Privacy Policy

Last updated: 21 October 2026

CoatMentor (“we”, “us”) provides independent online exam-preparation practice for coating inspectors. This policy explains what personal data we collect, why, who processes it, and the choices you have. Questions: contact@coatmentor.com.

1. What we collect and why

Data	Why	When
Your email address and, if you use Google, your Google account identifier	To create your account, sign you in, unlock the tracks you have purchased, and count the six free AI-marked answers in the readiness check	When you sign in; kept while your account exists
If you sign in with an email code: your email address, which then identifies your account in the same way as a Google sign-in; the code itself, kept only as a scrambled value (hash) until it is used or 10 minutes pass; and a count of codes sent to the address, kept for one hour	To send you the code, check it and limit how many codes are sent	Only when you ask for a sign-in code
When you last used the members area (date and time)	To see whether members come back to practise, and to help with support questions	When you sign in or open the members area; kept with your account
Purchase details (email, order ID, which product)	To grant access to the product you bought and provide support	When you buy through our payment provider
Your confirmation that your access starts now (when you gave it, the wording version and the order it concerns)	Evidence that you asked for immediate access and acknowledged losing the right of withdrawal; a copy is emailed to you as your record	When you start your access to a newly bought track; kept with your account
An unfinished mock exam (your answers, including written answers you typed, and its timer)	So you can continue a long exam later, on any device you sign in on	While a mock is unfinished. It is deleted when you finish or discard it. If you do neither, it expires when your access to that track ends, and a daily clean-up job deletes it
A readiness-check result you choose to save: the date, your score by domain, and the exam date or window you gave	So the members area can show it and start your plan from it	Only when you click “Save my result” on the check’s report and sign in; the latest result per exam is kept with your account
A question you report as wrong or unclear, your note and your email	To check and correct the question, and to reply to you if needed	Only when you use “Report an issue” under a question — stored in our database and sent to us in a daily summary email
The email address you leave in the free readiness check, the exam you chose, your answer to “When is your exam?”, the country your connection comes from, and the ad-campaign tag of the link you came in on, if any	To email you the exam-day sheet, to send one reminder when your exam is one to six months away (three or ten weeks after you ask), and to learn which countries and channels bring visitors; a hashed, one-day count of requests per network limits how many sheets are sent	Only when you submit the signup form — stored in our database; we see new signups in a daily summary email that our own system sends us
Your practice progress: recent results, which questions you have seen, per-domain statistics, a review date for each question you answered, how sure you said you were, your results in the practical-station simulations (how often you tried each station, your last five results and your practical mock totals), your exam date and weekly study hours, time spent on questions per day, and your settings	So your plan, reviews and progress follow you when you sign in on another device	While you are signed in, each time you finish a practice set or mock or change your plan
If you turn on plan reminders: your email address and your exam plan	To email you on your planned mock days, the day before the exam and two days after it, and a short summary of your week each Monday	Only after you turn reminders on in the members area; off again with one tap
If you turn on notifications on a device: that device's push address, issued by your browser's push service	To send plan reminders to that device	Only after you turn notifications on; removed when you turn them off or delete your account
The exam result you report (passed or failed, the exam month) and an optional short review with your choice about being quoted	To extend your access after a failed exam, to count real results before ever publishing any, and to ask your permission before quoting a review	Only when you answer “How did your exam go?” in the members area
Your invite code, if the invite offer is available, and which orders used it	To give a colleague the discount and add the reward time to your access	When you open the invite card in the members area
Cookieless visit records: the time, the page or the name of a step you take (for example opening checkout), the referring site, the campaign tag, your country, the name of the network you connect through (your internet provider or a hosting company, for example “Comcast”, never your address), a note when the page stayed in view for 15 seconds or was scrolled halfway, a pseudonymous identifier that changes daily and, when an AI assistant opens the page for its user, the assistant’s name (for example “ChatGPT-User”). When one of our scripts fails, the page also sends a short error report: the file name, the line and up to 80 characters of the message. It holds no personal data, and at most three go out in a page load	To understand traffic, find broken scripts and improve the site	On each page view, step or script error — no cookies, no cross-site tracking. Kept for 25 months, then deleted
How you first reached the site in this visit (an ad campaign tag, the referring website such as “google.com”, or “direct”)	To learn which channels lead to purchases	Passed to our payment provider when you open checkout and stored with the order — kept apart from your name and email, but linked to your order number
Short-lived counters and markers: how many times today you used a limited feature (AI marking, question reports, expert-feedback requests, saved check results, sending anonymous answer counts), your count of free AI-marked answers, and a note of which reminder was sent last	To keep each feature within its daily limit, to give the six free AI-marked answers only once and not to send the same reminder twice	Usage counters last 2 days, reminder notes 40 days, and the free-answer count 400 days (it goes with your account)

We never receive or store your full payment-card details — those are handled entirely by our payment provider (see below).

