Privacy Policy

This policy explains what information Attain Prep (“we,” “us”) collects, how we use it, and the choices you have. The short version: we collect what we need to run a study tool for your family, we share it only with the service providers that run the product, we do not sell it, and we do not run ads or advertising trackers.

1. What we collect

Account information

The parent’s name and email, the family name you choose, and each student’s name and email. Passwords are stored only in securely hashed form by our authentication provider; we cannot read them.

Study activity

The student’s practice history: which questions were answered, the answers given, right or wrong, how long each took, skill-level progress, flashcard reviews, lesson views, practice-test scores the family enters, and the study plan generated from all of this. This is the heart of the product — it is what drills, review, and the score estimate are built from.

Tutor conversations

Messages the student sends to the AI tutor and the tutor’s responses, kept so the conversation can continue across sessions and so we can enforce fair-use limits.

Billing information

Payments are handled by Stripe. We receive subscription status, seat counts, and billing events. We never receive or store full card numbers.

Technical basics

Standard server logs (IP address, browser type, timestamps) kept briefly for security and debugging. We use browser storage only to keep you signed in and to let practice work offline; we set no advertising or analytics cookies.

2. How we use it

• To run the Service: pick questions, schedule reviews, build the study plan, estimate scores, and show the parent dashboard.
• To power the AI tutor (see section 3).
• To bill subscriptions and manage seats.
• To send service email: account confirmations, password resets, billing notices, and the weekly progress digest.
• To keep the Service secure and debug problems.

We do not sell personal information. We do not use it for advertising. We do not train AI models on it.

3. The AI tutor and your data

When a student asks the tutor for help, we send the tutor conversation and the relevant question’s content to our AI provider to generate the response. That is the only purpose it is used for. Students should not put unrelated personal information into tutor chats; the tutor does not need it and the conversation is stored with the account.

4. Who we share it with

Only the service providers that run the product, each bound to use the data solely to provide their service to us:

• Supabase — database and login accounts (hosted in the United States).
• Cloudflare — hosting and content delivery.
• Stripe — payment processing.
• Venice AI — generates the AI tutor’s responses.
• Bento — delivers our service email (its delivery infrastructure may register when an email is opened).
• Google Workspace — receives email you send to us.

Beyond these providers, we disclose personal information only if the law requires it, or to protect the safety and rights of our users or the Service. If Attain Prep is ever acquired or merged, this policy would continue to apply to existing data, and we would notify you before any new policy took effect.

5. Children and student data

Attain Prep is built for high-school students preparing for the SAT. Student accounts are created by a parent or legal guardian, who consents to the student’s use of the Service and to the data practices in this policy. The Service is intended for students 13 and older.

Parents can see their students’ progress in the dashboard, and can ask us at any time to show, correct, export, or delete a student’s data. Student data is used only to run the Service for that student — never for advertising, never sold, never used to build profiles for any other purpose.

6. Retention and deletion

We keep your family’s data while the account exists, including through subscription pauses and cancellations, so a returning student does not lose their history. To delete a student profile or the whole account, email us at rex@attainprep.com and we will delete the associated personal data within 30 days, except records we must keep for legal or billing reasons (for example, Stripe’s record of past payments).

7. Security

All traffic is encrypted in transit. Database access is controlled with per-family row-level security, so one family’s data is never readable by another. Passwords are hashed. Access keys are held server-side and never shipped to the browser. No system is perfectly secure, but if we ever discover a breach affecting your personal data, we will notify affected account holders promptly by email.

8. Your rights

Email rex@attainprep.com to access, correct, export, or delete your family’s personal information, or to ask any question about this policy. Depending on where you live, these rights may also be backed by local privacy law; we honor the requests regardless.

9. Changes

If we change this policy in any meaningful way, we will email account holders before the change takes effect and update the date at the top of this page.