Privacy Policy

This policy explains how Nightingale Notes (“we”) collects and uses your personal data when you visit the site or buy a study guide. It is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Nightingale Notes is the data controller for personal data collected through this site. Contact: privacy@nightingalenotes.co.uk.

2. What data we collect

• Account data — your name, email address, and (if you sign in with email) a securely hashed password.
• Google sign-in data — if you use “Continue with Google”, we receive your email, name and profile picture from Google via the Emergent authentication proxy.
• Purchase data — which guides you have bought, order timestamps, and a Stripe checkout session identifier. We do not store your card details.
• Review data — ratings and text you voluntarily submit, along with the name on your account.
• Technical data — standard server logs (IP address, user agent, request paths) kept for a short period for security and debugging.

3. How we use your data

• Provide the Service — deliver purchased PDFs, keep your library accessible, take payment (Article 6(1)(b) UK GDPR — performance of a contract).
• Communicate about your orders — send receipts and important service notices (contract necessity).
• Improve the Service — publish aggregated review data and diagnose faults (legitimate interests).
• Meet legal obligations — tax and accounting records (legal obligation).

We do not sell your data, and we do not run behavioural advertising.

4. Payment processing

Payments are processed by Stripe Payments UK Ltd. Card data is submitted directly to Stripe on their PCI-DSS-compliant systems. We receive only a token and status. Stripe processes your data under its own privacy policy: stripe.com/privacy.

5. Email delivery

Receipt and service emails are sent via Resend. Resend processes your email address and message content on our behalf under our instructions: resend.com/legal/privacy-policy.

6. Cookies

We use a small number of strictly-necessary cookies to keep you signed in (a session token cookie for Google logins) and to remember your basket in local storage. We do not use advertising or analytics cookies.

7. Retention

• Account & purchase records — kept while your account is active and for up to 6 years after your last purchase to meet HMRC record-keeping rules.
• Reviews — kept for as long as the associated guide is on sale.
• Technical logs — typically 30 days.

8. Your rights

Under UK GDPR you have the right to:

• Access a copy of the data we hold about you.
• Correct inaccurate data.
• Erase your account and associated data (subject to legal retention above).
• Restrict or object to certain processing.
• Port your data to another provider.

To exercise any right, email privacy@nightingalenotes.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

9. International transfers

Some of our processors (including Stripe and Resend) may transfer data outside the UK. Where they do, they rely on the UK International Data Transfer Agreement or an adequacy decision to protect your data.

10. Security

We use HTTPS across the site, hashed passwords, tokenised sessions, and access controls on our backend and database. No online service can be 100% secure — if you suspect misuse of your account, contact us straight away.

11. Changes to this policy

We will post updates to this page with a new “Last updated” date. Material changes will also be communicated by email where reasonable.