Privacy policy
Controller: Bisai Technologies (Bisai Technologies, LLC), 131 Continental Dr, Suite 305, Newark, DE 19713, United States · Contact: contact@bisaitechnologies.com (subject "Privacy") · Effective: 19 October 2026
This policy covers the Part-66 Prep website. The mobile app has its own policy at https://bisaitechnologies.com/legal/part66_pro/privacy. We process personal data under the UK GDPR and Data Protection Act 2018 and, for visitors in the EEA, the EU GDPR.
What we collect, why, and the legal basis
| Data | When | Why (legal basis) | Kept |
|---|---|---|---|
| Email address | You ask for a sign-in link or pay at checkout | To sign you in and match you to your subscription (contract) | While you have an account, then 24 months after your last payment |
Session cookie p66_session (signed, http-only) |
After you sign in | Keeps you signed in for 30 days (contract; strictly necessary) | 30 days or until you sign out |
| Payment details | At checkout | Processed by Stripe on our behalf; we never see or store your card number (contract) | Per Stripe's retention; invoices kept 7 years for tax (legal obligation) |
| Subscription status, plan, renewal dates | From Stripe | To decide whether Pro is unlocked (contract) | While the subscription exists |
| Practice scores and your EASA/UK CAA choice | When you use the practice tool | Stored only in your browser (localStorage) to show your best scores | Until you clear your browser data |
| Server logs (IP address, user agent, URL) | Every request | Security and abuse prevention (legitimate interest) | 30 days |
| Analytics: pages viewed, actions on the site (test started and finished, score, plan clicked, checkout started), device and browser type, approximate country from the IP address | Every visit | To see how the site is used and improve it (legitimate interest; cookie only with your consent) | 12 months |
We don't sell personal data, show ads or use advertising or analytics trackers on the website.
Service providers
- Stripe Payments Europe, Ltd. / Stripe, Inc. (payments, customer portal; Ireland/United States) — https://stripe.com/privacy
- Resend (sends sign-in emails; United States) — https://resend.com/legal/privacy-policy
- PostHog, Inc. (analytics; PostHog US cloud, United States) — https://posthog.com/privacy
- Our hosting provider (serves the website).
Where personal data leaves the UK or the EEA, we rely on the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum, or on an adequacy decision such as the EU–US Data Privacy Framework and its UK extension where the provider is certified.
Your rights
You can ask to access, correct, delete, restrict or port your personal data, or object to processing based on legitimate interest, by emailing contact@bisaitechnologies.com from the address on your account. We answer within one month. Cancelling a subscription doesn't delete your account; ask us if you want it deleted (we keep invoices where tax law requires). You can complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority in your EU country.
Analytics
We use PostHog (PostHog US cloud, servers in the United States) to understand which pages and tests are used. Requests go through our own domain (/ingest). We collect pages viewed, a few actions (test started and finished with the score, offer shown and clicked, checkout started, sign-in, subscription confirmed), device and browser type, and an approximate country derived from your IP address. We don't record sessions or collect what you type. If you are signed in, events are linked to a one-way SHA-256 hash of your email address, never the address itself.
Until you accept, analytics runs without cookies or storage on your device: each page load is anonymous and not linked to the previous one. If you click "Accept" in the banner, PostHog sets a cookie and a localStorage entry (ph_…) to recognise your browser between visits, for up to 12 months. You can change your mind at any time with the "Cookies" link at the bottom of every page, or block analytics with a content blocker. Analytics data is transferred to the United States under the International Data Transfer Addendum to the EU Standard Contractual Clauses (and the EU Standard Contractual Clauses for visitors in the European Union).
Cookies
We use one strictly necessary cookie (p66_session), set only after you sign in, and a short-lived technical cookie (ph_evt, a few minutes) that passes an analytics event across a redirect (sign-in or checkout) and holds no personal data. The PostHog analytics cookie is set only after you accept it in the banner. Your choice is saved in your browser (analytics-consent). No advertising cookies.
Age
The website is for people aged 16 and over.