Privacy Policy

Metanoia Training and Consulting ("we", "us", "our") operates PassMaster at https://metanoiatraining.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in the European Economic Area, and applicable privacy laws in Jordan and the Middle East. By using PassMaster, you consent to the practices described in this Privacy Policy.

We collect the following categories of personal information: Account Information: When you register, we collect your name, email address, and password (stored as a secure hash). We never store your plain-text password. Usage Data: We automatically collect information about how you use the Service, including exam scores, time spent, questions answered, performance analytics, and session data. Payment Information: Payment transactions are processed by Paddle. We do not store your credit card number, CVV, or full payment details. We receive transaction confirmation, subscription status, and billing email from Paddle. Communications: If you contact us by email or through the Help Center, we retain those communications to respond to your inquiry and improve our Service. Technical Data: We collect IP address, browser type, device type, operating system, referring URLs, and pages visited for security and analytics purposes. Cookies: We use essential cookies for authentication and session management, and analytics cookies to understand how users interact with the Service. See our Cookie Policy for details.

We use your personal information to: • Provide, operate, and maintain the Service • Process your subscription and manage billing through Paddle • Send you transactional emails (account confirmation, password reset, subscription receipts) • Personalize your exam preparation experience and track your progress • Analyze usage patterns to improve the Service • Detect, prevent, and address technical issues and fraudulent activity • Comply with legal obligations • Respond to your support requests Legal Basis (GDPR): We process your data on the following legal bases: (a) performance of a contract — to provide the Service you subscribed to; (b) legitimate interests — to improve the Service and prevent fraud; (c) consent — for marketing communications and non-essential cookies; (d) legal obligation — where required by law.

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances: Service Providers: We share data with trusted third-party service providers who assist us in operating the Service, including: • Paddle (payment processing) — paddle.com • GoDaddy (hosting infrastructure) • Analytics providers (aggregated, anonymized data only) These providers are contractually obligated to protect your data and use it only for the purposes we specify. Legal Requirements: We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others. Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically: • Account data: Retained for the duration of your account plus 2 years after deletion • Exam results and analytics: Retained for the duration of your account • Payment records: Retained for 7 years as required by financial regulations • Support communications: Retained for 3 years You may request deletion of your account and associated data at any time by contacting us at [email protected]. We will process deletion requests within 30 days, subject to legal retention requirements.

Depending on your location, you may have the following rights regarding your personal data: Right of Access: Request a copy of the personal data we hold about you. Right to Rectification: Request correction of inaccurate or incomplete data. Right to Erasure: Request deletion of your personal data ("right to be forgotten"). Right to Restriction: Request that we limit the processing of your data. Right to Data Portability: Receive your data in a structured, machine-readable format. Right to Object: Object to processing based on legitimate interests or for direct marketing. Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are in the EU/EEA and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection authority.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include: • HTTPS encryption for all data in transit • Bcrypt hashing for all passwords • Secure session management with HTTP-only cookies • Access controls limiting employee access to personal data • Regular security reviews However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

PassMaster is operated from Jordan and serves users worldwide. Your information may be transferred to and processed in countries other than your country of residence, including the United States and European Union countries, where our service providers operate. For transfers from the EEA, we rely on Standard Contractual Clauses approved by the European Commission or other appropriate safeguards to ensure your data is protected.

PassMaster is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us at [email protected] and we will take steps to delete such information.

We use cookies and similar tracking technologies to enhance your experience. Essential cookies are required for the Service to function (authentication, session management). Analytics cookies help us understand usage patterns. You can control non-essential cookies through your browser settings or our cookie consent banner. Disabling essential cookies may prevent you from using certain features of the Service.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

The data controller for your personal information is: Metanoia Training and Consulting Amman, Jordan Email: [email protected] Phone: +962 79 850 0285 For privacy-related inquiries, data subject requests, or to report a concern, please contact us at the email above. We aim to respond to all privacy requests within 30 days.