Privacy Policy

Mohd Firdause Bin Zainuddin, trading as query.lab, is the data controller responsible for your personal data under the General Data Protection Regulation (GDPR). For any privacy inquiries, contact us at querylab.help@outlook.com.

We collect only the data necessary to provide the Service:

• Account data: your email address and an authentication identifier, managed through our auth provider.
• Practice progress: which problems you have attempted or solved, and your submitted code.
• Lesson progress: which lessons you have completed.
• Daily challenges: dates on which you completed the daily challenge, for streak tracking.
• Entitlement data: your subscription plan and billing status (Pro or free), stored as a plan flag — we do not store card numbers or payment details.

Your SQL and Python code runs entirely within your browser using client-side interpreters (sql.js and Pyodide). Your code is not sent to our servers for execution. Code submissions are stored only to track your progress and display your saved work when you return.

Pro subscriptions are processed by Paddle.com, which acts as the merchant of record and data controller for your payment data. Paddle collects and processes your name, billing address, and payment instrument (card, PayPal, etc.). query.lab never receives, stores, or transmits your full card number or payment credentials.

We receive from Paddle only the information needed to activate and manage your subscription: your subscription ID, plan, and billing status. Paddle's privacy policy governs payment data: paddle.com/legal/privacy.

We process your personal data under the following GDPR legal bases:

• Contract (Art. 6(1)(b)): to create and manage your account, track your progress, and provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): to improve the Service, prevent abuse, and maintain platform security.
• Consent (Art. 6(1)(a)): for any optional features that require it — you can withdraw consent at any time.

We retain your account data and progress while your account is active. If you delete your account, we erase your personal data within 30 days, except where we are legally required to retain it (e.g., tax records held by Paddle as merchant of record).

We use a minimal authentication session cookie to keep you signed in. We do not use tracking, advertising, or third-party analytics cookies. Signed-out progress is stored in your browser's localStorage and moves to your account when you sign in.

Under the GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Restriction — request that we limit processing of your data.

To exercise any of these rights, contact us at querylab.help@outlook.com. You also have the right to lodge a complaint with your local data protection authority (e.g., your national DPA within the EEA).

We do not sell your data. We share data only with our infrastructure providers (auth and database hosting) and with Paddle for payment processing. All providers are under GDPR-appropriate safeguards and data processing agreements.

Your data may be processed outside the EU/EEA by our infrastructure providers. Such transfers are made under appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

We use row-level security and access controls to protect your data. However, no method of transmission or storage is fully secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of material changes via the Service or by email. Continued use after changes take effect constitutes acceptance.

For privacy inquiries or to exercise your data rights, contact us at querylab.help@outlook.com. See also our Terms of Service.