from them is used in anything sent to that agency's clients.

Third-party services

I use trusted providers that may process data on my behalf or as independent controllers, including:

  • Netsons (Netsons s.r.l., Italy), which hosts the website, its WordPress installation and its database, and whose mail server I use when Brevo cannot deliver a message;
  • Brevo, which sends the site's emails: account and sign-in emails, booking confirmations, results and replies to the contact form;
  • Google, for Google Tag Manager and Google Analytics cookies, only if you consent to them, which may involve transfers outside the UK/EEA with appropriate safeguards. With that consent, a checkout and a purchase are also reported to Google Analytics through my own server, linked to your visit by the analytics id and never to your name or email address; my server keeps that id beside the checkout for no more than seven days. Separately, and whatever your choice, my server sends Google Analytics plain counts of passes started and ended, checkouts opened and purchases made, with the amount, the exam and the product: each under its own random id, linked to nobody, with no cookie and nothing read from your browser, and never with a name, an email address or an account;
  • Google sign-in and Sign in with Apple, only if you choose to sign in with Google or with Apple. If you sign in with Apple and choose to hide your email address, the emails I send you pass through Apple’s private relay;
  • Google, whose Gmail service holds the mailbox I use for lucas@lucasrey.com: the emails you exchange with me are kept there, and the review request above reads our email conversation there and replies in it;
  • Trustpilot, if you choose to leave a review: what you give Trustpilot is governed by its own privacy policy, and it emails me when a new review is posted;
  • Lemon Squeezy (sold through Link, LLC, United States), if you buy a pass or the book: Lemon Squeezy sells it to you as merchant of record. It is the seller named on your receipt and it handles the VAT, so it is a data controller in its own right and its own privacy policy governs what you give it. Your card details go to Lemon Squeezy and never reach me. It tells me your name, your email address, your country, what you bought, the order reference and the amount, and I use the email address to switch a pass on for the account with that address. Lemon Squeezy stores its data in the United States, with the safeguards its privacy policy sets out, such as standard data protection clauses;
  • Revolut, for a pass bought before 23 September 2026: you paid through Revolut's own payment page, so your card details went to Revolut and never to me; I received the payment and its reference;
  • jsDelivr, a content delivery network that serves the software which draws mathematical formulas (MathJax) to your browser, on pages that show formulas.

See my cookie policy for cookie-specific detail.

Stopping emails, and what happens to your address

There are two separate things you may be receiving, and they stop in different ways. The difference is real and I would rather set it out than let one sentence cover both.

  • The newsletter, if you ticked the box for it. Every issue carries a one-click unsubscribe link. Unsubscribing deletes your address from the newsletter list rather than keeping it on a suppression list. A consequence worth knowing: because nothing is kept, I have no record telling me not to add you again, so if you sign up a second time you will be added again.
  • News of the book, courses and mentorship, if you ticked its box. Every such email carries a one-click stop link, and you can also untick the box in your practice account's Profile. A stop is kept as a record that you said no, so that nothing further is sent to you; that record is deleted with your account, or when you ask me to erase your data.

Your result email is neither of these. It is sent because you asked for it when you started, and there is nothing to unsubscribe from.

Your rights

Under UK GDPR you may request access, correction, erasure, restriction, objection, or portability of your personal data, and withdraw consent at any time without affecting prior lawful processing. Contact lucas@lucasrey.com.

Complaints

You may lodge a complaint with the UK Information Commissioner’s Office (ICO): ico.org.uk.

Updates

Last updated: 1 November 2026.