Privacy Policy
Last updated 11 October 2026
What Recallab records about you, why, and how to get rid of it. We sell nothing to anybody. Google and Meta cookies and page measurement run only if you say yes to them, and never in the Recallab Android app. One thing does not depend on that choice: if you come to us from a Google advert and then create an account, we tell Google Ads that the advert led to a sign-up.
We never see your card. Payments are taken by our payment provider as merchant of record. Card numbers, bank details and billing addresses go to them and their payment processors, never to us. All we receive back is which plan you bought, when it renews, and a reference number.
Who is responsible
Auspec UK Ltd, a company registered in England and Wales (company number 07134027), at The Lexicon, Second Floor, Mount Street, Manchester M2 5NT, United Kingdom, is the controller of the personal data described here. For questions or requests, email privacy@recallab.com.
What we hold, and why
| What | Why | Basis |
|---|---|---|
| Your email address and a hashed password — or, if you continue with Google, the address Google confirms for you | To let you sign in and to recover your account | To provide the service you asked for |
| Your answers: which question, which option, whether it was right, how confident you said you were, and when | To show your progress, calibration and history, and to mark mock exams | To provide the service you asked for |
| Bookmarks, quiz results and mock exam sittings | So your work is there next time, on any device | To provide the service you asked for |
| Your IP address, recorded with answers and with sign-in attempts | To stop abuse, enforce the free daily allowance fairly and rate-limit attacks on accounts | Our legitimate interest in keeping the service working and secure |
| Where your sign-up came from: the address you created the account from, the country that address is in, the page that linked you to us (both the first time and the most recent time before you signed up), any campaign wording in those links and the click reference an advert adds to its link, and the kind of device you signed up on (phone, tablet or computer, its system, browser and screen size, as your browser reports them) | To see which places, pages and adverts actually bring people to Recallab, so we put our effort where it works, and, for a Google advert, to report the sign-up back to Google Ads as described under Cookies and local storage | Our legitimate interest in understanding how people find us |
| The kind of device and browser you last used Recallab on, and when, and on how many days you have used Recallab (phone, tablet or computer, its system, and the browser or Recallab app, as your browser or our app reports them) | To see which devices learners really use, and to find and fix problems on particular ones | Our legitimate interest in keeping the service working well on the devices you use |
| The pages and apps you open while signed in, and when | To understand how learners use Recallab and which features and plans interest them, including to decide what to offer you | Our legitimate interest in improving Recallab and offering you the plans that suit how you study |
| Your first name, the NEET PG year you are sitting, where you are in your training and the state you are studying in — and, only if you choose to give it, a WhatsApp number | To greet you by name, pace your revision towards your exam, and cover the counselling and cut-offs of your own state; the number only so that we can send study reminders when our WhatsApp channel opens, and only after you confirm it there | To provide the service you asked for; for the number, your consent |
| If you joined through a friend's invite link, whose link it was; and, once you open your Profile page, your own invite link | To see how many people join through friends, and to show the friend how many have joined with their link — a number only, never who | Our legitimate interest in understanding how people find us |
| How you heard about Recallab, only if you choose to answer — a single choice such as Instagram, Telegram or a friend | To learn which places actually bring people to Recallab, so we put our effort where it works | Your consent: the question is optional, and skipping it changes nothing |
| What you ask the AI tutor or the support assistant, with the question it is about, and the replies; for Pro Learner Insights, a summary of your week's results (counts and percentages by subject) | To write the reply or the report you asked for, and to keep your past conversations and reports where you can read them again | To provide the service you asked for |
| Your subscription status, plan, renewal date and a payment reference | To give you the access you paid for and to answer billing questions | To perform our contract with you |
We ask for your first name, and nothing further about who you are: not your full name, your medical school, your date of birth or your examination results. Giving a WhatsApp number is optional, and nothing is sent to it until the channel opens and you confirm the number.
The referring page is kept as the site and page only — example.com/article
— never the rest of the address. If you arrived from a search, the words you
searched for are in that part, and they are yours, not ours. The page of ours you landed on is kept with its campaign wording and any advert click reference.
