Who is responsible for your information
LNAT Lab decides how and why personal information collected through the service is used.
Email admin@lnatlab.co.uk for privacy questions or requests.
The short version
- We use account and practice data to provide the service and show your progress.
- We do not sell personal information or send your practice profile to universities.
- In demo mode, account, practice and Essay Lab data stays in your browser.
- Basic session analytics run by default for aggregate usage statistics. Longer-lived analytics cookies and individual journey measurement only switch on if you allow them, and you can object at any time.
- We may use limited public professional information to assess potential creator or organisational partnerships. A merely public email address is not treated as permission to send marketing.
- You can ask to access, correct or delete your personal information.
Information we collect
- Account information: your email address, account ID, access tier, onboarding status and account dates. Our authentication provider handles password verification. We cannot read your password.
- Learning information: passages and questions attempted, answers, correctness, time spent, answer changes, flags, practice mode, difficulty, session history, streaks and inferred reasoning patterns.
- Essay Lab information: prompt choice, plan, draft and recent reviews. In the current version these stay in your browser. A future feature will not upload a draft without telling you before you submit it.
- Technical information: security and service logs such as IP address, browser type, request time and error information. Our hosting and database providers may generate these logs.
- Messages and transactions: information you send to support and payment status and transaction references. Payment providers process your card or account details. LNAT Lab does not need to store full card details.
- Affiliate and referral information: referral code, tracked link visits, attribution, referred purchases, commission, payout status, creator applications and programme compliance records.
- Potential partner outreach information: limited information from public professional pages, such as an organisation or creator name, public profile URL, audience description, public business contact route, a recent relevant item of content, the public evidence supporting contact eligibility, contact history and any objection or suppression record.
Please do not put health information, school records or other sensitive personal information into an essay draft or support message.
Demo mode and live accounts
When the banner says Demo mode, account details, password verifier, answers, progress and Essay Lab drafts are stored on that device in browser storage. They are not an online LNAT Lab account and may disappear if you clear the browser.
When production accounts are enabled, Supabase processes authentication and account learning data so that progress can follow you between devices. The Essay Lab screen currently continues to identify its drafts as saved in the browser.
Our Cookie and local storage notice lists the device storage used by the current product.
Analytics
Basic aggregate usage statistics run by default to show visits, page use and product events. To support accurate session-level counts, Google Analytics may use analytics storage only for the current browser session unless you object. Advertising storage, advertising user data, Google signals and personalised advertising remain disabled.
If you choose Allow in the analytics-cookie box, the analytics identifier may be retained for up to 90 days so we can understand repeat visits and practice journeys. For signed-in users, an opaque account ID and account tier may be associated with analytics activity. We do not send Google Analytics your email address, password, essay text, answer text or authentication token.
If you choose No thanks or later turn analytics cookies off, we ask Google Analytics to deny analytics storage and remove LNAT Lab analytics identifiers. Basic cookieless aggregate usage statistics may continue, but visits are not linked across browser sessions. You can change this choice at any time using Cookie settings in the footer; doing so does not restrict the service.
Why we use it
| Purpose | Information | Legal basis |
|---|---|---|
| Create and secure your account | Account and technical information | Perform our contract and legitimate interests in security |
| Deliver practice, save progress and produce your reasoning profile | Account and learning information | Perform our contract |
| Operate the affiliate programme, attribute purchases and pay valid commission | Account, referral, transaction and payout information | Perform our programme contract, legitimate interests in fraud prevention and legal obligations |
| Identify and contact relevant potential partner organisations or people who have publicly invited commercial proposals | Limited public professional profile, contact, audience, evidence and outreach history | Legitimate interests where electronic-marketing rules permit business-to-business contact, or consent or an express invitation where required |
| Improve question quality, reliability, accessibility and the website experience | Learning information and basic aggregate usage information | Legitimate interests, using aggregated or de-identified data where practical |
| Measure repeat visits and individual product journeys after you allow analytics cookies | Pseudonymous analytics identifiers, usage events, acquisition data and, for signed-in users, opaque account ID and tier | Consent where required for longer-lived analytics storage; associated personal-data processing is limited to service measurement and improvement |
| Answer requests, prevent abuse and meet legal duties | Messages, transactions and technical information | Contract, legitimate interests and legal obligations |
| Send optional product news | Email address and preferences | Consent, which you may withdraw at any time |
Where local data protection law uses different terms, we rely on the equivalent lawful grounds for providing the service, pursuing legitimate interests, complying with law or acting with your consent.
