Privacy policy

This is a plain-English summary of how Mantlin handles your data. It explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We have tried to keep it clear. If anything is unclear, please contact us and we will explain it.

Who we are and who is responsible for your data

The data controller for Mantlin is South East Automation Limited, a company registered in England and Wales, company number 16324389, with its registered office at Flat 4, 113 Central Hill, London, SE19 1BY, England. Being the controller means we decide what personal data is collected and why. You can contact us about privacy at privacy@mantlin.com.

We are a small business. As an organisation that processes personal data by computer, we are registered with the Information Commissioner’s Office under reference ZC241170 and we pay its annual data protection fee. We are not required by law to appoint a Data Protection Officer, and you can reach us about any privacy matter at the email above.

This service is for adults

Mantlin is intended for adults preparing for the Life in the UK Test. It is not aimed at children, and we do not knowingly collect data from children.

What we collect and why

You can practise as a guest without giving us any personal details. When you choose to save your progress or create an account, we collect the information below. For each type we give the reason we use it and our lawful basis under UK data protection law.

• Your email address. We use it to create your account, sign you in, and send you the emails described further down. Our lawful basis is performance of our contract with you, which is the account you asked us to set up.
• Your password. We store it only as a secure hash, never in a readable form, so that we can check your sign-in without ever holding the password itself. Our lawful basis is performance of our contract with you.
• Your first and last name. We use it to set up and personalise your account. Our lawful basis is performance of our contract with you.
• Your test date, if you give it. This is optional. If you tell us the date your test is booked for, or the date you are planning to sit it, we use it to pace your study and to power the reminder emails you can turn on. Our lawful basis is your consent, and you can change or remove it at any time.
• Whether your test is booked. When you create an account we ask whether your test is booked, whether you are planning to take it, or whether you are unsure. It is optional. We use it to ask you for the right kind of date and to pace your study around it. Our lawful basis is your consent.
• Your practice answers, scores and progress. These are the tests you take, the answers you give and the scores you get. They are the core of the product, and they are what lets us show your progress and your weak spots. Our lawful basis is performance of our contract with you.
• Your reminder preferences. Whether you have asked for practice reminder emails, the time you chose, and the practice goals you set. Our lawful basis is your consent, and you can turn reminders off at any time.
• Anything you write when you report a problem. Every question has a report option, and it has a box you can describe the problem in, up to 1,000 characters. What you write is stored, with your account if you are signed in, and it is emailed to us so that a person can check the question and fix it. Please leave out anything personal, because we only need to know what is wrong with the question. Our lawful basis is our legitimate interest in finding and correcting errors in our practice material.
• Basic technical data. Your IP address and basic device and browser information, collected automatically when you use the service. We use it to keep the service secure, working and free from abuse. Our lawful basis is our legitimate interest in keeping the service secure.

To create an account you need to give us an email address, a password and your name, and without these we cannot set the account up. Everything marked optional you can leave blank, and leaving it blank does not limit your practice in any way.

How we use AI

Mantlin has an AI study plan feature. When you use it, an AI model turns your own practice numbers and the test topic labels into plain-English study suggestions. The model receives only those numbers and topic labels. It does not receive anything you type freely anywhere in the app. Its output is checked automatically before it is shown to you. Our lawful basis is performance of our contract with you, which is the study feature you chose to use.

Your study plan is guidance to help you revise. It is not a decision made about you. It does not produce a legal effect or a similarly significant effect for you, and it changes nothing about your official Life in the UK Test booking or result. It is not a prediction of whether you will pass. You never have to use it, and it is deleted along with the rest of your data when you delete your account or your practice data.

Separately, we may use AI tools to analyse usage patterns and aggregated, de-identified information to understand how people use Mantlin and to make it better. This analysis is done in aggregate, and we do not send names, email addresses or anything else that identifies you to those tools. Our lawful basis is our legitimate interest in understanding and improving the service.

Emails we send you

We send account and security emails, such as your sign-in link, your confirmation link and password resets. These are not marketing, and our lawful basis is performance of our contract with you together with our legitimate interest in keeping your account secure.

We send practice reminder emails only if you opt in. Our lawful basis is your consent. Every reminder email links to your account settings, where you can turn reminders off at any time, and turning them off stops them straight away. You need to be signed in to change that setting.

Who we share it with and where your data goes

We use a small number of trusted service providers to run Mantlin. Some of them, or their infrastructure, are outside the UK. Every one of them has a data processing agreement that takes effect when we accept their terms, so there is no separate contract left unsigned. Where personal data leaves the UK, those agreements rely on the UK Extension to the EU to US Data Privacy Framework where it applies, and otherwise on the UK Addendum to the EU Standard Contractual Clauses, which is the transfer instrument the Information Commissioner issued in March 2022. We checked each provider's own agreement rather than assuming, most recently on 7 September 2026.

