Privacy policy
What is collected, why, where it lives, how long it stays, and how to get rid of it.
Last updated 12 September 2026
The short version
We store what is needed to give you a score and get it to you: your account email, your answers, your report, and for Speaking a recording that is deleted after 15 days. Telemetry from the practice course is anonymous. We do not sell anything to anyone, and we do not run advertising networks on the site.
What we collect
Account information
Your email address, your name if you give one, and an account identifier. Authentication is handled by Supabase Auth, which stores your password. We never see or store your password. If you set a study goal on the dashboard, the target band, exam date and weak sections you chose are stored against your account.
Test submissions
For every test you complete we store what you submitted and what came back: your answers, the essays or transcripts, the section and test taken, the full evaluation, the criterion bands and the overall level, plus the time it happened. This is what a report is, and it is kept so your report link keeps working and your score history stays intact.
Speaking recordings
Your speaking audio is uploaded to a private storage bucket that is not publicly readable. Playback and transcription both use short-lived signed links rather than a public URL.
Recordings are deleted after 15 days. That applies to standalone speaking tests and to the speaking leg of a full mock alike. The transcript and the scores are kept, so an older report still renders in full and only the audio playback goes away.
Email address
If you enter an email to receive a result, it is stored so the result can be sent, and it is recorded as a contact so we do not repeatedly mail an address that has already bounced. Addresses that hard-bounce or that report a complaint are added to a suppression list so we stop emailing them, which is a protection for you and for our ability to deliver mail at all.
Messages you send us
The contact form and the request-an-expert form send us your name, email, subject and message. They arrive by email and are kept as normal correspondence. Do not send anything sensitive through a form.
Practice course telemetry
The practice course records anonymous events: which module, which question, whether the answer was right, and when. These carry a random identifier generated in your browser, not your email. It is not joined to an account unless you happen to be signed in, and clearing your browser data creates a new one. It exists only so that forty answers can be told apart from forty people.
Payment information
We do not receive, see or store your card number, CVV or bank credentials. Payment happens on Razorpay's or PayPal's own pages. What comes back to us and is stored is the plan you bought, the amount and currency, the provider, the provider's order and payment identifiers, the period start and end, and the status.
Technical data
The site is hosted on Vercel, which records standard request information, and Vercel Web Analytics collects aggregate page-view data without cookies and without an individual profile. An administrative action taken in the admin panel is logged with its IP address, so privileged actions are attributable.
What we do not do
- We do not sell or rent personal data.
- We do not run third-party advertising or tracking networks on the site.
- We do not use your essays or recordings to train models. They are sent to the model provider to produce your report and for no other purpose.
- We do not ask for identity documents, immigration file numbers or any government identifier, and you should never send one.
Why we are allowed to hold it
- To perform the service you asked for: your account, your submissions, your report, your emailed results, your plan.
- Because we have to: payment and tax records.
- Because it is a legitimate interest: keeping the site working, preventing abuse, suppressing dead email addresses, and understanding in aggregate which practice modules are used.
- Consent where you gave it, for example handing over an email purely to receive a result. You can withdraw it by asking us to delete the address.
Who else processes your data
These are the services the site genuinely runs on. Each gets only what it needs.
| Service | What it handles |
|---|---|
| Vercel | Hosting and request serving, plus cookieless aggregate analytics |
| Supabase | Authentication, the database, and the private bucket holding speaking audio |
| Anthropic | Evaluating Writing and Speaking from your text or transcript |
| Deepgram | Transcribing speaking recordings |
| Resend | Sending results emails and follow-up notes |
| Razorpay and PayPal | Taking payment and managing subscriptions |
We also receive an internal alert when a submission is filed or gets stuck, so a failure is noticed and fixed. It carries operational detail about the submission, not your essay.
These providers operate in several countries, so your data is processed outside the country you live in. We share data with them only to run the service, never for their own marketing.
How long things are kept
| Data | Kept for |
|---|---|
| Speaking audio recordings | 15 days, then deleted automatically |
| Transcripts, answers, reports and score history | While your account exists, so your history stays intact |
| Account details | Until you ask for deletion |
| Email address held for results | Until you ask for it to be removed |
| Email suppression entries | Kept, so a dead or opted-out address is never mailed again |
| Payment and subscription records | As long as tax and accounting rules require |
| Anonymous practice telemetry | Kept in aggregate; it carries no identity to delete |
Cookies and local storage
The site uses what it needs to work: a session for signing in, and browser local storage for your progress inside a test, your place in the practice course, and the random identifier used by the anonymous telemetry. Vercel Web Analytics does not use cookies. There are no advertising or cross-site tracking cookies, which is why there is no consent banner. Clearing your browser data clears all of it.
Security
Passwords are held by Supabase Auth and never by us. Speaking audio sits in a private bucket reachable only through short-lived signed links. Database access from the site runs server-side, and row-level security is enabled so that direct client access can only ever read your own rows. The admin panel is password-protected, excluded from search engines, and logs its actions.
No system is perfectly secure. If you find a vulnerability, please report it to admin@celpipmocks.com before disclosing it.
Your rights
Depending on where you live you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, ask us to stop processing it, or object to a particular use. Exercise any of these by emailing admin@celpipmocks.com from the address on your account.
- We reply within 30 days.
- Deleting your account removes your profile, your submissions and your reports. Report links stop working, which cannot be undone.
- Payment records are kept where the law requires them, even after deletion.
- A suppression entry is kept after deletion on purpose, so a bounced or opted-out address is not emailed again by a future account.
- To stop the follow-up emails without deleting anything, reply and say so.
Children
The site is built for adults preparing for CELPIP and is not directed at children. We do not knowingly collect data from a child under 13. If you believe we have, write in and it will be deleted.
Changes
If this policy changes, the date at the top changes with it. A change that materially affects how existing data is used will be notified by email to account holders rather than published quietly.
Contact
Privacy questions and requests go to admin@celpipmocks.com. celpipmocks is an independent study site and is not affiliated with Paragon Testing Enterprises, and no data held here is shared with them.