What we collect, why, and who sees it.

• Your email — to create the account and contact you about it.
• Your name and phone — optional. Phone speeds up M-Pesa checkout. We don't use them for marketing.
• Your profile answers — destination, current stage, target match year, study hours. These shape your personalised timeline.
• Your progress — which checklist items you've ticked, which chapters you've marked read, the notes you save against items.
• Payment metadata from Pesapal — confirmation code, amount, payment method (M-Pesa or card). Not your card number or M-Pesa PIN — those never reach us.
• Standard server logs — IP, browser, paths visited. Kept for ~30 days for debugging and abuse prevention.

• Card numbers, M-Pesa PINs, or any payment credential.
• Cookies for advertising or remarketing. We do use Google Analytics for aggregate visit statistics (which pages are popular, how people get here) — it sets a first-party _ga cookie and reports anonymised pageview data to Google. We don't enable Google's advertising features and we never join the analytics data with anything personal we hold.
• Anything from third parties about you that you didn't share with us.

Four suppliers see a slice of your data so the product works:

• Supabase — our database and authentication. Self-hosted by us, so the data sits on infrastructure we control.
• Pesapal — our payment processor. They handle the actual money.
• Brevo — our transactional email provider. Sees your email address and the contents of mail we send you.
• Cal.com — only if you book a coaching session. Sees your name and email for the booking.
• Google Analytics — for aggregate site traffic. Receives the page path you're on, an anonymised visit fingerprint, and your approximate location. Doesn't receive your name, email, or anything you fill into the portal.

We don't sell your data to advertisers or data brokers. We never have. We don't plan to.

As long as your account is active. If you delete your account, we delete your personal data within 30 days — except where law requires us to keep payment records (typically 7 years for tax purposes).

Email hello@gopractice.md to:

• Get a copy of your data.
• Correct anything wrong.
• Delete your account and data.
• Ask what we've shared with whom.

The product isn't designed for anyone under 18 and we don't knowingly collect data from them. If you believe a child has signed up, email us and we'll delete the account.

We can update this page. Material changes (anything that affects what we collect, share, or do with your data) get an email to your account address.