1 Who we are
Simena Digital LLC, 1021 E Lincolnway, Suite 9026, Cheyenne, WY 82001, USA (“SmashMyTest”, “we”) is the controller of the data described here. Contact: hello@smashmytest.com.
This policy covers smashmytest.com and the order process. It does not cover the test platform of your employer or publisher: that is their own processing, on their own terms.
2 What we collect
- Order details: your display name, email address, company, the test name or publisher, the test date, any notes, the package and the price.
- Test access: the invite link, the username or ID and the password you give at checkout, plus any access instructions or one-time codes you send in the chat.
- Messages and files: everything you write in the order chat, the files you upload, and the result we deliver.
- Payment data: the Stripe session and payment identifiers, the amount and currency, the card brand and last four digits, the invoice link. We never see or store the full card number.
- Technical data: IP address, request logs, device and browser data, the theme cookie, and the login session when you are signed in.
- Reviews: if you leave one, the name and the text you agree to have published.
3 Why we use it, and on what basis
We use the data to take your order, to access the test, to communicate with you, to deliver the result, to take payment, to prevent fraud and abuse, to meet tax and legal duties and to improve the service.
Where the GDPR or UK GDPR applies, the legal bases are: performance of our contract with you (the order and the service), our legitimate interests (security, fraud prevention, service improvement), your consent where we ask for it, and compliance with a legal obligation (tax and accounting).
4 The test credentials: read this
The invite link, username and password are the most sensitive thing you send us. We collect them because the service cannot be performed without them.
The password is stored in our order database in readable form: we do not encrypt that field separately. Our own database user needs to read it, so treat it as a plain-text secret. Access is limited to the person performing the order, but use a password you use nowhere else, and do not send the password of an account that holds other, more valuable data unless you are comfortable with that.
The password is kept only while the work is live: once an order is completed or cancelled, the password field is cleared, and the invite link and username stay with the order for its record.
One-time codes are used as soon as they arrive and are short-lived. You send them in the chat, so they stay in the order's chat history with everything else.
5 Who we share it with
- Stripe, for payment processing and refunds.
- Our email provider, to send order and login emails.
- Our hosting provider, for the site, the database and the uploaded files.
- Professional advisers, where necessary.
- Authorities, where the law requires it.
We do not sell your personal data. There are no advertising cookies.
6 International transfers
We operate from the USA and the data is processed there. Where data is transferred from the EEA or the UK, we rely on appropriate safeguards (for example the Standard Contractual Clauses with our processors) where the law requires them.
7 How long we keep it
- Order, invoice and payment records: as long as tax, accounting and legal claims need them.
- Chat, uploaded files and the delivered result: with the order, for its record.
- The test password: until the order is completed or cancelled (see §4).
- Backups: until they roll over on our backup cycle.
- Server and access logs: a short period, for security and debugging.
8 Security
We use TLS in transit, access controls and limited staff access. No system is perfectly secure, and we do not claim that the password field in §4 is encrypted.
9 Your rights
Where the GDPR or UK GDPR applies, you may ask for access, correction, deletion, restriction or portability of your data, or object to processing; you may withdraw a consent at any time; and you may complain to your national supervisory authority.
Write to hello@smashmytest.com. We may need to verify your identity first. Deleting your account removes your data as the app describes, subject to records we must keep (§7).
10 Cookies
We set a cookie for your theme choice and the login session. There are no advertising or third-party tracking cookies, so there is no consent banner. If we add analytics later, we will update this policy and, where the law requires it, ask for your consent first.
11 Children
The service is for adults. An applicant under 18 can use it with a parent or guardian. We do not knowingly collect data from children.
12 Changes
We may update this policy. The version on the site when you order applies to that order. The date at the top shows the current version.