How MBB Gorilla handles your personal data, written to be read rather than skimmed.
1. Who we are
MBB Gorilla (mbbgorilla.com) is an independent practice platform for the Bain & Company online assessment. It is operated by MBBGorilla.com, 30 N Gould St Ste R, Sheridan, WY 82801, United States ("we", "us"). We are the controller of the personal data described here. For anything in this policy, including a data request, email [email protected].
We are a small operation and do not have a statutory Data Protection Officer. Requests go to the same address and are handled by the person who runs the site.
2. What we collect
- Account data: email address, display name and a password hash (we never see your password). If you sign in with Google, we receive your email address, name and profile picture URL from Google.
- Practice data: the sections you attempt, your answers, scores, time per question, which questions you have already seen, your streak and achievements.
- Preferences you give us: the firms you are targeting, the Bain office you are applying to and your assessment date. We use them to set your countdown and reminders and to decide which emails you get.
- Time zone: your browser's time zone, so emails tied to your assessment date arrive at a sensible local time.
- Purchase data: what you bought, when, the amount, and Stripe's customer and payment identifiers. Card and wallet details (including Apple Pay, Google Pay and Link) are handled entirely by Stripe and never reach our systems.
- Email data: whether our emails were delivered, opened or clicked, your unsubscribes, and the result of an automatic check that your email address can receive mail.
- Measurement data: an anonymous visitor id, pages viewed, practice and checkout events, which version of a page or email you saw, the page you first landed on, the referring website, your device type, and which email or advert brought you to the site (including campaign tags and advertising click ids such as gclid or fbclid when they are in the link you followed).
- Technical data: IP address, browser and device type, and referring URL, processed by our hosting and security providers to serve and protect the site.
We do not ask for special category data. We do not knowingly collect data from anyone under 16.
3. Why we use it, and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create your account and keep you signed in | Account data | Contract |
| Run the simulators and show your scores and progress | Practice data, preferences | Contract |
| Show the leaderboard (see section 4) | Display name, profile picture, average score, number of tests | Legitimate interests |
| Take payment, issue receipts, process refunds and handle payment disputes | Purchase data, account data, practice data | Contract; legal obligation for tax records; legitimate interests for disputes |
| Activate a SolvePrep access key included with your purchase, if you choose to redeem it (we send your email address and the key to SolvePrep to verify it) | Email address, the key | Contract |
| Send account and transactional emails: receipts, password resets, sign-in | Account data, purchase data | Contract |
| After you create a free account, send practice follow-up emails timed around your assessment date (for example after you reach a paywall, or about an unfinished checkout), and occasional emails about our related prep sites for other consulting firms' assessments. Opt out at any time with the unsubscribe link in every such email or by emailing us | Account data, preferences, time zone, practice results | Legitimate interests (account holders), ended by unsubscribing |
| Improve our emails: account holders are randomly assigned to one version of our follow-up emails, and a small group receives fewer follow-up emails, so we can measure what actually helps | Account data, email data, purchase data | Legitimate interests |
| Check that a signup email address can receive mail | Email address | Legitimate interests |
| Measure how the site is used and test improvements | Measurement data | Legitimate interests (first-party only; no third-party trackers) |
| Keep the service secure and prevent fraud and abuse | Technical data, account data | Legitimate interests |
4. The leaderboard
After you complete at least three tests, your display name, profile picture (if you have one), average score and number of tests can appear on the leaderboard that other signed-in users see. You can change your display name from your profile page, or email [email protected] and we will remove you from the leaderboard.
5. Cookies and similar storage
Essential storage keeps you signed in and holds your in-progress attempt. We also use:
- mbbg_vid: a first-party cookie (1 year) and matching local-storage entry holding an anonymous visitor id, used for measurement and to keep the version of a page you see stable;
- mbbg_ft: a first-party cookie (about 13 months) and matching local-storage entry recording the page, referring website and campaign tags of your first visit, so a later signup can be attributed;
- local-storage entries recording which email or advert you arrived from (kept 30 days) and which events have already been counted in this session.
We do not use third-party advertising or analytics cookies, and we do not load advertising pixels. Measurement events are stored in our own database. You can clear or block these entries in your browser settings at any time; the site keeps working without them.
6. Who processes data for us
| Processor | What they do | Where |
|---|---|---|
| Lovable Cloud (built on Supabase) | Application hosting, database, authentication and backend functions | United States and European Union |
| Cloudflare | DNS, content delivery and protection against attacks | Global edge network |
| Stripe | Card and wallet payments (including Apple Pay, Google Pay and Link), receipts, refunds, disputes | United States and European Union |
| Brevo | Email delivery and delivery/open/click statistics | European Union |
| ZeroBounce | Email address validation at signup | United States |
| Sign-in, only if you choose "Continue with Google" | United States |
We do not sell your personal data, and we do not share it with Bain & Company, TestGorilla, Sova, any employer, or advertising networks.
7. International transfers
We are based in the United States, and some of our processors handle data in the United States and other countries outside the UK and EEA. For visitors in the UK and EEA, those transfers rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (or the EU–US Data Privacy Framework where the provider is certified), together with the provider's own safeguards. You can ask us which mechanism applies to a specific provider.
8. How long we keep it
- Account and practice data: while your account is open, then deleted within 30 days of your closing it or asking us to.
- Purchase and tax records: seven years after the purchase, because tax and accounting rules require it. This survives account deletion.
- Measurement events: page views 90 days; signup, checkout, purchase and experiment events about 13 months.
- Email delivery logs: 12 months.
- Unsubscribes: if you unsubscribe or ask us to delete your account, we keep your email address on a suppression list so that we never email you again by mistake.
9. Your rights
Depending on where you live (including under the UK and EU GDPR and US state privacy laws such as California's), you can ask us to give you a copy of your data or export it, correct it, delete it (subject to the tax records above), restrict or object to processing based on legitimate interests, and withdraw consent or unsubscribe from non-transactional email at any time without affecting your access.
We do not sell your personal information or share it for cross-context behavioral advertising, and we will not treat you differently for exercising your rights.
Email [email protected] and we will respond within one month (45 days where US state law allows). We may ask you to confirm the request from the email address on your account. If you are in the UK or EEA and unhappy with our response, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
10. Automated decisions
Scoring your practice attempts is automated, but it has no legal or similarly significant effect on you: it is feedback on a practice test, not an assessment outcome, and no employer ever receives it.
11. How we protect your data
All traffic to the site is encrypted (HTTPS). Our database only lets each account read its own practice and purchase data, and admin access is limited to the person who runs the site. No system is perfectly secure; if a breach affects your personal data, we will tell you and, where the law requires it, the relevant regulator.
12. Changes
If we change this policy materially, we will email account holders or show a notice in the app before the change takes effect. The date at the top always shows the current version.
13. Contact
Privacy questions, data requests and complaints: [email protected], or by post to MBBGorilla.com, 30 N Gould St Ste R, Sheridan, WY 82801, United States.