Privacy Policy

ExcelReady ("we", "us", "our") runs the website at excelready.app and the online Excel-practice service on it (the "Service"). We decide how and why your personal data is processed, so we are the data controller (or "data user" under Malaysian law) for it.

This Privacy Policy explains what personal data we collect, how we use and share it, how long we keep it, and the rights you have. It applies to everyone who uses the Service, wherever they live. It is written to meet the Personal Data Protection Act 2010 of Malaysia (as amended), the EU and UK General Data Protection Regulation ("GDPR"), US state privacy laws such as the California Consumer Privacy Act ("CCPA"), and similar laws elsewhere. It forms part of our Terms of Service.

You can contact us about anything in this policy, including to exercise your rights, at hello@excelready.app. This is also the contact for our data protection officer.

• You can try the first lesson without giving us any personal data. Your progress stays in your own browser.
• If you create an account, we keep your email address, a securely hashed version of your password (never the password itself) and your lesson progress.
• Payments are handled by Stripe. We never see or store your full card number.
• We do not sell your personal data, share it for targeted advertising, or use advertising or analytics trackers.
• We use only the cookies and browser storage needed to run the Service and remember your settings.
• You can ask to see, correct, export or delete your data at any time by emailing us.

Data you give us

• Account data: your email address and password. We store only a salted, one-way hash of your password, created with a strong algorithm (scrypt).
• Learning data: the lessons you start, complete or skip, your current step, points, streak and active days, your chosen keyboard (Mac or Windows), and, if you use the "Plan my prep" feature, your goal and the date of your interview or test.
• Certificate name: the name you type to appear on your certificate of completion.
• Waitlist data: if you join a waitlist, your email address and the goal you choose.
• Messages: what you write when you email us, and our replies.
• What you type in the practice spreadsheet: this is processed in your browser to check your answers. Please do not type personal or confidential information into it.

Data we collect automatically

• Technical and log data: your IP address, browser and device type, the pages and files requested, date and time, and error information. Our hosting provider records this in server logs, and we use IP addresses briefly to limit repeated login attempts.
• Session data: a random sign-in token stored in a cookie, so you stay logged in. We store only a hashed copy of it.
• Browser storage: your progress and theme setting, stored in your own browser (see section 7).

Data we receive from others

• Stripe (payments): when you buy a plan, Stripe tells us your customer ID, email, the plan, payment status, subscription status and renewal dates, and the country of your payment method. Stripe collects your card and billing details directly; we do not receive your full card number.
• Resend (email delivery): whether an email we sent was delivered or bounced.

What we do not collect. We do not ask for, and you should not send us, sensitive personal data such as health information, religious beliefs, political opinions, biometric data, government ID numbers or financial account details. We do not use automated decision-making that has legal or similarly significant effects on you.

Is giving data required? You can use the first lesson without giving us any personal data. An email address and password are required to create an account, and payment details are required to buy a plan; without them we cannot provide those parts of the Service. Everything else is optional.

We use personal data only for the purposes below. Where the GDPR applies, each purpose relies on the legal basis shown.

Where we rely on legitimate interests, we have balanced them against your rights and you can object (see section 10). Where we rely on consent, you can withdraw it at any time without affecting what we did before. Under Malaysian law, by using the Service and giving us your data, you consent to its processing for these purposes.

We will only use your data for a new purpose that is compatible with these, or after telling you and, where required, asking for your consent.

We do not sell or rent your personal data, and we do not share it with third parties for their own marketing or for cross-context behavioural advertising. We share it only with:

Our service providers act on our instructions, may use your data only to provide their services to us, and must protect it. Stripe also acts as an independent controller for some payment data under its own privacy policy.

We serve users worldwide, so your data will be processed outside your country, including in the Netherlands, the United States and Malaysia. Some of these countries may not have data-protection laws equivalent to yours. When we transfer personal data, we take steps required by law to protect it, such as relying on the European Commission's Standard Contractual Clauses (and the UK addendum), the EU-US Data Privacy Framework where a provider is certified, and contracts that require providers to protect your data. Where Malaysian law applies, we transfer data outside Malaysia only as permitted by the Personal Data Protection Act 2010, including where the transfer is necessary to provide the Service you asked for or you have consented to it.