Legal bases. Your account, purchases, sign-in, progress sync and the reminders you turn on: to provide the service you signed up for (contract). Readiness-check and launch emails: your consent, which you can withdraw at any time. Visit records, question reports and request limits: our legitimate interest in running and improving the site. Purchase records and your confirmation that access started: accounting and consumer-law obligations.

2. Data stored on your device

Your practice history and statistics, review schedule, exam plans, study time, reported results, practical-station record, settings, your cookie acknowledgement and a working copy of any unfinished exam, practical mock or written practice are stored in your browser (localStorage) on your device. Your answers in the free readiness check (so a reload does not restart it) are kept in session storage, which your browser clears when you close the tab. If you have purchased a track, a small offline practice pack (a sample of that track's questions, so you can practise without a connection) is also stored on your device (IndexedDB).

When you sign out, the app first uploads your progress. It then removes your data from the device: your practice history, saved mocks, typed written answers, the offline pack and the other stores listed above. Only small settings stay, such as your theme and your text size. If the last upload fails, your progress stays on the device and the app tells you, so that you do not lose it. You can also clear everything at any time through your browser settings.

A few small items on your device are not needed to run the service. Each one is listed here with what it does. None of them holds your name or your email address, and the service works without them. Clear them in your browser’s site settings at any time.

Item	Why	When
`cm_source` (session storage): where your visit began — an ad-campaign tag, the name of the referring site such as “google.com”, or “direct”	To learn which channels lead to purchases: it goes to our payment provider when you open checkout and is stored with the order	Set on the first page of a visit; removed when you close the tab
`cm_checkout_why_shown` (session storage): a flag	So the one-question card “Didn’t go ahead with checkout?” shows once in a tab, not again and again	Set when the card is shown; removed when you close the tab
`cm_purchased` (local storage): a flag	So that card does not show for someone who has bought	Set when you come back from checkout; stays until you clear your browser data

Other small items remember a choice or your place: that you closed the cookie notice (cm_consent), a hint that you are signed in, so the header says “Members” (cm_member), the tab you last opened in the members area (cm_tab), that you closed the prompt to install the app (cm_install_dismissed) and your answers in the free readiness check (cm_check).

3. Cookies

We use a single strictly necessary cookie:

cm_session — an HttpOnly cookie that keeps you signed in for 30 days after you sign in with Google or an email code. It is required for the members area to work.

We do not use advertising, marketing or third-party tracking cookies. Our analytics are cookieless. No consent is needed for the one cookie we set, because it is essential. The notice banner is an acknowledgement, not a consent choice. Section 2 lists what else we keep on your device and what each item does.

4. Who processes your data

We use a small number of trusted providers to run the service:

Google Sign-In — authentication. Where a Google sign-in button can appear (the members area, and the FROSIO readiness check when you are signed out), your browser loads Google’s sign-in script from Google’s servers, and Google receives your IP address and browser details with that request (policy).
YouTube (Google) — the walkthrough videos on the home page and the exam pages show a local preview image first and load from youtube-nocookie.com only when you press play; if you do, Google receives your IP address and browser details (policy).
Lemon Squeezy — our payment provider / merchant of record (policy).
Cloudflare — hosting and secure storage of your account, entitlement and in-progress exam, and the daily summary email of new signups, question reports and feedback requests that our system sends to us through Cloudflare Email Routing (policy).
Our own analytics — we count visits ourselves, on our own infrastructure (Cloudflare), without cookies: your IP address and browser type are combined with the date and a secret value to compute a pseudonymous identifier that changes daily, and the IP address itself is never stored. Without the IP address, the identifier cannot be linked across days. Each record keeps the time, page, referring site, campaign tag, country and the name of the network you connect through (your internet provider or a hosting company), and the name of the AI assistant when one opened the page for its user. A page also notes once when it stayed in view for 15 seconds or was scrolled halfway, so we can tell readers from automated visits. When one of our scripts fails, the page also sends a short error report: the file name, the line and up to 80 characters of the message. It holds no personal data, and at most three go out in a page load. We keep these records for 25 months. When you finish or leave a practice set, or finish a mock exam, we also add your answers to anonymous per-question counts (how often each question is answered, answered correctly, and which option is picked), so we can find and fix unclear or wrong questions. These counts carry no name, email, account or visit identifier, and cannot be traced back to you.
AI marking providers (Google Cloud Vertex AI, Anthropic, OpenRouter, Groq, Cloudflare Workers AI) — AI marking of FROSIO written answers: in the paid FROSIO written track, and for up to six answers in the free readiness check when you are signed in and ask for it. When you submit a written answer for marking, the answer text you typed is sent to one of these providers to compare it against the model answer and pre-fill your marking checklist. We try them in order — Google’s Gemini on Vertex AI first, then Anthropic’s Claude, then OpenRouter, then Groq, then Cloudflare Workers AI — moving to the next only if one is unavailable, so a given answer is sent to whichever provider handles it. Google does not use answers sent to Vertex AI to train its models, and neither does Anthropic for answers sent through its API. Through OpenRouter we only allow providers that neither store your answer nor train on it. Only the answer text is sent: never your name, email or account identifier. They process it under Google Cloud’s privacy notice, Anthropic’s privacy policy, Groq’s privacy policy, Cloudflare’s privacy policy and OpenRouter’s privacy policy. The free readiness check is marked in your own browser, except the FROSIO answers a signed-in visitor chooses to have AI-marked; those are sent in the same way. If no provider is available, you mark your answers yourself instead.
Your browser's push service (for example Google, Apple or Mozilla) — delivers notifications when you turn them on; the message carries no content about you.
Google Gemini free tier — no longer used since 17 October 2026. Earlier versions of the site sent some FROSIO written answers to it for AI marking, on its free tier, where Google may use what it receives to improve its products. What it received then stays with Google under its Gemini API terms.
Web3Forms — no longer used. Earlier versions of the site relayed the free-check email signup, the launch-notification signup and written answers sent for expert feedback through it. We closed the account on 19 October 2026. Web3Forms removes it 30 days later, with its forms and everything they received; until then that data stays with Web3Forms under its policy.
Resend — delivers the sign-in code when you choose to sign in with an email code, the exam-day sheet you ask for in the readiness check and the one reminder before your exam, plan reminders when you turn them on, and the email that confirms you started your access (policy).

