Privacy policy

This is a plain-English summary of how Mantlin handles your data. It explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We have tried to keep it clear. If anything is unclear, please contact us and we will explain it.

Who we are and who is responsible for your data

The data controller for Mantlin is South East Automation Limited, a company registered in England and Wales, company number 16324389, with its registered office at Flat 4, 113 Central Hill, London, SE19 1BY, England. Being the controller means we decide what personal data is collected and why. You can contact us about privacy at privacy@mantlin.com.

We are a small business. As an organisation that processes personal data by computer, we are registered with the Information Commissioner’s Office under reference ZC241170 and we pay its annual data protection fee. We are not required by law to appoint a Data Protection Officer, and you can reach us about any privacy matter at the email above.

This service is for adults

Mantlin is intended for adults preparing for the Life in the UK Test. It is not aimed at children, and we do not knowingly collect data from children.

What we collect and why

You can practise as a guest without giving us any personal details. The first time you open the practice page we start a test for you straight away, and to hold it we create an anonymous guest record that carries no name and no email address. When you choose to save your progress or create an account, we collect the information below. For each type we give the reason we use it and our lawful basis under UK data protection law.

• Your email address. We use it to create your account, sign you in, and send you the emails described further down. Our lawful basis is performance of our contract with you, which is the account you asked us to set up.
• Your password. We store it only as a secure hash, never in a readable form, so that we can check your sign-in without ever holding the password itself. Our lawful basis is performance of our contract with you.
• Your first and last name. We use it to set up and personalise your account. Our lawful basis is performance of our contract with you.
• Your test date, if you give it. This is optional. If you tell us the date your test is booked for, or the date you are planning to sit it, we use it to pace your study and to power the reminder emails you can turn on. Our lawful basis is your consent, and you can change or remove it at any time.
• Whether your test is booked. When you create an account we ask whether your test is booked, whether you are planning to take it, or whether you are unsure. It is optional. We use it to ask you for the right kind of date and to pace your study around it. Our lawful basis is your consent.
• Your practice answers, scores and progress. These are the tests you take, the answers you give and the scores you get. They are the core of the product, and they are what lets us show your progress and your weak spots. Our lawful basis is performance of our contract with you.
• Your reminder preferences. Whether you have asked for practice reminder emails, the time you chose, and the practice goals you set. Our lawful basis is your consent, and you can turn reminders off at any time.
• Anything you write when you report a problem. Every question has a report option, and it has a box you can describe the problem in, up to 1,000 characters. What you write is stored, with your account if you are signed in, and it is emailed to us so that a person can check the question and fix it. Please leave out anything personal, because we only need to know what is wrong with the question. Our lawful basis is our legitimate interest in finding and correcting errors in our practice material.
• Anything you tell us when you say whether something was useful. After a test you can answer "Was this useful?" by choosing Useful, Not sure, or Not useful. The same question will appear on a study plan once that feature is available. You can add a comment of up to 1,000 characters, and you can skip the comment or ignore the question entirely. What you choose is stored with your account if you are signed in. If you are practising as a guest it is stored against the same anonymous record the rest of your guest practice hangs from, and it is deleted when that record is, exactly as your practice is. Unlike a problem report it is not emailed to anyone; it is only counted and read so we can see which parts of Mantlin help and which do not. Please leave out anything personal, because we do not need it here. Our lawful basis is our legitimate interest in understanding what helps and improving the service.
• Basic technical data. Your IP address and basic device and browser information, collected automatically when you use the service. We use it to keep the service secure, working and free from abuse. Our lawful basis is our legitimate interest in keeping the service secure.

To create an account you need to give us an email address, a password and your name, and without these we cannot set the account up. Everything marked optional you can leave blank, and leaving it blank does not limit your practice in any way.

How we use AI

Mantlin has built an AI study plan feature, but it is not yet available to anyone. It will be offered as part of the Pass Pack when that launches, and until then no AI model receives any of your data. When it is available, and only if you choose to use it, an AI model will turn your own practice numbers and the test topic labels into plain-English study suggestions. The model will receive only those numbers and topic labels. It will not receive anything you type freely anywhere in the app. Its output will be checked automatically before it is shown to you. Our lawful basis will be performance of our contract with you, which is the study feature you chose to use. We will update this policy before the feature is switched on if anything here changes.

A study plan will be guidance to help you revise. It will not be a decision made about you. It will not produce a legal effect or a similarly significant effect for you, and it will change nothing about your official Life in the UK Test booking or result. It will not be a prediction of whether you will pass. You will never have to use it, and any plan you have will be deleted along with the rest of your data when you delete your account or your practice data.

Separately, we may use AI tools to analyse usage patterns and aggregated, de-identified information to understand how people use Mantlin and to make it better. This analysis is done in aggregate, and we do not send names, email addresses or anything else that identifies you to those tools. Our lawful basis is our legitimate interest in understanding and improving the service.

