1. Who we are
SovaGorilla (sovagorilla.com) is an independent practice platform for the Sova online assessment. We are the controller of the personal data described here. For anything in this policy, including a data request, email [email protected].
We are a small operation and do not have a statutory Data Protection Officer. Requests go to the same address and are handled by the person who runs the site.
2. What we collect
- Account data — email address, display name, and a password hash (we never see your password). If you sign in with Google, we receive your email address, name and profile picture URL from Google.
- Practice data — the sections you attempt, your answers, scores, time per question, which questions you have already seen, and your streak.
- Preferences you give us — your target employer and assessment date, used to set the countdown and reminder emails.
- Purchase data — what you bought, when, the amount, and Stripe's customer and payment identifiers. Card numbers are handled entirely by Stripe and never reach our systems.
- Measurement data (consent required in the UK and EEA) — an anonymous visitor id, pages viewed, practice events, and which email or advert referred you.
- Technical data — IP address, browser and device type, and referring URL, processed by our hosting and security providers to serve and protect the site.
We do not ask for special category data, and you should not enter it into free-text fields. We do not knowingly collect data from anyone under 16.
3. Why we use it, and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create your account and keep you signed in | Account data | Contract |
| Run the practice sections and show your scores and progress | Practice data, preferences | Contract |
| Take payment, issue receipts and process refunds | Purchase data, account data | Contract, and legal obligation for tax records |
| Send account and transactional emails: purchase receipts, password resets, sign-in | Account data, purchase data | Contract |
| After you create a free account, send practice follow-up emails (for example your result an hour after a free section, or a reminder about an unfinished checkout). Opt out any time via the unsubscribe link in every such email or by emailing [email protected] | Account data, practice results | Legitimate interests (soft opt-in for account holders), ended by unsubscribing |
| Measure how the product is used and test improvements | Measurement data | Consent in the UK and EEA; legitimate interests elsewhere |
| Keep the service secure and prevent fraud and abuse | Technical data, account data | Legitimate interests |
4. Cookies and the anonymous visitor id
Essential cookies keep you signed in and hold your in-progress attempt. Everything else — analytics events, the anonymous visitor id, experiment assignment and campaign attribution — is switched off until you accept it, if you are in the UK or the EEA. Nothing non-essential is written or sent before you choose.
The full list, with lifetimes, is on the cookie notice, where you can also change your choice.
Non-essential categories currently in use: Analytics and product measurement (consent required).
5. Who processes data for us
| Processor | What they do | Where |
|---|---|---|
| Supabase | Account database, authentication and hosted backend functions | European Union |
| Cloudflare | DNS, CDN and protection against attacks | Global edge network, including the UK and EU |
| Stripe | Card and wallet payment processing, receipts and refunds | European Union and United States |
| Brevo | Email delivery: account, transactional and practice follow-up emails | European Union |
| ZeroBounce | Email validation at signup, so we don't send to invalid addresses | United States |
| Lovable | Application hosting and deployment | European Union and United States |
We do not sell your personal data, and we do not share it with employers, with Sova Assessment Ltd, or with advertising networks for profiling.
6. International transfers
Some processors handle data outside the UK and EEA, principally in the United States. Those transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with the provider's own technical safeguards. You can ask us for the details of the mechanism used for a specific provider.
7. How long we keep it
- Account and practice data: while your account is open, then deleted within 7 days of your closing it or asking us to.
- Purchase and tax records: six full financial years, as UK tax law requires. This survives account deletion.
- Measurement events: 24 months, then deleted.
- Email delivery logs: 12 months.
8. Your rights
Under the UK and EU GDPR you can ask us to:
- give you a copy of your data, or export it in a portable format
- correct anything inaccurate
- delete your data, subject to the tax records above
- restrict or object to processing based on legitimate interests
- withdraw consent for measurement cookies or marketing email at any time, with no effect on your access
Email [email protected] and we will respond within one month. You can close your account and change your display name yourself from your profile page. If you are unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local EEA supervisory authority.
9. Automated decisions
Scoring your practice attempts is automated, but it has no legal or similarly significant effect on you: it is feedback on a practice test, not an assessment outcome, and no employer ever receives it.
10. Changes
If we change this policy materially we will email account holders or show a notice in the app before the change takes effect. The date at the top always reflects the current version.
11. Contact
Privacy questions, data requests and complaints: [email protected]. Other enquiries are on the contact page.