One page: what DrillCase collects, the reason and legal basis for each item, how long we keep it, who else handles it, every cookie we set, and how to get your data shown, fixed or deleted.
01
Who we are
Controller
DrillCase, the online practice site at drillcase.com. We decide how the data on this page is used.
644 Strander Blvd, Tukwila, WA 98188, United States
02
What we collect, entry by entry
Each entry reads left to right: what we hold, why, the legal basis, how long we keep it, and who handles it with us.
EntryWhyLegal basisKept forHandled by
01
Plan and practice emails
your email address
the test you're preparing for, your test date, invitation length, minutes a day and time zone
which form you used and how you found us (the source tags below, when cookies allow)
the exact consent wording you ticked, when, and a one-way hash of your IP address as proof (never the IP itself)
Why
To send the plan and the emails you asked for, and to prove you asked for them.
Legal basis
Your consent. Withdraw it any time with the unsubscribe link in every email.
Kept for
Until you unsubscribe. Addresses never confirmed are deleted after 30 days. After you unsubscribe we keep your address on a do-not-email list so it stays unsubscribed.
Handled by
Resend (sending), Cloudflare (hosting and database)
02
Email delivery records
whether each email was delivered, bounced or marked as spam
clicks on links in our emails, counted by our own redirect
we do not track whether you open an email
Why
To stop sending to addresses that bounce or complain, and to see which emails help.
Legal basis
Legitimate interests: keeping mail wanted and deliverable.
Kept for
As long as the contact record it belongs to.
Handled by
Resend, Cloudflare
03
Orders
your email, the product, price paid, any coupon, order number and time
how you found us (source tags and Google Analytics ids), when cookies allow
Why
To deliver what you bought, send your receipt, handle refunds and keep accounts.
Legal basis
Performing our contract with you; keeping accounting and tax records we are required to keep.
Kept for
As long as accounting and tax rules require for the order.
Handled by
Polar (checkout and payment, merchant of record), Resend (receipt), Cloudflare
04
Your account
your email address and sign-in id
with Google sign-in: the name and profile picture Google shares
practice results: answers, scores, times and plans
Why
To sign you in, unlock what you bought and save your progress.
Legal basis
Performing our contract with you.
Kept for
Until you ask us to delete your account.
Handled by
Google Firebase Authentication (sign-in), Cloudflare
05
Site events
a random visit id (the dc_aid cookie), when cookies allow
what happened (for example: a free demo was finished, a form was viewed), the page path without its query, source tags and the time
Why
To count which pages, demos and links lead people to sign up or buy.
Legal basis
Your consent in the UK, the EEA and Switzerland (the cookie choice); our legitimate interests elsewhere.
Kept for
400 days, then deleted.
Handled by
Cloudflare
06
Security and access logs
your IP address, for short-lived rate-limit counters on forms and sign-in
your IP address and browser type, logged when you download a purchase or open a product page
Why
To stop spam and abuse, and to spot shared or stolen download links.
Legal basis
Legitimate interests: keeping the service and your purchase safe.
Kept for
Rate-limit counters expire within minutes. Download and page logs are not yet deleted on a schedule; ask and we delete yours.
Handled by
Cloudflare
07
Messages to support
what you write to us and the address you write from
Why
To answer you.
Legal basis
Legitimate interests: helping you.
Kept for
As long as needed to answer and follow up.
Handled by
Our email provider
We make no decisions about you by automated means that have legal or similarly significant effects. Practice scores are feedback for you, nothing more.
03
Every cookie, and whether it's in your browser now
The last column checks this browser live. In the UK, the EEA and Switzerland the analytics cookies wait for your yes. Without it, Google Analytics still receives basic cookieless signals (for example, that a page was viewed) with no identifier stored on your device.
Checking this browser…
Cookies and browser storage used on drillcase.com
Name
Set by
What it does
Lasts
Asks first?
In this browser
dc_region
DrillCase
Remembers whether we need to ask you about cookies. Holds only a letter, no id.
1 day
Needed for the choice itself
checking…
dc_consent
DrillCase
Remembers your cookie choice.
180 days, then we ask again
Needed for the choice itself
checking…
dc_aid
DrillCase
A random id for this browser, so a sign-up or order can be linked to the visit that led to it.
365 days
Yes in the UK, EEA and CH
checking…
dc_ft
DrillCase
Where your first visit came from: campaign tags, landing page, referring site.
90 days
Yes in the UK, EEA and CH
checking…
dc_lt
DrillCase
The same, for your latest visit that came from a link or campaign.
30 days
Yes in the UK, EEA and CH
checking…
_ga
Google Analytics
Tells Google Analytics one browser from another.
Up to 2 years
Yes in the UK, EEA and CH
checking…
_ga_FSC2Y54RKE
Google Analytics
Keeps the state of your current visit.
Up to 2 years
Yes in the UK, EEA and CH
checking…
Sign-in storage
Google Firebase
Keeps you signed in (browser storage, not a cookie). Only after you sign in.
Until you sign out
Needed for sign-in
browser storage
Practice storage
DrillCase
Some practice tools keep your scores and notes in your browser. They stay on your device.
Until you clear them
Needed for the tool
browser storage
Cookies set by DrillCase are first-party: they are read by our pages and sent with sign-ups and orders so we can tell which pages and links work. We use no advertising cookies.
04
Who handles it with us
CloudflareHosting, database, security and rate limits
ResendSending our emails
PolarCheckout and payment, as merchant of record
GoogleAnalytics, Firebase sign-in, and the icon font our pages load
UnsplashServes some photos on our pages
International transfers
Several of these providers are based in the United States or run servers there, so your data may be processed outside the UK and the EEA. We rely on the transfer safeguards each provider sets out in its data processing terms. Ask us for details at support@drillcase.com.
Links to WhatsApp, Facebook, TikTok, LinkedIn and YouTube send nothing to those sites until you click them. If we switch on Cloudflare's bot check on a form, Cloudflare also sees your visit to that form.
05
Your rights, one email away
Each slip opens an email to support@drillcase.com with the request already named. We answer within one month. To stop emails, the unsubscribe link in any of them works at once, with no email needed.
Withdrawing consent doesn't affect what we did with your data before you withdrew it.
Not happy with our answer? You can complain to your data-protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EU or EEA the authority where you live or work, in Switzerland the FDPIC.
Changes to this page change the version and date at the top. The wording you agreed to when you signed up for emails is stored with your record; new wording is a new version, never an edit of the old one.