Privacy Policy

This Privacy Policy describes what NCLEX Key LLC (“NCLEX Key,” “we,” “our,” “us”) collects, why we collect it, and what rights you have. It covers nclexkey.com and any connected services.

Short version: we collect what we need to run the product — your email, your study activity, your payment record — and nothing we don’t need. We don’t sell your data. We don’t use ad-tracking pixels.

1. Information we collect

You give us:

• Account info: email address, password (hashed), display name if you provide one
• Study data: questions attempted, answers, flags, notes, session timings
• Profile fields: target exam date, daily question goal (both optional)
• Support messages: anything you email us

Our payment processor gives us:

• Stripe customer ID, plan, purchase amount, purchase date, expiry date — we never see or store your full card number
• Billing name and country (where Stripe collects them)

We collect automatically:

• Browser type, general OS, screen size — for rendering the right experience
• Usage events on our own site: pages viewed, the page that referred you, campaign tags in links you followed (for example, a link in one of our emails), and actions such as starting a quiz or viewing pricing. These are linked to a random visitor ID stored in a first-party cookie (nclex_sess, 30 days) and, if you are logged in, to your account. We store a one-way hash of your IP address, not the address itself, to filter automated traffic and prevent abuse. These records are deleted after 90 days.
• Aggregate page views via Plausible Analytics (cookieless, IP-anonymized before storage)
• Server access logs (IP address, page requested, time) for security and troubleshooting, kept by our hosting provider and deleted on a rolling basis

From public sources (educators only):

• If you work at a nursing program, we may use the professional contact details your school publishes (name, title, institution, work email) to offer free resources for your students. We keep only those details and our correspondence. Reply “no thanks” or email us and we will not contact you again.

2. How we use the information

• To provide the product: show you the right questions, track your progress, display your performance
• To authenticate you and keep your account secure
• To send transactional emails: welcome message, password reset, purchase receipt, refund confirmation
• To send study and service emails unless you opt out: tips in your first week (Day 3 and Day 7), a reminder if you start checkout but don’t finish, a note when you finish your free questions, a reminder before your paid access ends, and exam-date reminders if you add an exam date to your profile. Each of these emails includes an unsubscribe link.
• To understand which pages, articles, and links are useful (for example, which ones lead people to sign up), using the usage events described above
• To process payments via Stripe and keep accurate purchase records for tax and audit purposes
• To debug problems and improve the product based on aggregate usage patterns
• To detect and prevent fraud, abuse, and unauthorized access

3. Legal basis (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland:

• Contract: to provide the Service you purchased
• Legitimate interest: to keep the platform secure, understand how the site is used, improve it, and contact educators about free resources
• Consent: for optional study and service emails (you can opt out anytime)
• Legal obligation: to keep purchase records for tax / audit

4. Who we share it with

We share the minimum necessary data with trusted service providers. We do not sell personal data. The providers we use:

We may disclose information if legally required (subpoena, court order, regulatory request) or to protect our rights or the safety of others.

5. Cookies and tracking

See our Cookie Policy for details. Short summary: we use login cookies and a first-party visitor ID cookie (nclex_sess) for our own usage statistics, Stripe sets cookies at checkout for fraud prevention, and Plausible uses no cookies at all. None of these are used for advertising.

6. Your rights

Depending on your jurisdiction, you may have rights to:

• Access the personal data we have about you
• Correct inaccurate data (you can update your email and name in your account page)
• Delete your account and associated personal data
• Export your study data in a portable format
• Opt out of non-transactional emails at any time (unsubscribe link in each nurture email)
• Object to processing based on legitimate interests
• Restrict processing in certain circumstances
• Complain to a supervisory authority (EU residents: your national DPA; UK: ICO)

California residents (CCPA / CPRA):

In the past 12 months, we have collected the categories listed above. We do not sell or share personal information as those terms are defined under California law, and we do not process sensitive personal information for inferring characteristics. You have the right to know, delete, correct, and limit use of sensitive personal information (we don’t do this to begin with). To exercise any right, email support@nclexkey.com with “CCPA request” in the subject. We will respond within 45 days.

7. Data retention

• Active accounts: we keep your data for as long as your account exists
• Closed accounts: study data is deleted within 30 days; purchase records are retained for 7 years to comply with tax law
• Usage events (our own site analytics): 90 days
• Server access logs: kept by our hosting provider and deleted on a rolling basis
• Email delivery and payment logs: up to 12 months
• Educator contact details used for outreach: until you ask us to remove them

8. Security

We protect your data with industry-standard measures: HTTPS everywhere, hashed passwords, database access restricted to the application, daily automated backups, and least-privilege operational access. No system is perfectly secure; if we become aware of a breach affecting you, we will notify you and the relevant authority within 72 hours where required by law.

9. International transfers

Our servers are in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed there. Where required by law (e.g., GDPR), we rely on Standard Contractual Clauses or an equivalent mechanism to protect transferred data.

10. Children’s privacy

NCLEX Key is not intended for anyone under 18. We don’t knowingly collect information from children under 13, and do not direct marketing to them. If you believe a child has created an account, email us and we will delete it.

11. Changes to this policy

When we make material changes, we will post the updated policy here and email registered users before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

12. Contact

Email support@nclexkey.com for any privacy question, data request, or concern. We respond within 5 business days (within 30 days for formal data requests).