CASEPREPARATION
Privacy Policy
Effective date: 19 October 2026
Your preparation data should be used for clear purposes. This policy explains how CasePreparation handles information when you visit our website, create an account, practise a game, purchase access or contact us.
Privacy questions: info@casepreparation.com.
1. Who is responsible for your information?
CasePreparation is operated by CasePreparation Inc., at 9735 University Crescent, Burnaby, British Columbia V5A 0E8, Canada. This operator is responsible for the personal information described in this policy.
Privacy contact: info@casepreparation.com. Privacy requests are handled by the person accountable for privacy at CasePreparation Inc., reachable at the email and postal address above.
2. What information do we handle?
- Account information: your name, email address, account identifier and authentication information used to create and manage your account, plus the assessment date or “not scheduled” status, target firms, career background and browser time zone you provide during registration.
- Practice information: the games you use, your answers and decisions, timing, completion records, results and generated reports.
- Purchase information: transaction references, payment status, purchase date, access period and billing information required for receipts or invoices. Payments are processed by Stripe. We do not collect or store your full card number or card security code on the practice platform. Stripe processes your payment and provides transaction and billing information for payment administration, receipts, refunds and accounting.
- Support and refund information: messages you send us and any official assessment result or screenshot you submit for a refund, including your visible name and result date.
- Technical information: the IP address, browser and device details, error logs, sign-in events and security events that our hosting and authentication providers record when you use the service.
- Marketing preferences: whether you have agreed to receive preparation tips or offers and whether you have unsubscribed.
Please redact unrelated information from assessment evidence. We do not need your McKinsey login, password, interview correspondence unrelated to the claim or proprietary assessment questions.
3. Why do we use it?
| Purpose | Information used | Basis where GDPR applies |
|---|---|---|
| Create your account, provide practice and generate reports | Account and practice information | Performance of our contract with you, or steps you request before entering it |
| Process purchases and administer access | Account, transaction and billing information | Contract; legal obligations for applicable accounting and tax records |
| Answer support requests and assess refund claims | Contact details, messages, run records and result evidence | Contract; legal obligations where applicable |
| Keep the service secure and investigate misuse | Relevant account information and security logs | Legitimate interests in protecting users and the service, subject to applicable privacy safeguards |
| Send optional preparation emails or offers | Email address and marketing preferences | Your consent to preparation emails and offers |
| Measure usage or improve the service | Account, practice and purchase records, together with email delivery, open, click and unsubscribe events. We do not use advertising-network pixels on the Solve website. | Legitimate interests for essential service measurement; consent where required for optional email engagement tracking |
Where consent is required, you can withdraw it without affecting earlier lawful processing. Outside the GDPR, applicable consent requirements and other lawful permissions govern our handling of information. Account and payment information is necessary to supply the requested service; without it we may be unable to create an account or process a purchase. Marketing consent is optional.
4. Emails and your choices
Account, security, purchase and support messages are used to administer your service. Promotional emails, including post-run offers, preparation tips and checkout follow-ups, require your optional marketing consent. We select relevant messages using your stated assessment date, the games you have tried and whether you have purchased. Promotional messages are limited to one in any 24-hour period. Essential service messages are handled separately.
You can unsubscribe from promotional emails using the link in each message or by writing to us. Unsubscribing does not cancel your access or stop essential service messages.
5. Cookies and similar technologies
The website uses browser storage to keep you signed in, remember practice settings and return destinations, and avoid repeating account setup operations. Clearing browser storage can sign you out and remove these settings.
We store completed-run report data on our server so you can reopen saved runs from your account. Runs completed with full access are retained for 60 days, with a maximum of 50 saved reports per account. The first free run saved for each game is retained for 30 days. Full scores, feedback and PDF downloads require paid access. The browser also keeps the latest completed run per game in the current tab for up to 24 hours as a recovery aid. Download any PDF you want to keep longer.
We use Google Analytics 4 to understand how visitors use the website: pages viewed, buttons clicked, how visitors arrive, and purchase steps. It sets analytics cookies and processes your IP address, which Google does not store in Analytics. We do not use it for advertising, and Google signals and ad personalisation are switched off. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked first: analytics cookies are set only if you choose “Accept”. You can change your choice at any time with the “Cookie settings” link at the bottom of our pages. See how Google uses information from sites that use its services.
Cloudflare Turnstile provides security verification for registration, sign-in and password reset. It processes technical browser and connection signals to detect automated traffic. See the Turnstile Privacy Addendum. Stripe’s checkout uses its own technologies under its privacy policy.
