Privacy Policy

We collect:

• Account data — your email address, and your name if you sign in with Google.
• Email list data — if you ask for guide updates, the email address you give us and whether you have unsubscribed.
• Usage data — your practice attempts, mock-exam results and progress, so we can show your stats and readiness.
• Billing data — if and when paid plans launch, your subscription status and a Stripe customer reference. We do not store your card details; all payments are handled by Stripe.
• Technical data — basic logs needed to operate and secure the Service.

Getting Gulf-licensed involves handing sensitive documents to a lot of parties. We are not one of them. GulfNursePrep does not ask for, collect or store passport scans, degree certificates, transcripts, Good Standing certificates, DataFlow uploads, visa paperwork or any other licensing document. Please do not send them to us — if you do, we will delete them. Only the official portal for your authority, and the verification or attestation providers it names, should ever receive those files.

To provide and personalise the Service, track your progress, send guide updates you asked for, process subscriptions if you take one, communicate with you about your account, and keep the Service secure and working. We do not use your data to make automated decisions about you.

We share data only with service providers that help us run GulfNursePrep:

• Stripe — payment processing and billing.
• Supabase — database hosting.
• Vercel — application hosting.
• Resend — sending our emails and holding our mailing list.
• Google— optional "Sign in with Google".

We do not sell your personal data, and we do not share it with recruitment agencies, employers or licensing consultants.

We use a secure, essential cookie to keep you logged in. We do not use third-party advertising cookies.

We keep your data while your account is active. If you delete your account, we delete or anonymise your personal data, except where we must retain limited records (e.g. payment records) to meet legal obligations. You can leave the mailing list at any time using the unsubscribe link in any email.

Under the PDPA you may request access to, or correction of, your personal data, and may withdraw consent or ask us to delete your account. Contact us using the details below.

We use industry-standard measures (encryption in transit, hashed passwords, access controls). No system is perfectly secure, but we work to protect your data.

Privacy questions or requests: reach us through our feedback form.