• Supabase provides our accounts and database. Your account and practice data are stored in the UK, in the AWS London region. Supabase is a company headquartered outside the UK, and any access or processing that happens outside the UK is covered by the safeguards named above.
• Resend sends the emails we send you. Resend processes data in the United States, under the UK Addendum to the Standard Contractual Clauses.
• OpenAI provides the AI model that writes your study plan. When you use it, we send only the test topic labels and your own practice numbers, never your name, your email or anything you have typed. OpenAI may process this outside the UK, including in the United States, under the UK Addendum to the EU Standard Contractual Clauses. OpenAI does not use data sent through its API to train its models, and keeps a short record for abuse monitoring only, currently up to thirty days.
• Netlify hosts the website. Netlify is headquartered in the United States and may process data outside the UK under the safeguards named above. Its own agreement is unusually specific about which one applies, naming the UK Extension to the Data Privacy Framework first and the UK Addendum as the fallback. Netlify publishes the list of companies it uses in turn, and we re-read it rather than relying on a summary.
• GlitchTip receives the technical error reports described below. We use its European service, which holds the data in Frankfurt, Germany. Transfers to Germany are covered by the UK adequacy regulations rather than by the contractual safeguards named above, because the UK government has decided the EU protects personal data to an equivalent standard. The reports have already had everything identifying you stripped out before they are sent.
• Cloudflare provides our domain services and, if we switch it on, our usage analytics. Cloudflare is headquartered in the United States and may process data outside the UK under the safeguards named above, on the same Data Privacy Framework first and UK Addendum second basis. On the analytics specifically, Cloudflare's own description is that it does not use any client side state such as cookies or local storage, and does not fingerprint. Cloudflare publishes the list of companies it uses in turn, and we re-read it rather than relying on a summary.

We also collect technical error reports when something in Mantlin goes wrong, so that we can find the fault and fix it. A report says which part of our code failed. Before it leaves our server we remove the things that identify you, including your account identifier, your email address, your network address, the cookies your browser sent and the contents of whatever you had just submitted. We do not send your practice answers or your scores. What is left is a stack trace and the name of the code that broke. Our lawful basis is our legitimate interest in keeping the service working.

How long we keep your data

We keep your account and your practice data for twelve months after the last time you practised. If you have not practised for that long, we delete the account and everything in it, including your email address, your name, your test date and your practice history. We email you thirty days before that happens, at the address on your account, and practising again starts the twelve months afresh from that day.

You do not have to wait for any of that. When you delete your account, or delete your practice data, we delete it. You can do both yourself from your account page, which has a Download my data option and options to delete your practice data or your whole account.

You can practise as a guest without giving us any details, and that practice is not tied to a named person. It is still yours, so we do not keep it for ever. If a guest has not practised for twelve months, we automatically delete that practice and the anonymous record it hangs from. The twelve months is counted from the last time you practised, not from when you started, so this never removes the work of somebody who is still using Mantlin. You do not have to wait for it either. You can delete your guest practice yourself at any time, from the bottom of your progress page, without making an account and without asking us.

There is one thing we keep after you delete your account, and we would rather be plain about it than quiet. If an email we sent you ever failed permanently, or you ever reported one of our emails as spam, we keep your email address on a suppression list so that we never email that address again. Deleting that record would undo the only thing it does, because the address would look new to us the next time somebody signed up with it and we would start emailing it again. The record holds your email address, whether it was a failed delivery or a spam report, and the dates. It holds nothing about your practice and it is never used for any other purpose. Our lawful basis is our legitimate interest in honouring a delivery failure or a spam report, and in not sending mail to people who have told us to stop. A record created by a spam report is kept for as long as we send email at all, because there is no point at which we could delete it and still honour the report. A record created by a failed delivery is kept on the same basis, for the same reason. If you would like to know whether your address is on it, or to ask us to remove it, contact us at the address at the end of this policy.

Separately we keep a short count of temporary delivery problems, such as an email that was slow to arrive. That record holds your email address, a count of how many times it happened and the dates. It suppresses nothing and it is never read when we decide whether to email you. It is deleted when you delete your account. If the address on it belongs to no account with us, we delete it twelve months after the last delivery problem it records, in the same nightly job that clears guest practice.

Your rights

Under UK data protection law you have the following rights.

• The right to access the personal data we hold about you.
• The right to have data that is wrong or incomplete corrected.
• The right to have your data erased.
• The right to receive the data you gave us in a portable format.
• The right to object to, or ask us to restrict, certain processing.
• The right to withdraw your consent at any time, for your test date and for reminder emails, without affecting anything we did before you withdrew it. You can do both from your account page.
• The right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk. We would ask you to raise it with us first so that we can try to put it right.

You can act on two of these rights yourself from your account page, using Download my data and the delete options. If you are practising as a guest with no account, you can still erase your practice yourself from your progress page. For anything else, contact us at privacy@mantlin.com and we will respond within one month.

Cookies and similar technologies

Mantlin uses only an essential login and session cookie, which keeps you signed in as you use the service. This is strictly necessary to provide the service you asked for, so it does not need your consent.

We also keep a simple daily count of how often each feature is used, for example how many study plans were generated on a given day. That count is a date, a feature name and a number. It carries no account, no session and no address, so it cannot say that any particular person used anything, and it is not capable of following you anywhere. We keep it so we can see which parts of Mantlin are worth building on. For usage analytics we have chosen Cloudflare Web Analytics, which is cookieless. It sets no cookies, does not track you across other websites, and gives us only aggregate counts such as how many people viewed a page. We give you this clear explanation and a simple way to object, which we understand meets the current rules under the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025. On this basis we do not consider a cookie consent banner to be required. Checked on 2026-09-06, the analytics beacon is not switched on at all, the live pages do not load it and a plain visit sets no cookie. If we do turn it on, we will confirm that it still sets nothing on your device before this paragraph stays as it is. We do not use advertising cookies today. If that ever changes we will update this policy first and ask for your consent before setting one, because a non-essential cookie needs your permission rather than your patience. You can read more in our cookie policy.

Changes to this policy

We may update this policy. When we make a material change we will update the date at the top of this page.

Contact us

For any privacy question, or to make a request about your data, contact South East Automation Limited at privacy@mantlin.com.