Cookies and local storage
Recallab sets three cookies of its own. The first two are necessary for the site to work at all:
rl_sess- Your sign-in session. Set when you sign in, lasts up to 90 days, and is readable only by the server, never by scripts in the page.
rl_anon- A random identifier with no name attached, used to count the free daily allowance for a visitor who is not signed in. Lasts up to 400 days.
rl-consent- Your Accept or No thanks on the banner, so that our server knows your choice too. Lasts up to 400 days.
Your browser also keeps a few small things on your own device, so that the site looks and works the same next time: your light or dark theme; whether this browser is signed in and your count of questions answered, so that the blog's header can show them; which first-week steps you have done; which tips and release notes you have already seen; and, on the website, a count of the questions answered on this browser up to the tenth. None of these is sent to us. Signing out clears the header's count and the first-week steps; the others stay until you clear your browser's storage.
Your browser also keeps a note of how you arrived, the first time and the most recent time: the address of the site you came from, the page of ours you landed on, any campaign wording in that link, the click reference an advert adds to its link if you came from one (from Google, Meta or Microsoft), and the time. If you used a friend's invite link, it keeps that link's code. This note is kept whether or not you press Accept on the banner, and it stays until you clear your browser's storage; the most recent part is written again whenever you come back from another site or from a link with campaign wording. The site reads it on your own device to choose which sample question to show someone who has just come from an advert. It is sent to us when you create an account, and whenever you sign in with Google, together with whether you were using the installed app. We keep it only when a new account is created, and we use it as the table above and the paragraph on sign-ups from a Google advert describe.
If you use the help chat, your browser keeps a reference to that conversation until you close the tab, so that the chat does not start again when you move between pages. The Recallab iPhone app also keeps on the phone the notification token Apple gives it, so that it can ask us to forget that token if you sign out.
Google Analytics and Google Ads — only if you press Accept. The first time you
visit, a small banner asks. Until you accept, nothing from Google loads. If you do, Google sets its
own cookies (_ga, _ga_*, _gcl_au and, if you arrived from one
of our ads, _gcl_aw, lasting up to 13 months at most) so that we can see which of our
pages and ads bring people to Recallab, and whether they go on to create an account, confirm their
email and answer their first questions. We never send Google your answers, your questions, your
email or anything you type. We do not use Google for personalised advertising to you. Your choice is
remembered on your device; you can
change it at any time.
Sign-ups from a Google advert — reported whatever you choose. When you tap one of our Google adverts, Google adds a click reference to the link. If you then create an account, we keep that reference with your sign-up, and we report back to Google Ads, by that reference, that the click led to a sign-up and, later, to a confirmed email, with the date and time of each. We do this whether you pressed Accept or No thanks, because it is how we learn which adverts work. We send Google only the click reference and the date and time: not your email address, your name, your account or anything you do on Recallab. We do not do this for Meta or Microsoft adverts.
Meta (Facebook and Instagram) — the same Accept, the same banner. If you accept,
Meta sets its own cookies (_fbp, and _fbc if you arrived from one of our
ads on Facebook or Instagram, lasting up to 90 days) so that we can see which of our ads bring
people to Recallab. Our server also reports the same three moments to Meta — an account created, an
email confirmed, a tenth question answered — because a browser alone loses most of them. When it
does, your email address is turned into an irreversible SHA-256 hash on our server first: Meta can
compare that hash with one of its own, and can never read your address from it. Your questions, your
answers and anything you type are never sent. If you decline, nothing goes to Meta from your browser
or from our server.
In the Recallab Android app — none of this. The app shows no banner and loads nothing from Google Analytics, Google Ads or Meta, and our server reports nothing to Meta about what you do in it, even if you pressed Accept on the website in the same phone's browser. The app keeps a note for the length of a session that it is the app, so that it can leave these out; that note never leaves your phone. The sign-up report described above is the one exception: if you came from a Google advert and create your account in the app, that sign-up is reported in the same way.
Who else is involved
- Google (Google Ireland Ltd and Google LLC) — Google Analytics and Google Ads, only if you accept them on the cookie banner, under Google's privacy policy.
