Privacy Policy

Who runs this site

theMBAroom is a CAT and GMAT exam-preparation site operated by an individual based in the United States. For the purposes of the GDPR and the UK GDPR, that operator is the data controller for the information described here.

This policy covers thembaroom.com and everything served under it. It does not cover sites we link to, which have their own policies.

Using the site without an account

Most of the site — past-year questions, mock tests, study material, strategy articles — works without signing in, and we do not ask who you are to show it to you.

Two things are stored in your own browser rather than on our servers: which exam you last looked at, so the site opens on CAT or GMAT rather than asking every time, and a random identifier used only to stop the same browser voting twice on the same question. Neither contains your name or email, and clearing your browser storage removes both.

If you give a question a thumbs up or down while signed out, that vote is saved against the random identifier above, not against you.

If you create an account

Accounts are handled by Supabase Auth. You can sign up with an email address and password, or with Google — in which case Google tells us your email address and basic profile details, and we never see your Google password.

Once you have an account, the site stores the work you do so it is there when you come back:

• Your profile: display name, username, chosen avatar, an optional bio, and your points total.
• Questions and topics you save.
• Mock tests and sectional tests you take — your answers, your score, and when you took them.
• Individual question attempts, including which option you chose and whether it was right, so the site can show you what to revise.
• Your error log, study progress, flashcard progress, and any study plan you build.
• Anything you post in the forum: posts, replies, and votes.

What other people can see

Forum posts and replies are public, and show your display name and avatar. The leaderboard shows display names and point totals. Everything else — your attempts, your scores, your saved questions, your error log — is visible only to you. This is enforced in the database itself, not just in the interface: each row is scoped to the account that created it.

Your email address is never shown to other users.

Admissions consulting enquiries

If you submit the consulting enquiry form, we store the name, email address, target schools and message you give us, and send a copy by email to the person who handles those enquiries. That information is used to reply to you and for nothing else.

Feedback

When you send feedback, we store your message, the topic you chose, and which page you were on. If you are signed in, it is linked to your account so we can reply; if you are not, it is not linked to anyone.

Advertising

This site shows ads through Google AdSense. Google and its partners use cookies and similar technologies to serve those ads, and — where you have allowed it — to personalise them based on your previous visits to this and other sites. Google's own description of how it uses data from sites that run its ads is at policies.google.com/technologies/partner-sites.

If you are in the European Economic Area, the United Kingdom or Switzerland, you will be asked to consent before any of this happens, through a Google-certified consent message. You can change that choice at any time from the same message, and you can turn off ad personalisation everywhere Google shows ads at adssettings.google.com.

We do not give advertisers your email address, your account, or anything you have done on the site.

Analytics

We use Google Analytics to understand which pages get used and where people give up — how many people started a mock test and how many finished it, for instance. It reports on visits, not on individuals, and we do not use it to build profiles of named users.

Who else handles your data

We keep the list of companies with access to your data as short as we can:

• Supabase — the database and the login system. This is where account data and study data live.
• Vercel — hosting. It processes the requests your browser makes, including IP addresses, in order to serve pages.
• Google — advertising and analytics, as described above, and Google sign-in if you use it.
• Resend — sends the notification email when a consulting enquiry comes in.

Where your data is held

Our infrastructure runs in the United States. If you use the site from the European Economic Area, the United Kingdom, India or anywhere else, your information is transferred to and stored in the US. Where that transfer needs a legal basis under the GDPR, it rests on the Standard Contractual Clauses our providers offer.

How long we keep it

Study data stays as long as your account does — that is the point of it; a study history you cannot look back at is not much use. Feedback and consulting enquiries are kept while we still need them to act on. Ask us to delete any of it and we will.

Your rights

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. There is no charge and we will not treat you differently for asking.

If you are in the EEA or the UK, the GDPR also gives you the right to object to or restrict certain processing, to receive your data in a portable form, to withdraw consent at any time, and to complain to your national data protection authority.

If you are a California resident, the CCPA as amended gives you the right to know what is collected and why, to have it deleted or corrected, and to opt out of the sharing of personal information for cross-context behavioural advertising. Personalised advertising counts as that kind of sharing, and the consent message and the Google ad settings linked above are how you opt out of it. We do not sell personal information for money.

There is no self-serve delete button on the site yet. Until there is, use the form below and we will do it by hand — GDPR gives us one month to answer and the CCPA forty-five days, and we aim to be well inside both.

Children

This site is built for people preparing for postgraduate management entrance exams and is not directed at children under 13. We do not knowingly collect information from them. If you believe a child has given us their information, tell us through the form below and we will remove it.

Changes to this policy

If this policy changes in a way that affects you, we will update the date at the top of this page. Continuing to use the site after that means the revised policy applies.