Effective 12 October 2026 · Version 2.0

Privacy Policy

1. Scope and operator

This policy explains how WoWPrep Academy collects, uses, holds and discloses personal information when you:

• visit our website;
• join our waitlist or send us a message;
• create an account and study;
• make or approve a purchase;
• take part in the guardian-request process;
• contact support.

It covers the Kuwait KUAT service. If we later introduce a materially different country service, we will identify any additional arrangements before collecting information for it.

WoWPrep Academy is provided under the registered business name WoWPrep (ABN 59 194 029 687), an Australian sole-trader business. This policy applies to the business operator identified by that ABN. Privacy contact: support@wowprepacademy.com.

We do not sell personal information. We collect and use information for the purposes described below, subject to applicable law. Acknowledging this policy is not blanket consent to every kind of processing.

2. Information we collect

• Account and eligibility information:

  • email address, and display name where supplied;
  • authentication identifiers;
  • country or market, app language and required age band;
  • exam and subject choices, and account status;
  • verification and security records;
  • dated records of the terms you accepted.

• Guardian-process information, where enabled: learner and guardian contact details, their association for the request, the request language, invitation/approval/purchase status and timestamps, declaration and acceptance evidence, and the information needed to send reminders or receipts. We may hold limited request records before approval to operate and secure that process. Those records do not themselves activate unrestricted learner access.

  If you sign in with Google (available only for accounts already linked to Google), we receive your Google account identifier, and the name and email Google provides.

• Learning information:

  • diagnostic and practice responses, and selected or eliminated answers where recorded;
  • test attempts, question timing and scores;
  • mastery estimates, study plans and recommendations;
  • learning history and allowance use;
  • content-issue reports.

• Payment information:

  • order and transaction references, and payment status;
  • amount, currency, and purchased plan and subjects;
  • access dates, and discounts where used;
  • the billing name and email given at checkout;
  • records needed for refunds, reconciliation or disputes.

  Stripe handles card details. Our application does not store full card numbers or card security codes.

• Waitlist information:

  • your email address;
  • your WhatsApp number, if you choose to give it (optional);
  • your country or market;
  • the campaign or referring website that brought you to the signup page, where present.

• Contact-form information: your name, email address and message, plus the IP address and browser user agent the message was sent from.

• Support information: emails you send to support@wowprepacademy.com, any attachments, and the notes we need to investigate and respond. Please leave out identity documents, full card numbers and other sensitive material that isn't needed.

• How you found us (acquisition information). If you arrive from a campaign link, a referral or partner link, an ad click or another website, we record where you came from in a cookie called wp_ft, and store it with your account if you sign up. Section 7 describes exactly what it records.

• IP addresses and technical information. We record IP addresses:

  • with your acceptance of our terms;
  • with contact-form messages;
  • in some account and payment audit records;
  • in sign-in event logs;
  • in our hosting provider's request logs.

  Request logs also record the web address requested. Some addresses contain personal information; for example, an unsubscribe link contains your email address. We also process browser, device and operating-system information, request and session identifiers, error and security logs, and cookies or similar browser storage (section 7). Temporary rate-limit counters may be keyed to your account, IP address or email address (section 6).

3. Timed-test integrity information and collection limits

In modes that enable integrity checks, we collect limited attempt information:

• start and end times, and question timing;
• fullscreen exits and tab or focus changes;
• copy and paste attempt events;
• disconnections.

We may derive an integrity indicator from these events, for presenting practice results or making recommendations. It is not an official finding of misconduct.

These checks do not record webcam images, microphone audio, screen contents, typed text or keystroke contents, or clipboard contents.

For ordinary study access, we do not require:

• a passport, civil ID or biometric identifier;
• precise GPS location;
• health information, religion or political opinion;
• an official school result.

If a particular request requires extra verification, we will explain why and ask for the least intrusive information reasonably needed. Information you send to support voluntarily may include material we did not ask for; we handle it according to its purpose and sensitivity.

4. Where information comes from and why we use it

We collect information:

• from you;
• from your browser or device;
• from your activity in the service;
• from the providers involved in authentication, payment and email delivery.

