Last updated: 9 September 2026
Vertex Revision is a revision service for candidates preparing for Part 1 of the Overseas Registration Examination. It is run by an independent sole trader established in the United Kingdom, trading as Vertex Revision.
For the purposes of UK data protection law, that trader is the data controller for the personal data described in this policy. In this policy “we”, “us” and “our” mean that trader, and “you” means the person using the service.
You can reach us at any time at [email protected]. If you need our full registered trading details — for example to make a formal complaint, to exercise a legal right, or to serve a notice on us — email that address and we will provide them to you in writing.
We are not connected with the General Dental Council. Vertex Revision is an independent study aid. It is not affiliated with, endorsed by, or approved by the General Dental Council or any body that sets or administers the Overseas Registration Examination.
| Data | When |
|---|---|
| Email address | When you create an account. It is your sign-in identifier. |
| Password | When you create an account or reset it. We never see or store your password itself — it is hashed by our authentication provider before storage. |
| Display name | Optional, if you set one. |
| Anything you type into the service | Session names, deck names, planner entries and similar. Please do not enter clinical information about real patients, or anyone else’s personal data. |
| Data | What it is |
|---|---|
| Study activity | Questions answered or skipped, answers given, flashcard ratings, which items you have seen, your position within a session, saved sessions and decks. |
| Progress and results | Scores, per-topic performance, streaks and similar figures shown back to you. |
| Usage counts | A daily tally of questions and cards issued to your account. We use it to apply fair-use limits and to detect bulk extraction of our content. |
| Technical data | Standard information sent by your browser when you request a page — IP address, user agent, and the time of the request. Our hosting and security providers process this to serve the site and to protect it from attack and abuse. |
| Approximate location | Only if you have agreed to analytics. Our analytics provider works out an approximate location — at country, region and city level — from your IP address, so we can see roughly where our users are. It is not a precise location, we do not use device GPS, and your IP address itself is not retained by the analytics provider. |
| Purpose | Legal basis |
|---|---|
| Creating and running your account; letting you sign in; saving and restoring your study progress | Performance of a contract — this is the service you asked for |
| Applying fair-use limits, detecting bulk copying of our question bank, and keeping the service secure and available | Legitimate interests — protecting our content and other users. We have considered your interests and use the minimum data needed |
| Understanding, in aggregate, how the service is used so we can improve it | Consent — analytics does not run at all unless you agree to it. You can change your mind at any time, and withdrawing is as easy as giving it: see section 5 |
| Sending service emails you need — confirming your address, resetting your password | Performance of a contract |
| Keeping records of payments, once paid plans are available | Legal obligation — tax and accounting law |
| Answering you when you contact us | Legitimate interests |
We do not send marketing email. If that ever changes we will ask for your consent first, and you will be able to withdraw it at any time.
The rules here cover more than cookies. They apply to anything stored on, or read from, your device — including browser storage. Everything the site uses is listed below.
| What | Type | Purpose | Consent |
|---|---|---|---|
| Authentication session | Browser local storage, set by our authentication provider | Keeps you signed in as you move around the app. Without it, the service cannot work. | Strictly necessary — no consent needed |
| Your cookie choice | Browser local storage: vr_consent, and vr_analytics_optout
if you say no |
Records the choice you make in the cookie banner and when you made it, so that we do not ask again on every visit and can show that you were asked. It holds nothing but that preference and its date. | Strictly necessary — storing your choice is how we honour it |
| Cloudflare Web Analytics | No cookie, and no identifier stored on your device | Counts page views and basic page-performance figures in aggregate. | Nothing is stored on your device, so there is nothing to consent to |
| Google Analytics | Cookies, named _ga and _ga_…, lasting up to two years |
Aggregate statistics about how the service is used, so we can improve it. It is configured so that the data is not used for advertising, not used to build profiles, and not used to recognise you across other websites: Google Signals and advertising personalisation are switched off, and no advertising product is connected to it. | Your consent. These are not set, and nothing is requested from Google, unless you switch analytics on — see section 5 |
| Security challenges | Set by Cloudflare when a request looks automated | Distinguishes people from bots, and protects the service from scraping and attack. | Strictly necessary |
Nothing optional runs until you say so. The first time you visit, a short cookie notice asks whether you are happy with analytics. Until you answer, no analytics is loaded and no request is made to Google at all — refusing is one click, it is free, and the service works exactly the same either way. There is no “reject” buried two screens deep and no pre-ticked box.
We could have asked for less than this. UK law now allows aggregate analytics without consent so long as you are told and can object. We ask anyway, because most of the people using Vertex Revision are sitting a UK exam from outside the UK, and the rules where many of them live require being asked first. One standard for everybody is simpler to keep honest.