We use only strictly necessary cookies and browser storage. We do not use advertising cookies, cross-site tracking or third-party analytics. Because these are needed for the Service to work or to remember a choice you made, they do not require a cookie banner in most countries.

You can block or delete cookies and storage in your browser settings, but signing in and saving progress will not work without them.

We keep personal data only as long as we need it for the purposes in this policy:

When you delete your account, we delete or anonymise your account and learning data within 30 days, except data we must keep by law or to resolve disputes, prevent fraud or enforce our Terms of Service. Backups are overwritten on a rolling basis.

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS) for all traffic, salted password hashing, hashed session and reset tokens, limits on login attempts, access controls, and keeping our software up to date. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a personal data breach is likely to put your rights at risk, we will notify the relevant data protection authority and you where the law requires, within the time it sets. You can help by using a strong, unique password and keeping it private.

Depending on where you live, you have some or all of these rights over your personal data:

• Access: ask for a copy of the personal data we hold about you and how we use it.
• Correction: ask us to correct data that is inaccurate, incomplete, misleading or out of date.
• Deletion: ask us to delete your data, subject to legal exceptions.
• Portability: receive your data in a structured, machine-readable format, or have it sent to another provider where technically possible.
• Withdraw consent: where we rely on consent, withdraw it at any time.
• Object or restrict: object to processing based on legitimate interests, or ask us to limit how we use your data.
• Prevent direct marketing: ask us to stop any marketing at any time. Every marketing email includes an unsubscribe link.
• Prevent processing likely to cause damage or distress, where the Malaysian Personal Data Protection Act 2010 gives you that right.

To use any of these rights, email hello@excelready.app from the email address on your account. We may need to verify your identity before acting, and you may use an authorised agent where the law allows. We will respond within the time the law requires, normally within 21 days (Malaysia) or one month (GDPR), and tell you if we need more time. We do not charge a fee unless a request is clearly unfounded or excessive, or the law allows one. We will never treat you differently for exercising your rights.

You also have the right to complain to a data protection authority, such as the Personal Data Protection Commissioner of Malaysia, your local supervisory authority in the EU or EEA, or the UK Information Commissioner's Office. We would appreciate the chance to resolve your concern first, so please contact us.

In the last 12 months we have collected these categories of personal information: identifiers (email address, IP address, customer ID); commercial information (plans bought, payment and subscription status); internet or network activity (log and session data, learning progress); and account log-in details (email and hashed password). We collect them from you, your device and Stripe, for the purposes in section 4, and disclose them only to the recipients in section 5 for business purposes.

We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We use account log-in details only to provide and secure the Service. We do not knowingly sell or share the personal information of anyone under 16. Subject to applicable state law, you have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights. To make a request, email hello@excelready.app.

The Service is not directed to children under 13, and we do not knowingly collect personal data from them. Users aged 13 to 15 (or under the age of digital consent where they live) may use the Service only with the consent of a parent or guardian. If you believe a child has given us personal data without the required consent, contact hello@excelready.app and we will delete it.

We send service emails that are needed to run your account, such as the welcome email, password resets, receipts and notices about your plan or these policies. You cannot opt out of these while you have an account, but they will not contain advertising beyond information about the Service. We will only send marketing emails if you have agreed to receive them, and you can unsubscribe at any time.

The Service may link to other websites and services, such as Stripe's checkout. Their privacy practices are their own, and we are not responsible for them. Please read their privacy policies.

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date. If we make material changes, we will tell you by email or on the Service before they take effect and, where the law requires, ask for your consent.

For privacy questions, requests or complaints, contact us at hello@excelready.app. We aim to reply within 3 business days and to complete requests within the time the law allows.

This policy is written in English. If we provide a translation, including a Bahasa Malaysia version, and there is a conflict, the version required by applicable law prevails; otherwise the English version prevails.

ExcelReady is not affiliated with or endorsed by Microsoft. Excel is a trademark of the Microsoft group of companies.