Your data may be processed on these providers’ infrastructure, which may be located outside your country. Their policies, linked above, describe the safeguards they use when personal data leaves the EU, the EEA or the UK, such as the European Commission’s standard contractual clauses.

Daily summary emails and messages to contact@coatmentor.com are read in CoatMentor’s mailbox. We answer a member’s own request, such as a question report or an expert-feedback request, from that address.

5. How long we keep it

Account record: kept while your account exists.
Purchase records, with your confirmation that access started: kept for as long as accounting rules require, also after you delete your account. While your access term runs, signing in again with the same email restores your access.
Readiness-check and launch emails: the address is removed from our records 120 days after you leave it, after the one reminder you asked for, or earlier when you delete your account. The daily summary email that our system sends to our mailbox shows only its first letter and its domain (for example a***@example.com). Write to us to delete the address sooner.
Question reports and expert-feedback requests: kept while your account exists and deleted with it. The copy in our daily summary email stays in our mailbox.
Practice progress and plan: kept while your account exists and deleted with it.
Reported exam results and reviews: kept while your account exists; a review is never published without your consent and a person’s check.
Unfinished mock exam: deleted as soon as you finish or discard it. If you do neither, it expires when your access to that track ends, and a daily clean-up job deletes it.
Visit records, with the script error reports: kept for 25 months, then deleted.
Short-lived counters and markers: usage counters 2 days, reminder notes 40 days, and the free AI-marking count 400 days (it goes with your account).
Anonymous per-question counts: kept, since they contain nothing that identifies you.
Our providers’ own records: each provider keeps its own logs under its own policy, for example Resend’s log of the emails it delivered and Lemon Squeezy’s record of your order.
On-device data: your progress and saved work are removed when you sign out (section 2). Anything left stays until you clear it, and session storage clears when you close the tab.

6. Your rights

You can ask us to access, correct or delete your personal data, to restrict or object to its use, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time. You can also complain to the data protection authority where you live or work. In the members area, Me → Your data lets you download your data and delete your account yourself. The download holds your study data and the records we keep for your account: the account, the purchase record, reported exam results, saved checks, your invite code, question reports and feedback requests, and your sign-ups. You can also email contact@coatmentor.com from the address you signed in with.

Deleting your account removes your progress, plans, review cards, saved mocks, reported results, saved checks, question reports and feedback requests, invite code, notification registration and sign-in record, and your sign-ups for the exam-day sheet, its reminder and the launch waitlist. Your purchase record, with your confirmation that access started, is kept, as accounting requires, so signing in again with the same email gives back the access you bought. To clear only on-device data, you can do that in your browser.

7. Children

CoatMentor is a professional certification-preparation tool and is not directed at children under 16.

8. Changes to this policy

If we change this policy we will update the date at the top of this page. Continued use of the service after a change means you accept the updated policy.

CoatMentor is independent and not affiliated with AMPP, NACE International, or FROSIO. All trademarks are the property of their respective owners.