Privacy statement

Who is responsible

CBRKlaar, registered with the Netherlands Chamber of Commerce under KVK 42117527, is responsible for the personal data described here. Questions and privacy requests can be sent to hello@cbrklaar.com or made by telephone at +31 6 8700 5616.

Data we process

• Account details, including email address, authentication identifiers and display name.
• Learning activity, answers, progress, Practice Exam attempts and review history.
• Purchase and entitlement records, including package, amount, currency and Stripe references. CBRKlaar does not receive your complete card number.
• Support messages and technical information needed to diagnose a reported problem.
• Essential browser storage used for authentication, saved theme choice and secure payment operation.

Why we use it

We process data to create and secure your account, deliver purchased access, save progress, grade answers, provide support, prevent abuse, meet accounting and legal duties, and improve reliability. These activities rely on performing our agreement with you, legitimate security and service interests, legal obligations, or consent where consent is required.

Service providers and international transfers

CBRKlaar uses specialist providers for hosting, authentication, database and asset storage, payments, sign-in, and optional AI-assisted voice or administrative media tools. These may include Supabase, Vercel, Stripe, Google, Lovable and OpenAI. They receive only the data needed for their function and process it under their own security and contractual safeguards. Where data is transferred outside the European Economic Area, an applicable lawful transfer mechanism must be used.

Retention and security

Learning and account data is kept while your account is active and then deleted or anonymised when it is no longer needed, subject to fraud-prevention, dispute and statutory recordkeeping duties. Payment and accounting records may be retained for the legally required period. We use access controls, row-level database security, private asset storage and encrypted network connections to protect data.

Your rights

Depending on the circumstances, you can ask to access, correct, delete, restrict or transfer your data, object to certain processing, or withdraw consent. The Account page provides an account-deletion flow, and you can also contact us. We may need to verify your identity. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

We may update this statement when the service or legal requirements change. The date at the top shows the latest revision. Material changes will be communicated where required.