6. Service providers and other recipients
Information may be handled by providers supporting the purposes stated above, including hosting, account authentication, database storage, payments, email delivery and customer support. The confirmed providers and their roles are:
- Supabase: accounts, authentication and database. Our project database is hosted in Sweden (EU). supabase.com/privacy
- Vercel (Vercel Inc.): website and application hosting, and the request logs that come with it. Processor. United States and its global edge network. vercel.com/legal/privacy-policy
- Stripe (Stripe, Inc. and its group companies): payment processing. Independent controller for the payment itself. United States and Ireland. stripe.com/privacy
- Brevo: email delivery and contact management. We synchronize your email address, first name and mailing-list membership based on your marketing preference. Emails sent through Brevo may include tracking pixels and rewritten links that record opens and clicks; email-client privacy features can affect these signals. Brevo privacy policy
- Cloudflare Turnstile: security verification for account actions. Turnstile Privacy Addendum
- jsDelivr: public content delivery network that serves two open-source code libraries to your browser. Requests for these files disclose technical connection information such as your IP address and browser request headers. jsdelivr.com privacy policy
- Google Fonts: website fonts loaded by your browser, which disclose technical connection information when requested. Google Fonts privacy information
We may disclose information where required by law, to respond to valid legal requests or to establish, exercise or defend legal claims. We do not sell your information and we do not share it for advertising. Solve practice answers are evaluated by our simulation engines; we do not send those answers to a generative AI service for assessment.
Submitting a refund claim does not authorise publication of your result, identity or testimonial. Any publication needs a separate appropriate basis.
7. Where information is processed
Our operator is based in Canada and our Supabase project database is hosted in Sweden. Hosting, email, payment and other providers may process information in other countries as described in their privacy and data-processing terms. International transfers are subject to the protections required by applicable law, including contractual safeguards where required. Contact us for information about the safeguards relevant to your data.
8. How long we keep information
We apply the following retention criteria. Account closure and privacy requests are handled through our support team; report expiry is enforced by the platform.
| Record | Retention period or criteria |
|---|---|
| Free accounts and practice progress | Reviewed for closure after 12 months without account or practice activity. Before deleting an inactive account, we send at least 30 days' notice so you can sign in to keep it open. |
| Paid Solve account and practice progress | Retained during the paid access period, then reviewed for deletion 90 days after access expires. An account may remain open where it is needed for another active service or an unresolved request. |
| Saved report data | 60 days after completion for runs completed with full access, up to 50 saved reports. The first free run saved for each game is kept for 30 days. Run counts used for the guarantee are retained with the account separately from the report data. |
| Invoices and transaction records | Generally six years from the end of the tax year to which they relate, or longer where law or an unresolved tax matter requires it. |
| Refund evidence and support messages | For handling the request and normally up to two years after final resolution, with longer retention where an unresolved dispute or legal obligation requires it. |
| Security logs and recovery copies | For investigating incidents and maintaining service security, subject to the providers' configured retention periods. Recovery copies, where maintained, are restricted to recovery purposes and expire under the relevant retention settings. |
| Email events and marketing preferences | For measuring and managing the email relationship while it remains relevant. After an unsubscribe, we retain the minimum information needed to honour the opt-out and demonstrate the preference or consent where required. |
Deleting an account may not erase records we must retain by law. Any retained information remains restricted to the purpose justifying retention.
9. Security
We use encrypted connections, Supabase password hashing and access controls for account and practice records. Saved reports are retrieved through an authenticated service that checks account ownership. Administrative access is restricted, and server credentials are not included in public website code. We assess incidents and notify affected people and authorities where required by law. No online service can promise absolute security.
10. Your privacy rights
Depending on the law that applies, you may have rights to access or obtain a copy of your information, correct it, request deletion, restrict or object to processing, receive portable data, withdraw consent and complain to a privacy regulator. These rights may be subject to legal exceptions.
Contact info@casepreparation.com to make a request. We may ask for proportionate information to verify your identity and will respond within the applicable legal deadline. You do not need to submit an assessment result to make a privacy request.
Relevant regulator: the Office of the Privacy Commissioner of Canada (priv.gc.ca), and for British Columbia the Office of the Information and Privacy Commissioner for BC (oipc.bc.ca). If you live elsewhere you may also complain to your own national authority.
11. Scores and automated processing
The simulator automatically evaluates your practice performance and generates feedback. These results are for preparation; they are not McKinsey results and do not determine your recruitment outcome. With your marketing consent, practice activity and information you provide may also select relevant preparation emails. We do not rank you against other candidates for recruitment purposes; practice scores do not change the package price or determine what you can buy.
12. Changes and contact
We will update this policy when our practices change and provide appropriate notice of material changes. Where required, we will obtain fresh consent before using information for a new purpose.
For questions or complaints, email info@casepreparation.com or write to the operator at the address in section 1.