Emails we send you

We send account and security emails, such as your sign-in link, your confirmation link and password resets. These are not marketing, and our lawful basis is performance of our contract with you together with our legitimate interest in keeping your account secure.

We send practice reminder emails only if you opt in. Our lawful basis is your consent. Every reminder email links to your account settings, where you can turn reminders off at any time, and turning them off stops them straight away. You need to be signed in to change that setting.

Who we share it with and where your data goes

We use a small number of trusted service providers to run Mantlin. Some of them, or their infrastructure, are outside the UK. Every one of them has a data processing agreement that takes effect when we accept their terms, so there is no separate contract left unsigned. Where personal data leaves the UK, those agreements rely on the UK Extension to the EU to US Data Privacy Framework where it applies, and otherwise on the UK Addendum to the EU Standard Contractual Clauses, which is the transfer instrument the Information Commissioner issued in March 2022. We checked each provider's own agreement rather than assuming. We last checked Google's on 2 October 2026 and the others on 7 September 2026.

• Supabase provides our accounts and database. Your account and practice data are stored in the UK, in the AWS London region. Supabase is a company headquartered outside the UK, and any access or processing that happens outside the UK is covered by the safeguards named above.
• Resend sends the emails we send you. Resend processes data in the United States, under the UK Addendum to the Standard Contractual Clauses.
• OpenAI will provide the AI model that writes your study plan, once that feature is available. Until then we send OpenAI nothing about you. When it is available and you use it, we will send only the test topic labels and your own practice numbers, never your name, your email or anything you have typed. OpenAI may process this outside the UK, including in the United States, under the UK Addendum to the EU Standard Contractual Clauses. OpenAI does not use data sent through its API to train its models, and keeps a short record for abuse monitoring only, currently up to thirty days.
• Netlify hosts the website. Netlify is headquartered in the United States and may process data outside the UK under the safeguards named above. Its own agreement is unusually specific about which one applies, naming the UK Extension to the Data Privacy Framework first and the UK Addendum as the fallback. Netlify publishes the list of companies it uses in turn, and we re-read it rather than relying on a summary.
• Google hosts the mailbox that receives problem reports. When you tell us a question is wrong, what you wrote is emailed to us, and that email comes to rest in a Google Workspace inbox. Google is headquartered in the United States and may process data outside the UK under the safeguards named above. We name it because a problem report is the one thing you write that leaves our own systems and lands in an ordinary mailbox.
• GlitchTip receives the technical error reports described below. We use its European service, which holds the data in Frankfurt, Germany. Transfers to Germany are covered by the UK adequacy regulations rather than by the contractual safeguards named above, because the UK government has decided the EU protects personal data to an equivalent standard. The reports have already had everything identifying you stripped out before they are sent.
• Cloudflare provides our domain services, our usage analytics since 10 September 2026, and the email routing behind our privacy address. That last one is worth saying plainly rather than leaving buried: when you email us to see, correct or delete your data, your message reaches Cloudflare before it reaches us. Cloudflare is headquartered in the United States and may process data outside the UK under the safeguards named above, on the same Data Privacy Framework first and UK Addendum second basis. On the analytics specifically, Cloudflare's own description is that it does not use any client side state such as cookies or local storage, and does not fingerprint. Cloudflare publishes a directory of the companies it uses in turn. We have read it, but it links onward to separate pages we have not yet opened one by one, so unlike Netlify we cannot say we have seen the full list.

We also collect technical error reports when something in Mantlin goes wrong, so that we can find the fault and fix it. A report says which part of our code failed. Before it leaves our server we remove the things that identify you, including your account identifier, your email address, your network address, the cookies your browser sent and the contents of whatever you had just submitted. We do not send your practice answers or your scores. What is left is a stack trace and the name of the code that broke. Our lawful basis is our legitimate interest in keeping the service working.

How long we keep your data

We keep your account and your practice data for twelve months after the last time you practised. If you have not practised for that long, we delete the account and everything in it, including your email address, your name, your test date and your practice history. We email you thirty days before that happens, at the address on your account, and practising again starts the twelve months afresh from that day.

You do not have to wait for any of that. When you delete your account, or delete your practice data, we delete it. You can do both yourself from your account page, which has a Download my data option and options to delete your practice data or your whole account.

You can practise as a guest without giving us any details, and that practice is not tied to a named person. It is still yours, so we do not keep it for ever. If a guest has not practised for twelve months, we automatically delete that practice and the anonymous record it hangs from. The twelve months is counted from the last time you practised, not from when you started, so this never removes the work of somebody who is still using Mantlin.

There are two exceptions. If no question has ever been answered on a guest record, we delete it thirty days after it was made, together with any test started on it, because there is no practice in it to keep. And if you have started turning a guest record into an account and we are waiting for you to confirm your email address, neither rule applies until seven days after we sent the confirmation link, so the record is not removed while you are signing up. After that, both rules apply as normal. In the rare case where we cannot tell when the link was sent, a person checks the record instead of it being deleted automatically.

