Privacy notice

Ace the Role is the app provided under the public business name QTS One; the legal operator for this service is Bacalu Constantin-Iulian. This notice applies when you visit the public site, sign in, buy access, create Practice Sessions, submit Practice Answers, receive Trusted Grades, use Reference-Backed AI Feedback, report issues, or contact support. Current legal operator and public address details are listed in the Impressum.

Ace the Role processes the data needed to run the product: email address, authentication and session state, selected Role-Specific Paths, seniority and locale choices, generated questions from the Live Preparation Catalog, Practice Answers, Trusted Grades, feedback text, usage limits, credit and pass status, and support or issue-report details. Sign-in authentication is handled by Auth0, an identity provider that processes your email address and chosen sign-in method (for example a Google account) in the EU; Ace the Role verifies the result once and then issues its own session, so Auth0 plays no part in any later request.

Ace the Role uses this data to authenticate accounts, assemble Practice Sessions from published Question Content, provide Reference-Backed AI Feedback, calculate progress, show Clear Next Steps, enforce quotas and abuse controls, process purchases, answer support requests, maintain security, and improve reliability.

We process your account and practice data to provide the service you bought (Art. 6(1)(b) GDPR); usage limits, abuse prevention and security on our legitimate interest in keeping the service safe and available (Art. 6(1)(f) GDPR); and billing and accounting records to meet legal obligations (Art. 6(1)(c) GDPR).

When you request grading, Ace the Role sends the relevant question context, reference material, and your Practice Answer to configured AI grading providers so they can produce Reference-Backed AI Feedback. Practice Answers are graded by an AI service. Please leave out private details about yourself or other real people that grading does not need: health, ethnic origin, religious or political views, union membership, sex life or sexual orientation, genetic or biometric data, criminal records, and names of colleagues, clients or patients. Please also leave out passwords, ID documents and anything confidential to your employer. The people in our practice questions are invented, so answering about them is fine. If such details reach us anyway, we use them only to grade your answer and keep your practice history, and you can delete them at any time by deleting your account or by writing to our privacy address in Article 9.

Stripe handles checkout and billing portal flows. Where Stripe Managed Payments applies, Sold through Link, LLC ("Link"), a Stripe company, is the merchant of record and handles the payment as a separate controller under Link's privacy notice. Link gives us the email address linked to the order, the product or plan, the amount and currency, payment, refund and dispute status, and Link or Stripe identifiers for the order, customer, checkout, subscription, invoice and payment. We use this data to provide access, administer the order, handle withdrawals, refunds and disputes, and meet accounting and legal duties. Ace the Role stores billing status, Stripe identifiers, credit balances, purchase events, and access records; we do not store full card numbers. With each purchase we also keep a record of the two withdrawal-right statements you ticked at checkout, their wording version, and when you ticked them, for as long as we keep the purchase record, because it is our evidence if a withdrawal or refund is disputed. Resend is used for transactional email such as Practice Data Deletion confirmations.

If you use our online cancellation or withdrawal function, we record your name, email address, contract reference, the content of your declaration, and the date and time we received it. For a cancellation, this includes whether it is ordinary or extraordinary, your requested end date, and, for an extraordinary cancellation, the reason you give. If we can match the declaration to a contract, we also record the relevant internal order, subscription, payment, refund and receipt-email identifiers, the amounts needed to calculate any refund, the processing outcome and, for a cancellation, the contract end date. We use this data to process the declaration, cancel the contract or make a refund through Stripe where required, and send the legally required receipt through Resend. The legal bases are compliance with our duties under §§ 312k and 356a BGB (Art. 6(1)(c) GDPR), performance of the contract and steps you request concerning it (Art. 6(1)(b) GDPR), and our legitimate interest in proving what we received and how we handled it if a cancellation, withdrawal or refund is disputed (Art. 6(1)(f) GDPR). You do not need an account to use either function. A declaration that matches a contract is linked to the relevant purchase; an unmatched declaration is not linked to an account.

We delete a completed withdrawal record on 1 January of the fourth calendar year after the year in which we received it. We delete a completed cancellation record on 1 January of the fourth calendar year after the later of the year in which we received it and the year in which the contract ended. This follows the regular limitation period in §§ 195 and 199 BGB. We keep an unresolved record until it is resolved. If a record is needed for a claim, complaint or court case, we keep it until that matter ends; Art. 17(3)(e) GDPR permits this where the data is needed to establish, exercise or defend legal claims.

Ace the Role uses essential cookies and browser storage for sign-in, policy acknowledgement, appearance preferences, billing access, and in-progress Practice Session navigation. Sign-in uses two cookies, both set HttpOnly so page scripts cannot read either: a short-lived one that expires after a few hours, and a second one, sent only to the sign-in renewal endpoint, that silently renews it as long as you return at least every few days, keeping you signed in for up to seven days total without signing in again. The codebase does not currently include optional analytics or advertising cookies. If optional cookies are introduced, Ace the Role should ask for separate consent before setting them.

Practice history is kept so you can review prior answers, progress, and feedback. Practice Data Deletion removes Practice Sessions, Practice Answers, AI grade history, feedback records, preferences, daily usage counters, and the number of free AI gradings used from the account workflow, while retaining billing, access, other abuse-prevention, and legal records needed for purchases, disputes, security, accounting, and service operation.

You can request access, correction, deletion, restriction of processing, objection, and data portability (receiving the data you gave us in a structured, commonly used, machine-readable format, or having it sent to another provider) where those rights apply. We may need to verify your identity and may retain records where required for billing, security, dispute handling, or legal obligations. Send privacy rights requests to privacy@acetherole.com; send account support requests to support@acetherole.com.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de. You may instead complain to the supervisory authority of the EU member state where you live or work, or where you believe the infringement took place. You also have the right to an effective judicial remedy against us before the courts (Art. 79 GDPR).