EXAMSTEAD · INFORMATION & POLICIES
Cookies and storage
Clear choices. The same access.
Last updated September 22, 2026 · Privacy on Examstead
Your choices
Cookies, local storage and session storage can keep information on your device. Necessary functions support sign-in, security and requested purchases. Visit measurement and remembering referrals stay off until you accept them. The page address determines language without a persistent language identifier.
Use “Cookie and privacy settings” in the footer of any page to accept, reject or change optional uses. Rejecting does not prevent reading free guides, signing in, buying or studying. Scrolling or continuing to browse does not give consent.
Storage and services used
| Name or function | Provider | Purpose | Duration |
|---|---|---|---|
| __Host-examstead-privacy | Examstead | Signed identifier necessary to record and enforce privacy choices. Never used for advertising. | 180 days after a choice |
| examstead-privacy-choice | Examstead | Local copy of the notice version, selections and expiry. Permissions are verified on the server. | 180 days |
| examstead-privacy-pending-reject | Examstead | Retry a refusal that could not be saved on the server. | Until the next successful synchronization |
| examstead-marketing-visit / examstead-marketing-linked | Examstead | Optional measurement of visits, campaigns, account links and purchases with permission. | Visit identifier: 30 minutes; linkage marker: browser session |
| examstead-referral-suggestion | Examstead | Optional remembering of a referral link for a later visit. | Up to 30 days |
| examstead-learner-session and verification/recovery state | Examstead / Supabase | Requested sign-in, secure verification and account recovery. | Subject to session validity; cleared by sign-out and security cleanup |
| Course navigation and administrator return state | Examstead | Return to a destination you requested. | Session; removed on use or its applicable expiry |
| reCAPTCHA, including _GRECAPTCHA depending on the browser | Abuse prevention at contact submission after you agree to the security check. | Subject to Google storage and settings | |
| Storage on external payment or sign-in pages | Stripe / Google / Microsoft | Process a payment or sign-in you request. | Subject to the provider and your session |
Optional measurement and withdrawal
With permission, a random visit identifier and source, medium, campaign and course labels can be linked to your account and an order. No third-party advertising tools are used. We do not retain the full referring URL in these records. A random identifier is not anonymous when linked to an account.
Withdrawal stops new measurement and removes visits and campaign attribution associated with this browser’s choice. In a signed-in, verified account, the application also requests removal of that account’s marketing links. This does not cancel purchases or referral commissions. Clearing browser data may remove our ability to locate records by that identifier; you can make a privacy request.
Discounts and referrals
A link can suggest a code for the current purchase journey without persistent storage. You can request application of a code without accepting optional measurement. Remembering the link for future visits requires your separate choice. Discounts and commissions remain subject to eligibility, confirmation before payment and program terms. Transaction and commission records have their own retention requirements.
Retention and choice evidence
We remember your choice for 180 days. We record its version, time, language, selections and privacy signal under a protected identifier. History is limited to the latest 20 changes and removed after 365 days without a change. It contains no email address, sign-in token or card number.
Daily cleanup removes unlinked visits older than 90 days, all visits older than 180 days, and expired permissions from active measurement journeys. Order campaign attribution is retained for up to 365 days, subject to earlier withdrawal. Protected daily hashes used for security limits are removed after two days according to the cleanup schedule. Provider backups and logs have separate retention periods.
Browser signals
We respect Global Privacy Control by switching off optional measurement and remembering referral links. This voluntary treatment is broader than some legal obligations concerning sale or sharing for advertising. We do not sell your information for advertising. “Do Not Track” settings are not the same standardized signal; our privacy controls remain available.
External services and help
Google reCAPTCHA loads at contact submission after you agree to its security check. Stripe and sign-in providers receive information when you request those services. Providers may process information outside Canada. Our Reject button does not clear cookies placed on their own websites. See the privacy policies of Google, Stripe and Microsoft, and our Privacy notice.
To exercise privacy rights or report a problem, use the contact form. If you cannot use Google verification, call +1 416-901-9115 or write to Investatech Inc., Privacy Officer, 100 Richmond Street West, Suite 308, Toronto, ON M5H 3K6, Canada. No account is required to make a request.