- Meta (Meta Platforms Ireland Ltd) — advertising measurement for Facebook and Instagram, only if you accept it on the same banner, under Meta's privacy policy.
- Our payment provider — merchant of record, named at checkout and on your receipt. They handle the payment and hold the billing data under their own privacy notice.
- OpenAI (OpenAI, L.L.C.) — writes the replies of the AI tutor and the support assistant, drafts our email reply when you ask the support assistant for a person (someone at Recallab reads every draft before anything is sent), and writes Pro Learner Insights, only when you use one of them. It receives the text of that request: your message, the question it is about, and for Insights the summary of your results. It never receives your email address or your name. We ask it not to store the conversation; under OpenAI's API data terms it does not use it to train its models, and keeps abuse-monitoring records for up to 30 days.
- Our hosting provider — the servers that run recallab.com, located in the United Kingdom.
- Google Fonts — the site loads its two typefaces from Google's servers, which means your browser's IP address reaches Google when a page loads. No cookie is set by this.
- Sign in with Google (Google LLC) — only if you press "Continue with Google". Google's sign-in script loads when you open the sign-in box, and if you use it, Google tells us your email address and that it has confirmed it. We keep only the address. Google learns that you signed in to Recallab, under Google's privacy policy.
Nobody buys data from us, because we do not sell it. We share it only where we must: with the providers above so the service can run, and with the authorities where the law requires it.
Where your data is
Recallab's servers are in the United Kingdom. If you use Recallab from outside the UK, including from India, your data is transferred to and stored there, protected by the safeguards the applicable law requires. When you use an AI feature, the text of that request is also processed by OpenAI, which may be outside the UK, including in the United States, under the same safeguards.
How long we keep it
- Your account and your answer history: until you delete your account, or ask us to.
- Your AI tutor and support conversations and your Insights reports: with your account, until you delete it. OpenAI's own abuse-monitoring records: up to 30 days.
- Sign-in sessions: 90 days, or until you sign out.
- Security and rate-limit records tied to an IP address: 24 hours.
- The address a sign-up came from: 90 days, then erased. The country, the referring page, the landing page with its campaign wording, any advert click reference and the kind of device you signed up on stay with the account until it is deleted.
- The kind of device and browser you last used: one record, replaced at each visit, so there is no history of your devices (the pages you open are kept separately; see below). No address is stored with it. Erased when you delete your account.
- The pages and apps you open while signed in: kept for 90 days, then deleted; erased when you delete your account.
- Your first name, NEET PG year, stage, state, WhatsApp number and how you heard about us: until you ask us to delete them, or you delete your account. Email privacy@recallab.com to have the number removed and keep the rest.
- Password reset links: 60 minutes, and only ever as a one-way hash.
- Records of payments: kept as long as tax and accounting law requires, normally six years, whether or not you delete your account.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop a particular use of it. Email privacy@recallab.com and we will act within one month.
Deleting your account is something you can do yourself, at any time, in the app or on the website: Profile → Account → Delete my account (how it works). It happens at once and cannot be undone. It removes your email address, your answers, your history, your profile and your conversations; it keeps the payment records we are required to keep, without your email address. If a paid plan is still set to renew, write to support@recallab.com to cancel the renewal first.
If you are in the UK you may complain to the Information Commissioner's Office at ico.org.uk. If you are in India, our grievance contact is on the Contact page and you may also approach the Data Protection Board once it is operating. Wherever you are, please try us first — most things are quicker to fix directly.
Children
Recallab is built for medical students and doctors and is not aimed at children. We do not knowingly hold data about anyone under 18. If you believe we do, email privacy@recallab.com and we will delete it.
Security
Passwords are stored only as a one-way hash, never in a form we could read. The site is served over HTTPS. Answers are checked on the server so the correct option is never sent to your browser before you commit to one. No system is perfect, and if a breach ever affects your data we will tell you and the regulator as the law requires.
Changes
If this notice changes, the date at the top changes with it, and we will tell you by email before any change that materially affects you.