Privacy policy

Gotitly is run by Orb Global Ltd (“we”), 7 Bell Yard, London, WC2A 2JR, United Kingdom. We are the controller of the personal data described here. This policy explains what we collect when you use our website and apps, why we collect it and the rights you have under the UK GDPR and the Data Protection Act 2018.

What we collect

• Account details: your name and email address, and a securely hashed password if you set one. If you sign in with Google or Apple, they give us your name, your email address (Apple lets you hide it behind a relay address) and an identifier for your account with them.
• Learning data: your answers, confidence ratings, timings, mock results and tutor conversations.
• Billing data: your plan, your subscription status and the reference of each purchase. Card details are handled by Stripe, Apple or Google, not us.
• Technical data: device and browser information, your IP address and security logs.
• Analytics and advertising data, only if you allow it. See “Cookies and similar technologies” below.

Voice commands in the apps' hands-free mode are turned into text by your phone's own speech recognition (Apple's or Google's), which may send the audio to their servers. We receive only the command, never the recording.

Why we use it

• To run your study plan, spaced repetition schedule, readiness score and tutor (performance of our contract with you).
• To take payments, manage your subscription and send you service emails, such as sign-in links and a reminder before a free trial ends (performance of our contract with you, and our legal obligations).
• To keep the service secure and prevent abuse (legitimate interests).
• To measure how the service and our advertising perform, only if you allow it (your consent).

We do not sell your data, and we make no decisions about you by automated means that have a legal effect on you.

AI tutor

Tutor messages are sent to our AI provider, Anthropic, which generates the replies on our behalf. Under its terms, Anthropic does not use these messages to train its models. Please don't put sensitive personal information in a tutor message.

Who we share it with

We use these companies to run Gotitly. Each may use your data only to provide its service to us.

• Microsoft Azure: hosting, our database and email delivery. Our servers and database are in the United Kingdom.
• Stripe: payments made on the website.
• Apple and Google: purchases made in the apps, and sign-in if you choose it.
• RevenueCat: keeps the record of purchases made in the apps. It receives an account number and your purchase history, not your name or email address.
• Anthropic: the AI tutor, as described above.
• Google and the advertising platforms listed below: analytics and ad measurement, only if you allow it.

We also share data where the law requires us to.

Transfers outside the UK

Some of these companies process data in other countries, including the United States. When they do, the transfer is covered by UK adequacy regulations (including the UK–US data bridge) or by standard contractual clauses approved for transfers from the UK.

Your rights

You can ask for a copy of your data, have it corrected or deleted, object to how we use it or ask us to restrict that use, and withdraw a consent you gave. You can delete your account and all your learning data at any time from Settings; how to delete your account explains what is removed. To use any other right, email support@gotitly.com. We reply within one month. You may also complain to the Information Commissioner's Office (ico.org.uk).

Cookies and similar technologies

We set a few cookies of our own that the site needs to work. Analytics and advertising tools load only if you allow them, and nothing of theirs runs before you choose. You can change your choice at any time with “Cookie settings” at the bottom of our public pages or in Settings in the app. If your browser sends a Global Privacy Control signal, advertising stays off unless you switch it on yourself. Strictly necessary cookies need no consent; for everything else we rely on the consent you give in that choice. Not every tool listed below is switched on at all times, and a tool that is off sets nothing.

Our own cookies

• gt_at, gt_rt (strictly necessary): keep you signed in. Up to 15 minutes and 30 days. Not readable by scripts.
• gt_meta (strictly necessary): a signed note of your account type, so the right pages open. 30 days.
• gt_oauth (strictly necessary): protects a Google or Apple sign-in while it is in progress. 10 minutes.
• gt_ml (strictly necessary): marks the browser that asked for a sign-in email, so the link signs you in there. 15 minutes.
• gt_ev (analytics helper): a one-off note that you just signed up or signed in, and how. It holds no identity, is read only if you allow analytics, and is deleted when read or after 5 minutes.
• gt_consent (strictly necessary): remembers your cookie choice. 180 days.
• acaAffinity (strictly necessary): set by our hosting provider (Microsoft Azure) so that your requests keep reaching the same server while you are signed in. It holds a random routing value, not your identity, and lasts for your browser session.
• gt_attr (only with your permission): how you first and most recently reached Gotitly, such as the campaign or website that linked to us. Ad click IDs are kept only if you allow advertising. 90 days.

Analytics (only if you allow analytics)

• Google Analytics (Google): which pages and features are used, on our public pages and in the app. Cookies _ga and _ga_*, which last up to two years. Google deletes the visit data linked to them after 14 months at most.
• Microsoft Clarity (Microsoft): how people move around our public pages, including session recordings and heatmaps. Never used inside the app. Cookies _clck and _clsk.

Advertising (only if you allow advertising, and only on our public pages)

These tell an advertising platform that someone it showed our ad to visited our site, so we can measure and improve our ads. They see page views and that you looked at pricing or courses, nothing else. They never load in the app or on sign-in pages.

• Google Ads (Google): cookies _gcl_*.
• Meta Pixel (Meta, for Facebook and Instagram ads): cookies _fbp and _fbc.
• TikTok Pixel (TikTok): cookie _ttp.
• Reddit Pixel (Reddit): cookie _rdt_uuid.
• LinkedIn Insight Tag (LinkedIn): cookie li_fat_id, plus LinkedIn's own cookies.
• X Pixel (X, formerly Twitter): X's own cookies, such as personalization_id and muc_ads.
• Snap Pixel (Snap, for Snapchat ads): cookie _scid.
• Microsoft Advertising (UET) (Microsoft, for Bing ads): cookies _uetsid and _uetvid.

If you allowed advertising, our server also tells these platforms when you sign up, start a checkout, start a free trial or subscribe, so they can count the result of an ad. It sends identifiers from the cookies above and a scrambled (hashed) form of your email address that lets the platform match its own account for you, never your name or what you study. If you allowed analytics, a subscription is also reported to Google Analytics.

In our iPhone, iPad and Android apps

The apps ask the same question once, after you have set up your study plan, and you can change your answer at any time in Settings, under Privacy choices. Nothing is collected for analytics before you answer.

• Analytics (Google Analytics for Firebase, Google): which screens and features are used, your app version and device type. Never your answers, the questions you practise or your tutor conversations.
• Ad measurement, Android only: if you allow it, Google may use your device's advertising ID to measure our ads, and we ask Google Play which campaign led to the install. The iPhone and iPad app does not offer or do this.
• What you do in the apps, including signing up and subscribing there, is never passed to an advertising platform by our server.

How long we keep it

We keep your account and learning data while your account is open. When you delete your account we delete them from our live systems straight away. Copies in our database backups are overwritten within 14 days, and security logs within 30 days. Payment records are kept by Stripe, Apple or Google, and by us where tax and accounting law requires it (normally six years).

Children

Gotitly is for adults preparing for professional exams. You must be 18 or over to create an account, and we do not knowingly collect data from anyone younger.

Changes to this policy

We update this page when what we do changes, and we email you about a change that matters to you.

Contact

Orb Global Ltd, 7 Bell Yard, London, WC2A 2JR, United Kingdom. Email: support@gotitly.com.