PanelPrepStart a pack

Privacy Policy

Last updated 13 September 2026

Who is responsible

PanelPrep is operated by Mohamed Almahroos, a sole trader based in the Kingdom of Bahrain. We are the controller of the personal data described here. Contact us through our contact page.

What we collect

When you buy or create an account:

  • your email address, and your name if you give it
  • your purchase record: what you bought, when, the period it covers, and the amount. Card and payment details never reach us; Dodo Payments, our merchant of record, holds those.

When you visit any page, signed in or not:

  • the page, the time, your IP address, the browser identification your browser sends, the country and city your network reports, and the site you came from if you followed a link. This is recorded on our own server, sets nothing on your device, and reaches no third party.
  • if you arrived by clicking one of our adverts on Google Search, the click identifier Google itself adds to the web address. It is Google's identifier, read out of the address; nothing is stored on your device to obtain it.

When you join the mailing list:

  • your email address, and which airline you are applying to
  • the wording you agreed to, the date and time, your IP address and your browser identification. We keep these as the evidence that you asked for the emails, which the law requires us to be able to show
  • the date and time you pressed the confirmation link, and from which address
  • if you arrived by clicking one of our adverts, the click identifier from that visit
  • which of the emails we have sent you, and when

Nothing is sent to an address until the confirmation link in the first email is pressed. If it is never pressed, the record is deleted after 30 days on its own.

When you use the service:

  • sign-ins, with time, IP address and browser details
  • which lessons you open and which questions you view
  • practice and mock attempts, your answers, timings and scores
  • copy events on lesson and question pages

We also render your email address as a faint watermark on lesson and question pages while you view them.

If you agree to adverts, Google collects data about you directly through the advertising slot on our page. We do not receive it and we cannot see it. What Google collects and what it does with it is set out in Google's privacy policy and in Google's page on how it uses data from sites that use its services.

Why we collect it

  • To give you the access you paid for and to score and review your attempts.
  • To answer support and refund requests.
  • To detect sharing, copying and bulk downloading, which the terms of service prohibit.
  • To know whether anybody visits, which pages they read, and where they came from. Our lawful basis for this is legitimate interest: a business needs to measure whether its own site works, and counting page requests on our own server is the least intrusive way to do it.
  • To know whether the adverts we pay for lead to sales, so we can stop paying for the ones that do not. This is done two ways. Reading the click identifier off the web address and recording it on our own server rests on legitimate interest, because it stores nothing on your device and tells Google nothing about who you are. Loading Google's conversion tag, which does store something on your device, rests on your consent and nothing else: it is asked for, and it does not happen unless you say yes. Both are set out under Cookies below.
  • To earn a little from the pages we give away, by showing adverts supplied by Google beside them. This rests on your consent and nothing else, and it is asked for as its own question, separately from the one above, because it is a wider thing: it lets Google use what it knows of you to choose what you are shown. Adverts never appear on anything you have paid for.
  • To keep the service secure and to fix faults.

We do not sell personal data. We do not build a profile of you and we do not use anything we hold to advertise to you. Google, if you agree to adverts, does use what it holds about you to choose them; that is Google's processing under its own policy, not ours, and no data of ours is given to it for the purpose.

To send you the assessment-prep emails you asked for, and to be able to show that you asked. The lawful basis is your consent, given by pressing the confirmation link, and you can withdraw it at any time with the unsubscribe link on every message or the button your mail client shows. Withdrawing takes one press and no sign-in. We keep the record of your unsubscribe so that a later sign-up of the same address does not start the emails again without you.

Who processes it for us

  • Dodo Payments Inc (United States): payments, receipts and tax.
  • Supabase: database and sign-in.
  • Vercel: hosting.
  • Our email provider, for sign-in links and support replies.
  • Google Ads. In one direction always: when a purchase came from one of our adverts we send Google its own click identifier, the time and the amount, so that the sale is counted against the advert. Nothing that identifies you goes with it. And, if you consented to it, in the other direction too: Google's conversion tag runs in your browser, sets its own cookies on this domain and reports the purchase to Google directly. In that case Google is acting for its own purposes as well as ours, not purely as our processor.
  • Google AdSense, only if you consented to adverts. Google is not our processor here at all. It decides for its own purposes what to collect through the advertising slot and which advert to put in it, and it pays us a share of what the advertiser pays. We send it nothing about you, we receive nothing about you, and we have no say in which adverts you are shown.

Apart from the last one, each of these handles data only to provide its service to us.

Resend sends our email, which means Resend processes the address of anyone we send to, and the message itself.

Cookies

Whether this site sets a cookie is your decision, and until you make it the answer is no.

On arrival nothing is loaded from another company and no cookie is written. A bar at the bottom of the page asks two questions, and they are answered separately.

The first is whether we may measure our advertising. Answer no, or ignore it, and nothing changes: no Google tag, no request to googletagmanager.com, no cookie. Answer yes and Google's conversion tag is loaded and sets Google advertising cookies (_gcl_aw and related items, which Google documents as lasting 90 days) so that Google can attribute a purchase to the advert you clicked.

The second is whether we may show adverts from Google. Answer no and AdSense is never loaded and no request is made to Google for it. Answer yes and Google's advertising script runs on the pages listed in our cookie policy, sets Google's own cookies both on this domain and on Google's, and uses them to choose which adverts you see. Adverts never appear on the front page, the purchase page, the receipt page, a lesson, the exercise lab or an exam, and never for anyone who is signed in.

Three items sit in your browser's local storage whatever you answer: the one that holds your sign-in, and the two that record your answers so you are not asked again. Local storage is not a cookie and is not sent with your requests.

Measuring adverts on our own server, using the click identifier described above, happens either way and stores nothing on your device. Our cookie policy lists every item by name, when it is written, and how long it lasts.

Until 13 September 2026 this section said the site set no cookies at all, and there was no banner. That was true of the site as it then stood. It stopped being true when we added Google's tag, which is why both the tag and this paragraph arrived on the same day. Later that day we added AdSense, split the one question into the two above, and discarded every answer given to the old one.

How long we keep it

Your answers to the two questions, and any Google cookie set because of them, sit in your browser rather than with us; clearing this site's data removes them all. How long Google keeps what it sets is Google's to state, not ours, and its policy is linked above. Account and purchase records: while the account exists and for 12 months after the last access period ends, then deleted. Usage and activity records: 12 months. Visit records, including the IP address and any advert click identifier: 90 days, then deleted automatically. A click identifier attached to a purchase is part of that purchase record and is kept for as long as the purchase is. Mailing list records: while you are subscribed, and after you unsubscribe we keep the address and the consent and unsubscribe evidence as a suppression record, so that we can prove you consented and then honour your leaving. You can delete that record from the unsubscribe page, which also removes the protection it gives you. An address that never confirms is deleted after 30 days. The sign-up rate-limit log, which holds IP addresses, is kept for 30 days. Records we need to keep for tax or to handle a dispute are kept as long as that requires.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete your account and its data. Send the request through our contact page from the email address on the account. We reply within 30 days. Deleting your account ends any remaining access without refund. Data Google holds about you from its advertising is held by Google, not by us; you can see and change what it uses at Google's ad settings.

Transfers

Our processors store data in the European Union, the United Kingdom and the United States. They are bound by contracts that require them to protect it.

Children

The service is for adults preparing for airline selection. We do not knowingly collect data from anyone under 18.

Changes

We may update this policy. The date at the top shows the current version.