Privacy Policy

1. Who we are and scope

AcuPrep is owned and operated by AcuPrep LLC, a Virginia limited liability company (“we”, “us”). This policy describes what we collect from students and parents who use acuprep.com, why, who processes it, and the rights you have over it. AcuPrep is an invite-only service currently offered only to U.S. residents age 13 and older. This policy is written with minors in mind: we collect the minimum we need to run an effective SAT prep service, and student data is never an advertising asset.

2. What we collect

Account data: name, email, date of birth (to verify eligibility and identify minors), U.S. state of residence, role (student or parent), and for students under 18 a parent or guardian's email and confirmation record. Study data: practice and mock-exam responses, timing, skill-mastery estimates, score history you enter, and study settings. Tutoring conversations: transcripts of text and voice tutoring and coaching sessions, plus short distilled summaries that personalize your tutor across sessions. Billing data: handled by Stripe — we receive subscription status and plan, never full card numbers. Email and support data: the recipient address, delivery status, and the content of messages you send to our support or security inboxes. Calculator data: expressions you enter into the embedded Desmos calculator may be processed by Desmos. Technical data: IP address, browser and device information, timestamps, security signals, request URLs, and error diagnostics needed to deliver, protect, and troubleshoot the service. We do not use third-party advertising or behavioral-analytics trackers.

Cookies and device storage: we use strictly necessary session and security cookies to keep you signed in, enforce the age screen, and protect forms. We use local browser storage to preserve in-progress answers and remember study, accessibility, and voice preferences on that device. We do not use advertising cookies.

No biometric data. We do not collect, store, or process fingerprints, face scans, voiceprints, or other biometric identifiers from adults or minors. Live voice tutoring processes what you say as audio so the tutor can respond, but AcuPrep does not use that audio to identify you or create a biometric template.

3. How we use it

To run the service: score your practice, estimate skill mastery, assemble the right questions, personalize tutoring, show parents their own student's progress, and process subscriptions. To keep it safe: enforce eligibility and age rules, prevent abuse, and audit administrative actions. To improve it: aggregate, de-identified analysis of how questions and features perform. We do not sell personal information, we do not serve ads, and we do not use student data for targeted advertising — commitments consistent with state student-privacy laws such as California's SOPIPA.

AcuPrep, as the service controller, does not use personal data, tutoring conversations, or student work to train a general-purpose or foundation language model. We may use aggregated or de-identified service measurements to improve question quality and reliability, but not to advertise to a student or build a commercial profile unrelated to SAT preparation.

4. AI processing

Tutoring, coaching, question review, voice tutoring, and memory features may use Anthropic, OpenAI, and Google, depending on the feature and our configuration. OpenAI currently provides realtime voice tutoring and memory embeddings. An xAI integration exists but is not currently enabled for personal or student data; we will not enable it for that data unless its account-level zero-data-retention control and the required contractual safeguards are verified.

AI personalization and persistent tutor memory are optional and require a separate, revocable choice from the student; a minor also needs guardian confirmation. We minimize what reaches an AI provider. To let the tutor address you by name, your first name is included in the tutoring prompt. We remove email addresses, common phone-number patterns, and repeats of the account display name from typed conversation text before an AI call. Automated redaction is not perfect and does not detect every name or identifier, so do not enter sensitive identifiers into the tutor. That filtering cannot happen before speech is understood: during live voice tutoring, the audio you speak is streamed directly to the active voice provider in real time and is not pre-redacted. AcuPrep stores the resulting conversation transcript, not a voiceprint or biometric template.

So that the tutor can teach you rather than a generic student, each tutoring request also includes a summary of your own learning data: your skill mastery levels, your accuracy by section and skill, recent practice and mock results, your target score and test date, and the error patterns we compute from the answers you have given. This is your own progress information, computed by us from your work on AcuPrep, and it is used only to tutor you — never to advertise to you, and never sold.

Active AI providers are used under business, API, or paid-service terms and configurations that do not permit training their foundation models on your data. AcuPrep stores conversation transcripts and shorter learning memories under the student's account; we minimize direct identifiers sent to providers but do not claim those stored records are anonymous. Access is restricted by account authorization and operational need; an authorized linked parent may request access to their minor student's records. A student may turn off future AI processing and request deletion of optional AI transcripts and memories as described in section 8.

