Privacy Policy

We collect the following personal information:

• Full name
• Email address
• Phone number
• State or territory
• Target exam intake
• Referral source (how you heard about us)
• Marketing and SMS consent preferences
• Consent records (whether you accepted our Terms of Service and Privacy Policy, and the timestamp of acceptance)
• Subscription plan and exam intake month status
• Practice progress (which questions you have seen or completed)
• Attempt history (your answers, self-assessment ratings and scores)
• Written answers submitted for AI examiner feedback

We collect your information:

• Directly from you when you complete the sign-up form
• Through Google OAuth if you choose to sign in with Google (we receive your name and email from Google)
• Automatically as you use the portal (your practice activity, attempts and progress)

We use your information to:

• Create and manage your account
• Provide and manage your subscription and exam-session access
• Track your practice progress and show your results
• Provide optional AI feedback on your written answers
• Send you service-related communications
• Send marketing emails or SMS reminders — only where you have given consent, which you may withdraw at any time

Your data is stored using Supabase, hosted in Sydney, Australia (AWS region ap-southeast-2). We apply reasonable technical and organisational measures — including access controls and row-level security — to protect your information from misuse, interference, loss, and unauthorised access, modification or disclosure.

We only share the minimum information necessary with trusted service providers who help us operate the portal:

• Stripe — to process subscription payments
• Anthropic — to generate AI feedback on written answers you submit for review
• Google — to authenticate you if you choose Google sign-in
• Supabase (AWS) — to host our database and authentication

We do not sell your personal information to any third party.

Some of these providers process your personal information outside Australia, including in the United States (Anthropic, Stripe, Google) and through Vercel's global infrastructure. Where personal information is transferred overseas, we take reasonable steps to ensure it is handled in accordance with the Australian Privacy Principles (APP 8).

Under the Australian Privacy Principles you may:

• Request access to the personal information we hold about you
• Request correction of information that is inaccurate or out of date
• Request deletion of your account and associated personal information
• Withdraw marketing or SMS consent at any time

To make a request, contact us at support@maraprep.com.au. We will respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

In the event of an eligible data breach involving your personal information, we will respond in accordance with our obligations under the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act 1988 (Cth)). Where required by law, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable.

We use essential session cookies only, for the purpose of keeping you signed in and securing your session. We do not use advertising, analytics or cross-site tracking cookies.

We use Vercel Web Analytics, a cookieless, privacy-friendly analytics service, to understand aggregate site usage (such as page views). It does not use cookies or track you across sites.

We retain your account data for as long as your account remains active. Your practice progress and attempt history are retained even after a subscription expires, so that your history is available if you return. You may request deletion of your account and personal information at any time (see “Your rights” above).

For any privacy questions, requests or complaints, contact our privacy officer at support@maraprep.com.au.