LEARN. PRACTICE. GROW.Last updated: 1 October 2026
1. Data controller
The controller of personal data collected on bigsavant.com is ExpertFusion Software and Marketplace FZ-C.L.L, registered at Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, licence no. 2532231.01 issued by Meydan Free Zone, Dubai, United Arab Emirates. For any privacy question or to exercise your rights, contact us at info@bigsavant.com
We have not appointed a data protection officer, as we are not legally required to. The contact above is handled directly by the controller.
2. Scope
This policy explains how we process personal data when you visit bigsavant.com, create an account, or use the lessons, exercises, assessments, and other features. Regulation (EU) 2016/679 (GDPR) and Portuguese Law 58/2019 apply. It does not cover third-party sites we link to, such as official certification provider pages.
3. Data we process
| Category | Data | Source |
|---|---|---|
| Account | Name, email, password (stored only as a salted scrypt hash), language, time zone, daily goal, role (learner/editor), email confirmation status, creation date. | You, at sign-up and in settings |
| Learning | Paths started and followed, completed lessons, personal notes, answers, attempts and scores, review cards and their schedule, aggregated daily activity. | Your use of the service |
| Reports | Messages you send to report problems with questions. | You |
| Security | Session and recovery/confirmation identifiers (stored only as hashes), anti-abuse counters linked to a hash of the IP address or account, log of editorial and administrative actions. | Generated by the service |
| Technical logs | IP address, date and time, requested page, response code, size, referring page, and browser identification (user agent). | Your browser, on every request |
| Recipient address, content, and delivery logs of transactional messages (account confirmation and access recovery). | Generated by the service | |
| Usage statistics (consent only) | Pages visited (without URL parameters), referral source, device and browser type, approximate country/region, duration and interactions, linked to random identifiers in cookies. | Your browser, via Google Analytics |
We do not ask for or intend to process special categories of data (for example, health or beliefs). Please do not write such information in notes or reports. We use no advertising, tracking pixels, or marketing profiles. Usage analytics is only enabled if you accept it in the cookie notice.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and manage your account, provide lessons, exercises and assessments, store progress, let you export data and delete your account. | Performance of a contract (1)(b) — the terms of use you accept at sign-up. |
| Send account confirmation and access recovery emails. | Performance of a contract (b). |
| Protect accounts and the service: authentication, abuse and attack prevention, rate limits, technical logs, backups, and editorial audit. | Legitimate interest (f) in keeping the service secure and available. |
| Review and fix reported content. | Legitimate interest (f) in content quality. |
| Comply with legal obligations and respond to authority requests. | Legal obligation (c). |
| Measure site usage (Google Analytics) to improve content and navigation. | Consent (a), which you can withdraw at any time via "Cookie preferences" in the footer. |
We do not send marketing communications or newsletters. If we ever do, it will only be with your prior consent, which you can withdraw at any time.
5. Recipients and processors
We do not sell or rent personal data. Data is only accessed by:
- Vultr (The Constant Company, LLC, USA) — server infrastructure. The application, database, logs, and backups run on a server in Amsterdam, Netherlandsthe email server is in Madrid, Spain
- Cloudflare — domain name resolution (DNS) only. Site traffic does not pass through Cloudflare.
- Google Ireland Limited (Google Analytics 4) — usage statistics, only if you accept. Google Signals and ad personalisation are disabled; IP addresses are not stored by Google Analytics 4.
- Your own email provider, which receives the messages we send you.
- Public authorities, where required by law.
We run our own email server (no third-party sending services). Infrastructure providers act as processors under GDPR Art. 28.
6. International transfers
Data is stored on servers in the European Union. Because the controller is based in the United Arab Emirates and the infrastructure provider belongs to a US group, data may be accessed from outside the European Economic Area for administration and technical support. In those cases we apply appropriate safeguards under Chapter V of the GDPR, such as the standard contractual clauses approved by the European Commission. You can request information about these safeguards using the contact above. Google Analytics data may be processed by Google LLC in the US under the EU-US Data Privacy Framework, to which Google is certified, and standard contractual clauses.
7. Retention periods
| Data | Period |
|---|---|
| Account and learning data | While the account exists. When you delete your account, they are removed from the live database immediately. |
| Reports and editorial/audit logs | Kept for content history but unlinked from your account (anonymised) when you delete it. |
| Sessions | 7 days, or until you sign out or change your password. |
| Recovery / confirmation links | 1 hour / 24 hours; single use. |
| Anti-abuse counters | Short windows (minutes), cleared automatically; they store only a hash of the IP or account. |
| Web server logs | 14 days. |
| Email server logs | About 5 weeks. |
| Google Analytics statistics | _ga cookies up to 13 months; user-level event data kept by Google for 14 months. |
| Database backups | Up to 30 days, rotating. Data from deleted accounts disappears from backups as they expire; if a backup must be restored, later deletions are re-applied. |
8. Security
- Connections always encrypted (HTTPS with HSTS).
- Passwords stored only as scrypt hashes; sessions and recovery links stored only as hashes.
- HttpOnly, Secure and SameSite cookies, CSRF protection, and form origin checks.
- Limits on sign-in attempts and operations; changing your password ends all sessions.
- Restricted administrative server access, with the service running with least privilege; the database and backups are not reachable from the web.
No system is completely secure. If we detect a data breach that puts you at risk, we will notify the supervisory authority and, where required, affected individuals.
9. Your rights
Under GDPR Articles 15 to 22, you have the right to:
- Access — know what data we process and get a copy
- Rectification — correct inaccurate data (name and preferences can be changed in settings)
- Erasure — delete your account and associated data, directly in settings
- Portability — export your data in a structured format (JSON), directly in settings
- Restriction and objection — in particular to processing based on legitimate interest
- Not be subject to solely automated decisions with legal effects. Automatic answer marking only supports your learning and has no such effects.
To exercise any right, use your account settings or write to info@bigsavant.comWe reply within one month, extendable under GDPR Art. 12. We may ask for information to confirm your identity. You may also lodge a complaint with the Portuguese Comissão Nacional de Proteção de Dados (CNPD) or the supervisory authority in your country of residence.
10. Minors
The service is intended for people aged 16 or over. If you are under 16, you may only create an account with the permission of a parent or guardian. If we learn that an account was created without such permission, we may delete it.
12. Changes
We may update this policy to reflect changes to the service or the law. The update date is shown at the top. If changes are significant, we will notify you on the platform or by email before they take effect.
Other documents: Privacy · Terms of use · Cookie policy · Legal notice