Privacy Policy — ParaCrash

Introduction

About this policy

This Privacy Policy explains how Nexi Bot LTD, trading as ParaCrash ("we", "us", "our"), collects, uses, stores, and shares your personal data when you use paracrash.uk. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By creating an account or using our platform you acknowledge that you have read this policy. If you have any questions, email us at [email protected].

Section 1

What data we collect

1.1 Account data

First name and last name
Email address (stored encrypted)
Hashed password (bcrypt — we cannot see your password)
Date and time of account creation
Email verification status

1.2 Subscription and billing data

Stripe customer ID and subscription ID (references only)
Subscription status and billing dates
Payment success/failure history from Stripe webhooks

We do not store your full card number, CVV, or expiry date. All card data is processed and stored by Stripe, Inc. under their PCI DSS compliance programme. See stripe.com/privacy.

1.3 Usage and progress data

Modules accessed and time spent
Practice exam results and scores
AI patient simulation history — condition, score, grade, duration
Login dates and session activity

1.4 Technical data

IP address (for session security and fraud prevention)
Browser type and version
Device type and operating system
Session cookies (required for login)

1.5 AI interaction data

Important: When you use the AI patient simulator, the text you type is transmitted to Anthropic, Inc. (USA) for processing by their Claude AI model. We strongly advise you never to enter real personal data, patient data, or sensitive information into AI input fields. Anthropic processes this data under their own Privacy Policy. ParaCrash stores only the simulation outcome (score, grade, duration) — not the full conversation text.

Section 2

How we use your data

Purpose	Legal basis (UK GDPR)
Provide platform access and features	Performance of contract
Process subscription payments	Performance of contract
Send transactional emails (verification, billing, subscription)	Performance of contract / Legitimate interests
Track and display your learning progress	Performance of contract
Prevent fraud and secure the platform	Legitimate interests
Improve the platform and fix technical issues	Legitimate interests
Comply with legal obligations (e.g. financial records)	Legal obligation
Send optional review invitations via Trustpilot AFS	Legitimate interests

We do not use your data for advertising, profiling, or sell it to any third party.

Section 3

Third-party services and data sharing

We share data with the following third parties only where necessary to operate the platform:

3.1 Stripe, Inc. (payment processing)

Stripe processes your payment card data securely. We share your name, email, and subscription details with Stripe. Stripe is PCI DSS Level 1 compliant. Data may be processed in the US and EU. See stripe.com/privacy.

3.2 Anthropic, Inc. (AI processing)

When you use AI features, your text inputs are sent to Anthropic's servers (USA) for processing by Claude AI. Anthropic is the data processor for this activity. See anthropic.com/privacy. Do not enter personal data into AI fields.

3.3 Trustpilot A/S (review invitations)

Following signup or subscription activation, your name and email address may be shared with Trustpilot via their Automatic Feedback Service (AFS) so they can send you a review invitation on our behalf. This is done in accordance with Trustpilot's privacy policy at trustpilot.com. You may opt out of review invitations by following the unsubscribe link in any Trustpilot email.

3.4 Hosting provider

Our platform is hosted on servers located in the UK/EU. Your data is stored on our database hosted by our server provider.

3.5 PHPMailer / email delivery

Transactional emails are sent via our server's mail service. Your name and email address are used for delivery.

We do not share your data with any other third parties unless required by law.

Section 4

International data transfers

Some processors (Stripe, Anthropic) operate in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions). Anthropic's data handling is governed by their own Privacy Policy.

Section 5

Data retention

Active accounts: Data retained for the lifetime of your account
Cancelled subscriptions: Account data retained for 12 months, then deleted or anonymised
Billing records: Retained for 7 years to comply with UK financial regulations
Email logs: Retained for 12 months
Session data: Cleared on logout or after 30-day inactivity

Section 6

Cookies

Session cookie (PHPSESSID): Required for login. Expires when you close your browser or after 30 days if "Remember me" is selected. This is strictly necessary and cannot be opted out of.
Remember me cookie: Set only if you choose "Remember me" at login. Expires after 30 days.

We do not use advertising cookies, tracking pixels, or analytics cookies. No third-party cookies are set by ParaCrash itself.

Section 7

Your rights under UK GDPR

Right of access: Request a copy of the data we hold about you
Right to rectification: Correct inaccurate or incomplete data
Right to erasure: Request deletion ("right to be forgotten") — subject to legal retention requirements
Right to restrict processing: Ask us to limit how we use your data
Right to data portability: Receive your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interests
Right to withdraw consent: Where processing is consent-based, you may withdraw at any time

To exercise any of these rights, email [email protected]. We will respond within 30 days. You may also lodge a complaint with the ICO at ico.org.uk.

Section 8

Children's privacy

ParaCrash is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at [email protected] immediately and we will delete the account.

Section 9

Security

We implement appropriate technical and organisational measures to protect your data, including:

Passwords stored using bcrypt hashing (never in plain text)
Personal data encrypted at rest using AES-256-GCM
HTTPS enforced across all pages
Parameterised database queries to prevent SQL injection
Session security controls and HMAC-blind indexed lookups
Access to production systems restricted to authorised personnel

No system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO as required by law.

Section 10

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. The current version is always available at paracrash.uk/privacy.php.

Section 11

Contact and complaints

Nexi Bot LTD (trading as ParaCrash)
Company number: 16502958
ICO registration: ZB910034
Registered address: Suite 627, 80A Ruskin Ave, Welling DA16 3QQ
Email: [email protected]
If you are not satisfied with how we handle your data, you may raise a complaint with the ICO at ico.org.uk.