Privacy Policy

When an individual or parent signs up directly, we act as the controller of that personal information. When a school or district provides the Service to its students, the institution directs how student data is used, and we act as a service provider / processor and, where applicable, a school official under the Family Educational Rights and Privacy Act (FERPA), handling student data only to provide the Service under our agreement with the institution.

Information you provide.

• Account details: name or display name, email address, and password (stored only as a salted hash by our authentication provider).
• Learning profile: target score, test date, grade level, available study time, and similar onboarding inputs.
• Study activity: your answers, confidence ratings, reflection tags, time spent per question, lesson progress, practice-test results, streaks, and predicted scores.
• AI tutor conversations: the messages you send to and receive from the tutor.
• Optional uploads: official score reports you choose to submit for the efficacy study or for verification.
• Support and feedback: messages you send us, including flags on questions or explanations.

Information collected automatically.

• Device and usage data: pages and features used, actions taken, approximate (city-level) location derived from IP address, browser and device type, and timestamps.
• Cookies and similar technologies: essential cookies to keep you signed in, and privacy-respecting product analytics used to understand and improve the Service. We do not use cookies for third-party advertising.

Information from others. If a parent links to a student, or a teacher adds a student to a class, we receive the connection and limited profile information needed to provide shared dashboards. Payment processors confirm the status of a purchase without sending us full card numbers.

• to provide the Service: score the diagnostic, build and update your personalized plan, schedule reviews using spaced repetition, run the AI tutor, and estimate your predicted score;
• to personalize your experience, including which questions and lessons you see next;
• to operate shared dashboards you have enabled (parent progress sharing, teacher and district cohort views), with privacy-safe aggregation that never exposes one student's raw responses to peers;
• to improve content and the Service, including measuring item quality, retiring weak or flagged questions, and producing de-identified and aggregated analytics and research;
• to communicate with you about your account, your progress, and (where you have not opted out) re-engagement and product updates;
• to provide security, prevent fraud and abuse, enforce our Terms, and comply with law.

Where required, we rely on legal bases including performance of our contract with you, your consent (including verifiable parental or institutional consent for minors), our legitimate interests in operating and improving the Service, and compliance with legal obligations.

To power the AI tutor and generate explanations, we send the relevant question context and your messages to third-party large-language-model providers. We contractually require these providers to:

• process the data only to return a response to us, and not to train their general-purpose models on your content;
• apply appropriate security and confidentiality protections; and
• delete or return data in accordance with our agreements.

We store tutor conversations to provide continuity, to let you revisit them, and to improve our own reviewed explanation database. We may use de-identified conversation data to evaluate and improve tutor quality.

We design the Service to be safe for students, including minors.

• Under 13 (COPPA):We do not knowingly collect personal information from children under 13 without appropriate consent. Where a school or district uses the Service, the institution may provide consent on behalf of parents for the limited educational purpose of the Service, consistent with COPPA. Where a parent creates and supervises an account, the parent provides that consent. A parent or institution may review, request deletion of, and refuse further collection of a child's information by contacting us.
• Student records (FERPA):When we handle student data on behalf of an educational institution, we treat it as the institution's education records, use it only to provide the Service under our agreement, do not use it for unrelated commercial purposes, and return or delete it at the institution's direction.
• No advertising or sale of student data. We never sell student personal information and never use it to deliver third-party behavioral advertising. We honor applicable state student-privacy laws, including laws modeled on SOPIPA.

We share personal information only as follows:

• Service providers: vendors that host our infrastructure, authenticate users, process payments, provide the AI models, send transactional email, and provide product analytics, each bound by contract to protect the data and use it only for us.
• People you choose: parents you link to, and teachers and administrators of a class or organization you join, see the progress information those roles are designed to show. Students control parent progress sharing and can turn it off.
• Institutions:where the Service is provided through a school or district, we share that institution's students' data with the institution.
• Legal and safety: where required by law or to protect the rights, safety, and security of users, the public, or Percentile.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy and continued protection of your data.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We keep personal information for as long as your account is active and as needed to provide the Service, then for a limited period as required for legal, security, and legitimate business purposes. You may request deletion of your account and personal data from your settings or by emailing us; we process verified deletion requests within 30 days, except for information we must retain by law or in de-identified form. For institutional accounts, we follow the institution's deletion instructions. We maintain encrypted backups and a hard-deletion process so deleted data is removed from active systems and ages out of backups.

We use technical and organizational safeguards appropriate to the sensitivity of the data, including encryption in transit, row-level database access controls that scope each user to their own data, least-privilege access for staff, and routine backups. Answer keys and exam content are served only through controlled server logic and are never exposed to clients before an answer is submitted. No system is perfectly secure, but we work continuously to protect your information and will notify affected users and authorities of a data breach as required by law.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain uses. Tools in the Service let you:

• view and edit your profile and study plan;
• control parent progress sharing and weekly emails;
• manage notification preferences;
• request a copy of your data or request account deletion.

California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of "sale" or "sharing" (we do neither). Residents of the EEA, UK, and similar jurisdictions have rights under the GDPR and equivalent laws. We do not discriminate against you for exercising these rights. To make a request, email privacy@percentileprep.com; we may need to verify your identity, and an authorized agent or parent may submit a request on a user's behalf.

We operate in the United States, and your information may be processed in the United States and other countries where we or our service providers operate. Where required, we use appropriate safeguards, such as standard contractual clauses, for international transfers. By using the Service, you understand your information may be processed in the United States.

We use essential cookies to keep you signed in and to remember your preferences, and privacy-respecting analytics to understand how the Service is used so we can improve it. We do not use advertising cookies or sell data to advertisers. You can control cookies through your browser settings; disabling essential cookies may prevent the Service from working.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice, such as by email or an in-product notice, before the change takes effect where required. The "Last updated" date above shows when this policy was last revised.

For privacy questions or requests, contact our privacy team at privacy@percentileprep.com. Schools and districts with data-protection questions can reach us at privacy@percentileprep.com to request our data-protection addendum.