We may also receive records needed to investigate a payment dispute, an abuse report or a legal request.

We use relevant information to:

• create, verify and secure accounts, apply eligibility rules, and operate required guardian approval;
• provide learning activities, results, recommendations and learning history;
• apply purchased entitlements and disclosed usage limits;
• process, reconcile and support payments, receipts and lawful remedies;
• send necessary account, verification, purchase, guardian-request, security and access messages;
• answer support, privacy and content-correction requests;
• detect fraud, misuse, technical faults and security threats, including limiting repeated requests;
• understand which campaigns and referrals bring people to the service (section 2, acquisition information);
• assess and improve service performance using appropriately limited data;
• send optional communications where legally permitted and subject to your choices;
• keep records needed for legal, accounting, dispute and compliance purposes.

Where applicable law requires us to identify a legal basis or obtain consent, we do so before the relevant processing. Depending on that law and the purpose, processing may be:

• necessary for a service you request;
• required by a legal obligation;
• for a permitted security or business purpose;
• based on valid consent.

We do not treat these as interchangeable. If information is needed to provide a service you've requested and you do not supply it, we may be unable to provide that part of the service.

5. Minors and guardians

We use age and eligibility information to apply the registration path and safeguards relevant to the service. Users under 18 must follow the required guardian-permission process. Age groups not permitted by the signup flow must not bypass those restrictions.

Where enabled, we send the guardian the learner identification and request information necessary to review the request, record the response and administer approval or payment. The guardian may also receive necessary request reminders and, if they pay, their receipt. The learner receives their own account and access communications.

Approval or payment does not create a parent dashboard or unrestricted access to the learner's answers, detailed activity or private support messages. We may verify identity and authority before handling a guardian request. We consider applicable law, the learner's interests and any relevant capacity/consent requirements.

We do not use a minor's learning answers, mastery or integrity signals for targeted advertising. First-party acquisition information is collected as described in section 7; approval of an account does not by itself constitute consent to unrelated advertising or optional marketing.

If we learn that an account or approval was created contrary to eligibility or authority requirements, we will investigate and restrict inappropriate access or processing. Contact support about mistaken guardian information or requests to change or withdraw permission. Any disclosure, retention or deletion remains subject to applicable law.

6. Who receives information

We disclose information only as reasonably necessary for a described purpose, and subject to applicable law. Our service providers, and what they do:

Providers process information relevant to their role. Our routine checkout and purchase emails do not require the learner's question responses. If you include learning information in a support message, the support-email provider will process that message.

Other recipients may include professional advisers. We may also disclose information:

• where legally required;
• to respond to a valid legal request;
• to protect people or the service from a substantiated threat;
• to investigate a relevant fraud or payment dispute.

We assess the basis and scope of each disclosure rather than releasing an entire account unnecessarily. In a lawful business transfer, relevant records may be transferred, subject to applicable notice, consent and continuing-protection requirements.

We do not routinely share learning records with Kuwait University, schools, examination bodies or admissions authorities. An authorised user-directed disclosure or a legally required disclosure is assessed under the rules above. We do not allow service providers to sell student records or to use identifiable learning data for unrelated advertising. Providers may separately handle information they collect directly under their own terms (for example, Stripe's legal and fraud obligations); see their notices when you use those services.

7. Cookies, browser storage, analytics and advertising

Essential storage (sign-in and security). Authentication cookies hold the tokens needed to keep you signed in. Some sign-in flows use a temporary security-verifier cookie. Browser session storage may record the time you last re-confirmed your password. Blocking necessary authentication storage can prevent sign-in. Session expiry, refresh and sign-out are controlled by the authentication service; a cookie's stored lifetime is not a guarantee of continuous access.

Authentication cookies are removed or updated by the relevant sign-in/sign-out flow. The re-confirmation timestamp is held in the tab's session storage. We do not describe a library default as a verified login-validity period.

Acquisition cookie (not essential). wp_ft is separate from the essential storage above. It is not needed to use the service.

• When it's set: the first time you arrive with:

  • campaign (UTM) values;
  • a referral (ref) or partner (partner) code;
  • a Google or Meta ad-click identifier (gclid or fbclid);
  • or a link from another website.