We do not sell personal information. We do not use your reasoning profile to make a university admissions decision, and we do not send it to universities.
A public contact detail alone does not establish permission for electronic marketing. Automated partner outreach is restricted to verified corporate business contacts or contact routes that expressly invite partnership, sponsorship, collaboration or affiliate proposals. Other prospects remain excluded unless another lawful basis is recorded.
Reasoning profiles and automated analysis
LNAT Lab groups practice responses into educational signals, such as over-inference or missed qualification. This is profiling because software infers patterns from your answers. It controls study feedback and practice recommendations only.
The profile does not make a legal or similarly significant decision about you. A university does not receive it. You can ask us to explain, correct or delete the profile.
Essay Lab can request server-only qualitative AI feedback for a submitted version you choose. That request is made by our servers, not your browser. Feedback is educational practice guidance only and is not an official LNAT mark or university prediction. Provider logs are redacted so essay text and tokens are not written to application logs. Retention controls delete expired feedback jobs after the configured period.
Our partner-discovery system may use public-web search and automated scoring to identify potentially relevant professional accounts. A high score does not itself authorise contact. The system must also record a supported marketing basis and public evidence, and messages remain subject to review and suppression controls.
Who receives it
We use suppliers only where needed to run LNAT Lab. They include Supabase for authentication, database services and aggregate product measurement; Vercel for hosting and delivery; Google Analytics for usage measurement; OpenAI for selected server-side AI feedback and public-web research tasks; an email delivery provider such as Resend if partner outreach is enabled; Stripe for customer payments; and PayPal for manual affiliate payouts. Professional advisers and public authorities may receive information where the law requires it.
These providers may process information outside the country where you live. Where data protection law requires it, we use an approved transfer mechanism or another lawful safeguard.
How long we keep it
- Account and learning history is kept while your account is active so the service can show progress.
- If you ask us to delete your account, we will delete or de-identify account and learning information within 30 days, unless we must retain a limited record for fraud prevention, tax, dispute or legal reasons.
- Support records are normally kept for up to 24 months after the matter closes.
- Transaction, affiliate payout and tax records may be kept for the period required by law.
- Uncontacted partner-prospect records are normally deleted or reverified within 90 days. Outreach history is normally kept for up to 24 months for compliance and dispute handling.
- After an objection or unsubscribe request, we may retain only the minimum contact identifier and suppression information needed to ensure that the person or organisation is not contacted again.
- Security logs and backups are kept for limited operational periods and then deleted or overwritten.
- Browser-only data remains until you clear it or the product provides a delete control.
Your choices and rights
Depending on where you live, you may ask us to give you a copy of your information, correct it, delete it, restrict or object to its use, or provide it in a portable format. You may withdraw consent without affecting earlier lawful use.
Your right to object: you may object to processing based on our legitimate interests. You may always object to direct marketing.
Any direct-marketing objection, unsubscribe request or clear refusal is applied to the outreach suppression list and stops future campaign messages through that contact route.
Email us to make a request. We may need to verify that the account is yours. There is normally no fee. We aim to respond within one month, or sooner where local law requires it.
Students under 18
LNAT Lab accounts are for students aged 16 and over. If you are under 18, ask a parent or guardian to review the service and its terms with you. Do not create an account if you are under 16. If we learn that an account belongs to a younger child, we will close it and delete the associated information unless the law requires a different step.
We do not serve behavioural advertising and do not share reasoning profiles with universities. A parent or guardian may contact us about a child's account, but we will consider the student's privacy as well as the request.
Partner discovery excludes personal contact information belonging to anyone who appears to be under 18.
Security and complaints
We use access controls, encrypted connections and database rules intended to keep each account separate. No online service can promise absolute security. Tell us promptly if you believe your account or information has been compromised.
If a personal information breach creates a legal duty to notify you or a regulator, we will do so as required.
Please contact us first so we can investigate. You may also complain to the data protection authority where you live. If UK data protection law applies to you, you may complain to the UK Information Commissioner's Office.
Changes to this notice
We will update the date above when this notice changes. If a change materially affects how we use account information, we will give reasonable notice in the service or by email.