Privacy Policy

1 Who We Are

MyPMP ("we", "our", "us") is an online learning platform that helps students prepare for the Project Management Professional (PMP)® certification exam. Our services include video lectures, study materials, practice simulations, a performance history tracker, and certificate generation.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights regarding that data.

For privacy-related questions contact us at: privacy@mypmp.app

2 Data We Collect

We collect the minimum data needed to provide and improve our services:

We do not collect passwords (Google handles authentication), payment card numbers (Stripe handles payments), precise geolocation, or any biometric data.

3 How We Use Your Data

• Provide the service: Authenticate your identity, enforce plan-based access control, and generate your personalised PMP certificate.
• Process payments: Verify successful Stripe payments, activate or extend your plan, and sum transaction totals to determine eligibility for the 50% loyalty discount.
• Track your progress: Store simulator results and lecture progress so you can review your history and measure improvement.
• Communicate with you: Send transactional messages related to plan activation or expiry. No marketing emails without explicit opt-in.
• Maintain security: Detect and prevent unauthorised access, abuse, or fraudulent transactions.
• Improve the platform: Aggregate, anonymised usage patterns may be used to improve content and features. No individual behavioural profiles for advertising.

4 Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your data under the following bases:

• Contract performance (Art. 6(1)(b)): Processing your identity, plan data, and exam results is necessary to deliver the service.
• Legitimate interests (Art. 6(1)(f)): Fraud prevention, security monitoring, and aggregated analytics.
• Legal obligation (Art. 6(1)(c)): Retaining transaction records as required by financial and tax law.

5 Third-Party Services

We share data only with the following trusted providers who are contractually bound to protect it:

We do not sell, lease, or trade your personal data to any third party for marketing or advertising purposes.

6 Data Retention

• Account & plan data: Retained while your account is active. Deleted within 30 days of an account deletion request, except where legally required.
• Transaction records: Retained for a minimum of 7 years to comply with financial and tax regulations.
• Exam results & progress: Retained while your account is active; deletable on request.
• Browser-local data: Theme and language preferences stay on your device until you clear browser data and are never transmitted to our servers.

7 Cookies & Local Storage

MyPMP does not use tracking cookies or advertising cookies. We use browser localStorage exclusively for:

• Supabase authentication session tokens (access token & refresh token)
• Theme preference (mypmpTheme)
• Language preference (mypmpLang)

These are stored solely on your device and are not used for cross-site tracking or profiling.

8 Data Security

• All data in transit is encrypted over HTTPS/TLS.
• Database access is protected by Row-Level Security (RLS) — authenticated users can only read their own records.
• Sensitive operations run server-side only via Cloudflare Pages Functions using secret environment variables never exposed to the client.
• Stripe webhook payloads are verified with HMAC-SHA256 signature validation before any DB update.
• No plaintext passwords are stored; authentication is delegated entirely to Google OAuth 2.0.

If you believe your account has been compromised, contact us immediately at privacy@mypmp.app.

9 Children's Privacy

MyPMP is intended for adults pursuing professional certification and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will promptly delete the data.

10 Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your account and associated data (subject to legal retention obligations).
• Restriction: Ask us to pause processing in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.

To exercise any right, email privacy@mypmp.app. We will respond within 30 days. EEA/UK users may also lodge a complaint with their local supervisory authority.

11 International Data Transfers

Your data is processed on infrastructure operated by Supabase (AWS, US) and Cloudflare (global edge). Transfers from the EEA or UK are covered by Standard Contractual Clauses or equivalent mechanisms in place with our service providers.

12 Changes to This Policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above. Continued use of MyPMP after that date constitutes acceptance of the revised policy.

13 Contact Us

Email: privacy@mypmp.app