  If you arrive with none of these, it isn't set.

• What it records:

  • the five UTM values;
  • the referral code and partner code;
  • the ad-click identifier;
  • the address of the external page that linked to us, as your browser sent it (up to 200 characters);
  • the path of the page you landed on (without its query string);
  • the time.

  Campaign, referral, partner and click-identifier values are shortened to their configured field limits, generally 120 characters; the external referring address is limited to 200 characters. Most browsers send only the other website's domain as the referring address, but a website can send its full page address, and that may include information from that page's own query string.

• Lifetime: 90 days. It is not replaced by later visits, and it isn't removed when you sign up.

• Where it goes: if you create an account, its contents are copied to your account record, where we use them to understand which campaigns and referrals bring people to the service. The cookie is not accessible to ordinary page scripts and is processed by our server and hosting provider. Its contents are stored through our database provider if you sign up. This attribution feature does not transmit those contents to Google Analytics or Meta. Account deletion currently removes the associated acquisition record, subject to section 9.

Analytics. We disabled Google Analytics 4 (GA4) on our current production website on 11 October 2026. The production website we serve today does not load it.

That date is when we stopped using it on our live website. It isn't the date all collection stopped:

• Some older, protected versions of our website are kept for operational reasons and still contain the GA4 code. They can be opened only by our team or authorised systems, and if one is opened, it can send data to our GA4 property. We avoid opening them, and we do not direct users to them.

• We used GA4 on the live website from 9 May 2026. Previously collected data remains subject to Google's storage, retention and deletion arrangements. The property retention setting controls certain user/event-level data; it does not automatically erase all aggregated reports.

• That data included:

  • the pages visited, with their web addresses;
  • referral information;
  • device and browser information;
  • approximate location;
  • browser identifiers.

  Page-address and referrer collection could also include information placed in those addresses, including email addresses and unsubscribe tokens, and checkout session identifiers. We disabled current-site collection and are reviewing the historical data and available deletion mechanisms. This policy does not represent that historical deletion or complete containment has been completed.

• Google Analytics cookies set during that period (such as _ga) may still be in your browser until they expire or you clear them. Our current website does not read them.

If we turn analytics back on, we will update this policy first, and put in place any permission that applicable law requires. There is currently no cookie-choice control. First-party attribution storage remains in use as described above; disabling GA4 does not disable that storage. Contact support with questions or objections to this collection. This contact route is not a substitute for consent where the law requires it.

Advertising. Our current production pages do not load a Meta advertising pixel or a Google advertising tag. The first-party attribution cookie described above can nevertheless record ad-click identifiers. Before introducing any, we will identify the provider and the information and purposes involved, and put in place the permissions and minor safeguards required by law. (The wp_ft cookie can record an ad-click identifier that an ad platform added to a link; it does not send anything to that platform.)

Third-party pages. When you pay on Stripe's payment page, or sign in on Google's page, those companies may use their own cookies under their own notices.

We do not claim that Do Not Track or Global Privacy Control signals are automatically honoured.

8. International processing

WoWPrep is operated from Australia and serves users in Kuwait. Information is processed outside Kuwait. Our database/authentication service and configured application functions are hosted in Mumbai, India. The operator and support-mailbox arrangements are in Australia.

Other providers, including Stripe, Google and providers' global networks or subprocessors, may process information in the United States and other countries. Email delivery, rate limiting, backup/log storage and support access may involve locations different from the primary application region. We do not claim that a sending-domain DNS record proves where all email information is stored, or that a provider's headquarters proves its processing location. Contact support for available details of the providers and processing arrangements relevant to your request.

We use reasonable safeguards appropriate to the information, recipients and applicable law. Overseas laws and government-access rules may differ from those in Kuwait or Australia. We do not promise Kuwait-only or Australia-only storage. Acknowledging this policy does not waive cross-border obligations or supply consent that the law requires separately.