You do not have to wait for any of these. Once you have finished a test, you can delete your guest practice yourself at any time, from the bottom of your progress page, without making an account and without asking us.

There is one thing we keep after you delete your account, and we would rather be plain about it than quiet. If an email we sent you ever failed permanently, or you ever reported one of our emails as spam, we keep your email address on a suppression list so that we never email that address again. Deleting that record would undo the only thing it does, because the address would look new to us the next time somebody signed up with it and we would start emailing it again. The record holds your email address, whether it was a failed delivery or a spam report, and the dates. It holds nothing about your practice and it is never used for any other purpose. Our lawful basis is our legitimate interest in honouring a delivery failure or a spam report, and in not sending mail to people who have told us to stop. A record created by a spam report is kept for as long as we send email at all, because there is no point at which we could delete it and still honour the report. A record created by a failed delivery is kept on the same basis, for the same reason. If you would like to know whether your address is on it, or to ask us to remove it, contact us at the address at the end of this policy.

Separately we keep a short count of temporary delivery problems, such as an email that was slow to arrive. That record holds your email address, a count of how many times it happened and the dates. It suppresses nothing and it is never read when we decide whether to email you. It is deleted when you delete your account. If the address on it belongs to no account with us, we delete it twelve months after the last delivery problem it records, in the same nightly job that clears guest practice.

Your rights

Under UK data protection law you have the following rights.

• The right to access the personal data we hold about you.
• The right to have data that is wrong or incomplete corrected.
• The right to have your data erased.
• The right to receive the data you gave us in a portable format.
• The right to object to, or ask us to restrict, certain processing.
• The right to withdraw your consent at any time, for your test date and for reminder emails, without affecting anything we did before you withdrew it. You can do both from your account page.
• The right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk. We would ask you to raise it with us first so that we can try to put it right.

You can act on two of these rights yourself from your account page, using Download my data and the delete options. If you are practising as a guest with no account, you can still erase your practice yourself from your progress page. For anything else, contact us at privacy@mantlin.com and we will respond within one month.

Cookies and similar technologies

Mantlin uses one cookie, an essential login and session cookie, which keeps you signed in as you use the service. This is strictly necessary to provide the service you asked for, so it does not need your consent.

The site also keeps a few small pieces of information in your browser’s own storage, which is a technology similar to a cookie. They stay on your device. They are never sent to us, and they are not shared with anyone.

• Whether questions move on automatically after you answer. This remembers the choice you made with the auto-continue switch, so you do not have to set it again on your next visit.
• Whether tapping an answer submits it straight away, or only selects it until you press Submit answer. This remembers the choice you made with the auto submit switch, so you do not have to set it again on your next visit.
• Whether you have seen the one-time tip that explains auto-continue, so that we do not show it to you twice, and so that the first question of a test moves on by itself like the rest instead of waiting for you to press Next.
• A count of how many times the same error page has appeared in the browser tab you are using, so that the page can offer you different help if the problem keeps happening. It is deleted when you close the tab.
• The time the site last reloaded onto a new version in the browser tab you are using, and the times of its most recent automatic reloads, so the site never reloads itself in a loop or more than twice in half an hour. It is deleted when you close the tab.

None of these identifies you. They exist only to make the site work properly or in the way you have chosen, so like the login cookie they do not need your consent. You can remove them at any time by clearing the site data for Mantlin in your browser. If you do, auto-continue goes back to on, auto submit goes back to on, the tip may appear once more, and the first question of a test may wait for you to press Next again.

We also keep a simple daily count of how often each feature is used, for example how many times the revision sheet was opened on a given day. That count is a date, a feature name and a number. It carries no account, no session and no address, so it cannot say that any particular person used anything, and it is not capable of following you anywhere. We keep it so we can see which parts of Mantlin are worth building on. For usage analytics we have chosen Cloudflare Web Analytics, which is cookieless. It sets no cookies, does not track you across other websites, and gives us only aggregate counts such as how many people viewed a page. We give you this clear explanation and a simple way to object, which we understand meets the current rules under the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025. On this basis we do not consider a cookie consent banner to be required. The beacon was dormant until 10 September 2026 and is now on. Cloudflare's own published design for it uses no client side state at all, no cookies and no local storage, and we check the live site against that rather than taking it on trust. We do not use advertising cookies today. If that ever changes we will update this policy first and ask for your consent before setting one, because a non-essential cookie needs your permission rather than your patience. You can read more in our cookie policy.

Changes to this policy

We may update this policy. When we make a material change we will update the date at the top of this page.

Contact us

For any privacy question, or to make a request about your data, contact South East Automation Limited at privacy@mantlin.com.