Nothing on this site is used for advertising. If we ever introduce advertising or cross-site tracking, we will ask for your consent separately and this page will change before that happens.
Analytics is off until you turn it on. You are asked once, in a notice at the bottom of the app, and your answer is remembered on that device. To change it later, use Cookie settings in the app’s footer, which reopens that notice — or use the control below, which does the same thing from this page.
This control applies to this browser, takes effect immediately, and costs nothing. Everything strictly necessary to run the service keeps working either way.
Your choice is stored on your device only, so clearing your browser data resets it and you will be asked again. We also honour your browser’s own “do not track” and Global Privacy Control settings automatically — if either is switched on, analytics never loads and you are not asked. If you would rather we handled it by email, make a request under section 8 instead.
Cloudflare Web Analytics is the one thing this does not switch off, and deliberately so: it sets no cookie and stores no identifier on your device, so there is nothing on your device to consent to or withdraw. It counts page views and page-speed figures in aggregate and cannot single you out. It is listed in section 4 with everything else.
We do not sell your data and we do not share it for anyone else’s marketing. We use the following service providers, who process data on our instructions:
| Provider | What they do for us |
|---|---|
| Supabase | Database, user accounts and authentication. Your account and study data are stored here, and the service emails described in section 3 are sent through it. |
| Cloudflare | Hosting and delivery of the site, protection against attack and automated abuse, and the cookieless aggregate analytics described in section 4. |
| Google Analytics, configured as described in section 4, and Search Console, which reports on how our pages appear in search results and does not identify you. |
Payments are not yet available. When they open we will use Stripe, which handles card details directly so that we never receive or store your card number, and this page will be updated to say so before any payment can be taken.
We may also disclose data where we are legally required to, or to establish or defend legal claims.
| Data | Retention |
|---|---|
| Account details and study data | While your account is open. If you delete your account, they are deleted — see section 9. |
| Daily usage counts | Kept for a short period for fair-use and anti-abuse purposes, then deleted or aggregated so they no longer identify you. |
| Google Analytics data | 14 months, and only if you agreed to
analytics — if you did not, none of it exists. Event-level analytics data,
including the identifier in the _ga cookie, is deleted automatically after 14
months. Aggregate reports built from it — totals with no identifier in them —
are kept for longer, because they no longer relate to an identifiable person. |
| Cloudflare Web Analytics data | Retained in aggregate only, in line with Cloudflare’s standard retention. It contains no identifier for your device. |
| Server and security logs | Retained for a limited period by our hosting and security providers, in line with their standard retention. |
| Payment and tax records | Retained for six years after the relevant tax year, because we are legally required to keep them. This will apply once paid plans are available, and it applies even if you delete your account. |
| Correspondence with us | Kept for as long as needed to deal with the matter, and then for a reasonable period afterwards. |
Under UK data protection law you have the right to:
To exercise any of these, email us using the address in section 13. We will respond within one month. There is no charge. We may need to verify your identity first, which normally means writing to us from the email address on the account.
You can delete your account yourself, from inside the app. Sign in, and on your home screen use Delete account. You will be asked to type the word DELETE to confirm, and nothing happens until you do. There is no charge and you do not have to give a reason.
If you would rather we did it for you, email [email protected] from the account’s own email address and we will action it and confirm when it is done.
Deleting an account removes your account record, your study history, your saved sessions and decks, your planner entries and your display name.
Deletion is permanent. Your study progress cannot be recovered afterwards. Two things survive deletion: payment and tax records, which we are legally required to keep for six years, and anonymised or aggregated statistics that no longer identify you. Aggregate counts of how the service was used are not restored to, or linked back to, a deleted account.
No online service can promise perfect security. If a breach affects your rights and freedoms, we will tell the Information Commissioner’s Office within 72 hours where required, and we will tell you without undue delay where the law requires it.
Your account and study data are stored in Ireland (our database
provider’s eu-west-1 region), which is inside the European Economic Area.
The UK has formally recognised the EEA as providing an adequate level of protection for
personal data, so no additional transfer safeguard is needed for that storage.
Some of our other providers — our hosting, security and analytics providers — are based outside the United Kingdom or operate global networks, so your data may be processed outside the UK and the EEA. Where that happens we rely on one of the safeguards UK law allows: either that the destination has been formally recognised as providing adequate protection, or an approved UK data transfer agreement (the International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses) together with any additional safeguards needed.
We will update this page when what we do changes. The date at the top always reflects the current version. If a change materially affects how we use your data — for example introducing advertising, or a new provider — we will make that clear rather than quietly amending the text, and where the law requires consent we will ask for it first.
For anything in this policy, including requests under section 8 and section 9, contact [email protected].
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.