9. Retention and deletion

Retention depends on the purpose of the information, the account or request involved, provider settings and any applicable legal obligation or genuine dispute. There is not one retention period for every record. We have not yet implemented an automatic inactive-account deletion schedule. The application retains records until they are removed through its manual processes; this does not mean that every record may lawfully be kept indefinitely.

For access, correction, account closure or deletion, contact support@wowprepacademy.com and identify the account or information concerned. Requests are handled manually, with proportionate identity/authority checks. We assess what must be deleted and what may or must lawfully remain, and explain an applicable limitation rather than treat technical inconvenience as a legal exception.

Closing an account ends access to its learning history and remaining entitlements. The current process also removes some local financial and acceptance evidence. Separate waitlist/contact records, support messages, some audit/sign-in records and provider records may remain and require separate assessment. We do not represent that a single account-deletion action erases all information in every system.

A misuse/security flag can require additional review before the current deletion action can proceed. It is not, by itself, a right to retain all information indefinitely or to refuse a legally required remedy.

Deleted live data can remain in backups until their rotation or expiry. If a backup is restored, previously deleted data may be restored; we do not currently have an automated process to re-apply previous deletions. Historical analytics deletion is subject to Google's tools and their limitations and has not been completed.

We may retain genuinely de-identified aggregate statistics where they no longer reasonably identify a person. Replacing a name with an ID alone does not establish anonymisation.

10. Security and incidents

We use reasonable safeguards appropriate to the information and the risks. These include:

• access controls and secure authentication;
• encrypted transport;
• restricted administrative access;
• limits on repeated requests;
• our providers' security controls.

Security and error logs support detection and investigation. No online system can guarantee absolute security.

If we become aware of a personal-information incident, we will assess it, take reasonable steps to contain and fix it, and notify affected people and authorities where applicable law requires. This does not waive any responsibility or remedy. Contact support promptly if you suspect account compromise or an improper disclosure.

11. Learning recommendations and AI

We use automated calculations to estimate mastery, recommend practice and display integrity indicators. These are study-support tools, not official admissions or examination decisions. If you believe an account restriction or a material result is incorrect, you can ask support to review it.

We do not send your learning answers or support messages to AI providers, and we do not allow them to be used to train external AI models. If a new feature would send personal information to an AI provider, we will first explain the provider's role, the data, the purpose and the retention, and obtain any required permission.

12. Service messages and marketing choices

Necessary messages include verification, sign-in, security, support, guardian requests and reminders, purchase receipts, access and expiry communications. A guardian-paid purchase has separate learner-welcome and payer-receipt messages. We use your language preference where supported; otherwise we may use English.

Optional marketing is subject to the permissions required by applicable law. You can unsubscribe using the link in a marketing email, or by contacting support. We do not treat consent to necessary account messages as consent to optional marketing. Unsubscribing stops marketing emails; it does not delete your waitlist entry or account (section 9 explains how to ask for deletion).

13. Access, correction, deletion and complaints

Depending on applicable law, you may request:

• access to your personal information;
• correction or deletion;
• information about how it is processed and disclosed;
• withdrawal of consent;
• other rights, such as portability or objection, where available.

We do not promise that every right has the same scope in every country.

Email support@wowprepacademy.com, describing the request and the account involved. We may verify your identity or authority using proportionate means. Do not email identity documents unless we explain why they are needed. Requests are handled manually by our team. We aim to acknowledge requests promptly and to respond within 30 days where practicable, or within the period required by law. If a lawful exception applies, we will explain it and any available review or complaint route. Technical inconvenience alone is not a reason to refuse a legally required request.

For complaints, use the subject “Privacy Complaint” and describe the concern and the outcome you want. We will investigate and respond. You may also contact a competent regulator, including the Office of the Australian Information Commissioner where it has jurisdiction, or the relevant Kuwaiti authority where applicable. Contacting us first does not remove your right to complain directly.

14. Policy changes and contact

We identify the current version and its effective date. You can contact support to request available previous policy text. We will give appropriate notice of material changes, and obtain fresh consent where required. Continuing to use the website is not, by itself, consent to a new optional purpose or a retrospective expansion of data use.

Privacy contact: support@wowprepacademy.com. Business identification: section 1.