5. Children and minors

Under 13: AcuPrep does not accept users under 13 and does not knowingly collect their personal information. Our signup asks every student's date of birth; an under-13 answer stops account setup, and if we learn an account belongs to a child under 13 we will delete it and its data. Parents who believe a child under 13 has an account should contact support@acuprep.com. 13–17: a parent or guardian must review and agree to our terms with the student, and the student must name a guardian email. We send that address a private, expiring confirmation link. Basic non-AI practice is available while confirmation is pending, but AI tutoring, voice, coaching, AI walkthroughs, and persistent tutor memory stay off until both the student and guardian authorize them. The guardian confirms their relationship, the current policy versions, and the AI/persistent-memory use; we record the confirmation time, email, IP address, user agent, and document versions. A student under 18 cannot buy a subscription — only an adult can purchase a plan that covers a student. A linked parent sees their own student's progress — read-only — may request access to the student's tutoring records, and can exercise all of the rights in section 8 on the student's behalf, including deleting that data.

6. Who processes your data

We disclose data only to service providers needed to operate AcuPrep, under their agreements with us and only for the purposes described below:

• Supabase — authentication, database, file storage, backups, and related infrastructure.
• Vercel — application hosting, content delivery, security, and operational logs.
• Stripe — adult checkout, subscriptions, billing records, fraud prevention, and tax calculation. Payment-card details stay with Stripe.
• Anthropic, OpenAI, and Google — the AI functions described in section 4. xAI is not active for personal or student data unless the safeguards described in section 4 are first verified.
• Resend — transactional email delivery, including waitlist and account messages where configured. Supabase also processes authentication-email requests.
• Cloudflare Turnstile — bot and abuse prevention on login and public forms. It processes browser, device, network, IP, and challenge information; Cloudflare also provides authoritative DNS for acuprep.com but does not proxy AcuPrep application traffic.
• Sentry — error monitoring and operational alerts. We configure it without session replay, performance tracing, request bodies, cookies, or default user PII, although technical diagnostics such as a URL or IP address can still be personal data.
• Desmos Studio PBC — the embedded Graphing and Scientific Calculators. Desmos can receive browser and network information, calculator expressions, and calculator telemetry; AcuPrep does not intentionally send it your account profile or study history.
• Google Workspace — messages sent to AcuPrep support, privacy, security, and operational email addresses.

We may also disclose information when required by law, to protect users or the service, or as part of a merger, financing, acquisition, or sale, in which case this policy's protections continue to apply to the data. We do not sell personal information, share it for cross-context behavioral advertising, use data brokers, or operate advertising partnerships.

7. Retention and security

We keep account and study data while the account is active, so your mastery history and progress survive between sessions. Raw text and voice tutor transcripts in our transcript archive are ordinarily retained for no more than 12 months unless you delete them sooner. Coach conversation history and the shorter distilled memories used to resume and personalize tutoring remain with the active account until deletion. Support and security messages are kept only as long as needed to resolve the request, preserve an incident record, or meet a legal obligation. When an account is deleted, personal data under our control is ordinarily removed within 30 days, except records we are legally required to keep (such as billing and tax records) and encrypted backups that expire through their normal retention cycle. Data is encrypted in transit; access is enforced row-by-row in the database so each account can read only its own records; answer keys and other sensitive content never reach the browser; and administrative actions are logged.

8. Your rights

You — or, for a student under 18, your parent or guardian — can access, correct, export, or delete your personal data, or delete just your tutoring transcripts and memories. Many of these you can exercise yourself, right away: students can download a machine-readable copy of their account, study, consent, subscription, and tutoring session records or permanently delete their account from Settings; a linked parent can download those records for their student or request the student's deletion from the parent dashboard. To request access to any remaining content, including archived transcript content, or to make any other request, email support@acuprep.com from the account's email address or use our privacy request form. We first verify the requester's identity and track the request against the deadline that applies to it; we ordinarily respond within 30 days and never discriminate for exercising these rights. If we deny a request, our decision explains why and how to appeal. You may appeal through the same form by choosing “Appeal a privacy decision”; we review the decision afresh and use a different reviewer when reasonably available. California residents: the rights above cover your CCPA/CPRA rights to know, delete, and correct; we do not sell or share personal information as those terms are defined in the CPRA, so there is nothing to opt out of. Residents of other states with privacy laws have the equivalent rights through the same address.

9. Changes and contact

If we materially change this policy, the new version will be presented for acceptance in the app before it applies to you, and each acceptance is recorded with its version. Questions or requests: AcuPrep LLC · support@acuprep.com · 8401 Mayland Dr #11346, Richmond, VA 23294.