Privacy policy

Scope and contact

This policy describes information used when you read Lusopasso materials, use free practice, subscribe to updates or create an account. Contact us with privacy questions or requests using the email below.

Optional account

We store your name, email, language, verification status, connected sign-in method and a protected password hash if you use a password. We use these to provide, authenticate and secure your account, confirm email and recover access. Free practice does not require an account. We do not request passports, NIF, residence documents or your personal immigration history.

Google sign-in

Google is optional and requests only basic identity, profile and email scopes. Google provides a stable account identifier, name, email and verification status for sign-in or a link you explicitly request. We do not receive your Google password, request Gmail, Drive or Contacts access, or retain Google access or refresh tokens. Revoking access in Google settings does not itself delete your Lusopasso account data.

Practice and browser storage

Free-practice answers and results are associated with a random guest identity; access information is stored in your browser. Guest access expires after 30 days. Clearing browser storage removes that browser’s saved access, but does not instantly delete server copies. This account release does not sync guest practice into accounts.

Cookies and preferences

Necessary session and security cookies support sign-in. Cookies and browser storage also keep language and browser preferences. You can delete or block storage in browser settings, but account or saved-practice features may stop working. Not all storage expires when the browser closes.

Account emails and updates

Resend delivers verification, recovery and separately subscribed update emails. Updates require separate email confirmation; use the unsubscribe link or contact us to stop them. Necessary account messages you request are separate. Email registration offers an optional newsletter checkbox, selected by default; you can clear it. A new Google registration automatically requests newsletter confirmation, while existing login or linking does not. Neither a default selection nor verified Google email activates a subscription: separate email confirmation is required. Prior opt-outs are preserved for automatic Google enrollment.

Usage measurement

Public pages use Google Analytics and OpenPanel for page and practice activity, language, topics and score ranges. These providers may receive network and device information; Google Analytics may use cookies. Application event payloads exclude names, email, account, guest and session identifiers, and secret token URLs. Private account, sign-in, recovery, verification and other private screens exclude analytics. The current notice is informational: closing it does not stop measurement. We also measure limited visit-source and campaign categories. Only these categories are kept in browser session storage, with a 30-minute validity after each update; full addresses, searches and arbitrary link-parameter values are not sent. A local flag can exclude browsers used for internal testing.

Providers and security

Hosting and infrastructure providers, Cloudflare for delivery and protection, Resend for email, Google for optional sign-in and analytics, and OpenPanel for usage measurement process information needed for their roles. Processing may involve countries outside your country. We use TLS in transit and access controls; perfect security cannot be guaranteed. Lusopasso does not sell data or use it for advertising targeting.

Retention

Account information remains until removal is requested and handled. Update records support subscriptions and proof of their status. Necessary security and operational records and protected backups may remain after live records change. No automatic backup deletion schedule is currently configured. Verification links last 24 hours; recovery links last 60 minutes. Link expiry does not immediately delete underlying records. Contact us about retention or removal.

Account learning history is stored with your account until the account is removed. Anonymous practice expires separately.

Your choices

Email us to request access, correction, deletion, a copy, or an objection or restriction of processing. We may verify your identity with proportionate account details; we do not ask for passports. These requests are handled through contact, not an automated self-service feature. You may contact your data protection authority, including Portugal’s CNPD. We update this policy when our practices change.