Privacy Policy

Notice at collection

This table summarizes the personal information we collect, why we collect it and how long we keep it. The sections below give the details.

"Shared" means shared for cross-context behavioral advertising. We do not sell or share any category of personal information.

1. Who we are and what this policy covers

EPPPPrep.ai is an exam-preparation service for the Examination for Professional Practice in Psychology (EPPP). It is operated by EPPP Prep AI, LLC, a California limited liability company, 8500 Wilshire Blvd., Suite 740, Beverly Hills, CA 90211. We are responsible for the personal information described in this policy.

The service is built for adults preparing for psychology licensure. It is not directed to children (section 11).

This policy covers the EPPPPrep.ai website and service, including the Helix U pages for university psychology departments. It does not cover websites and services run by others, such as Google's sign-in pages or outside websites we link to. Their own privacy policies apply.

Our Terms of Service also apply when you use the service.

2. Information we collect

2.1 Information you give us

• Account details. When you create an account, you give us your full name, email address and password. You can also add your exam date. When you tick the consent box, we record the time you accepted our Terms of Service and this policy, and which version of them you accepted.
• Account changes. If you change your name, email address or exam date, we store the new value. A new email address is held until you confirm it from both your old and new addresses.
• Messages to Psi. What you type to Psi is sent to our AI provider to create a reply (section 4).
• Messages to us. If you email us, we receive your email address and what you write, and we use them to respond.

2.2 Information created when you use the service

When you are signed in, we record your learning activity:

• each answer you give in Study Mode quizzes, Integrated Practice, the diagnostic test and Full-Length Exams, whether it was correct and when you answered;
• your quiz, practice set, diagnostic and exam results, including scores by Knowledge Domain or exam domain, and the time you used;
• your quiz settings, such as the sections you chose and whether "Prioritize Missed" is on.

Our own software calculates your progress summaries and study suggestions from these records. They are not produced by the AI model.

Some things stay in your browser and never reach us. These include the notes, flags, highlights and strike-outs you make during a Full-Length Exam.

If you are not signed in, you can still try quizzes, practice sets, the diagnostic test and exams. Your answers are sent to our server only so they can be graded, and we do not save them. Your browser may keep a summary of your results (section 6).

We also keep a count of the Psi messages you send each day, so we can apply a daily limit.

Our sign-in provider keeps account records, such as when you created your account, confirmed your email address and last signed in.

2.3 Information from Google sign-in

If you choose "Continue with Google", Google shares your Google account email address, name and basic profile information with us, as shown on Google's consent screen. We use:

• your email address as your account email; and
• your name for your profile.

Our sign-in provider also keeps the identity information Google sends so it can recognize you at your next sign-in. [Confirm: the Google identity fields Supabase stores in production.] If your Google email address matches an existing EPPPPrep.ai account, you sign in to that account. The first time you continue with Google, we record the time you accepted our Terms of Service and this policy, and which version of them you accepted.

We use Google information only to create your account and sign you in. We do not use it for advertising, we do not sell it, and we share it only with the service providers that run our sign-in and database (section 5).

Google learns that you signed in to EPPPPrep.ai. Google's own privacy policy covers what Google does with that information.

You can remove EPPPPrep.ai's access in your Google Account settings. This does not delete your EPPPPrep.ai account. To delete your account, use the Account page (section 8.2).

2.4 Information from institutions (Helix U)

Helix U is our program for university psychology departments. Today, institutions do not send us information about learners, and they cannot see your account, answers or results. The Helix U access page does not send your information to us or to any institution.

If we later offer access through an institution, the institution might give us information such as your name, school email address and program so we can set up your access. Before that happens, we will update this policy to explain what the institution provides, what it can see and how its agreement with us limits the use of your information (section 12).

2.5 Information collected automatically

• Logs. Our hosting and database providers record technical information about requests to the service, such as IP address, browser type, the page or action requested, the date and time and error codes. Our sign-in provider also records security events, such as sign-ins and password changes, and keeps a record of your signed-in sessions. These records can include an IP address and browser type.
• Security check. The forms to create an account, sign in, reset your password, change your password on the Account page or send an email again include a security check from Cloudflare (Cloudflare Turnstile), which tells people from automated programs. To run it, Cloudflare processes your IP address and technical information about your browser and connection (section 5).
• Cookies and browser storage. We use cookies that keep you signed in and complete Google sign-in, one cookie that remembers your time zone, and storage in your browser that saves work in progress and a few related items (section 6).

Our own server logs record error codes and technical measurements. They do not record your name, email address, Psi messages or answers.

We do not use analytics, advertising or social media tracking tools.

2.6 Information we do not collect

We do not ask for your date of birth, government ID numbers, professional license numbers, payment card details, precise location, contacts, photos, or health, disability or demographic information. Please do not send us this kind of information, including in Psi messages.

3. How we use information

We use personal information to:

• Provide the service. Create and run your account, sign you in, and show you the Strategy Guide, Study Mode, Integrated Practice, the diagnostic test and Full-Length Exams.
• Score your work and show your progress. Grade your answers, calculate your results, show your progress over time, and put questions you missed first when you turn on "Prioritize Missed".
• Run Psi. Send your question and the relevant study content to our AI provider, and show you the reply (section 4).
• Support your study plan. Use your exam date to show study-planning milestones in the service.
• Keep the service secure. Protect accounts, prevent abuse, check that sign-ups and sign-ins come from people rather than automated programs, apply daily limits and investigate problems.
• Communicate with you. Send account emails, such as sign-up confirmations, sign-in links, password resets and email-change confirmations. Tell you about important changes to the service, our Terms of Service or this policy. Reply when you contact us.
• Improve the service. Find and fix errors, and review how questions perform (for example, how often a question is answered correctly) so we can correct unclear items and improve our content. We use aggregated or de-identified information for this where we can. [Confirm: the owner will review question statistics.] When we de-identify information, we keep it in de-identified form and do not try to re-identify it, except as the law allows.
• Meet legal obligations. Comply with the law, respond to lawful requests, enforce our Terms of Service and protect our rights and the rights of others.

We do not:

• sell your personal information;
• share it for cross-context behavioral advertising or show you targeted advertising;
• use your personal information to train AI models, and our AI provider may not use it to train its models (section 4); or
• make decisions about you that have legal or similarly significant effects based only on automated processing.

If we want to use personal information for a new purpose that is not compatible with the purposes above, we will tell you first and ask for your consent where the law requires it.

4. Psi and AI

Psi is the AI tutor in EPPPPrep.ai. It answers questions about EPPP content, Study Guide material and practice questions. Psi is available when you are signed in. It uses an AI model provided by OpenAI ("our AI provider").

What is sent to our AI provider. When you send Psi a message, our server builds a request from:

• your message (up to 1,000 characters);
• up to eight earlier messages from the same conversation;
• EPPPPrep.ai study content chosen for what you are viewing, such as the Study Guide section or the practice question and its answer choices; and
• if you are asking about a question you have already answered, the answer you chose and whether it was correct; and
• on Metrics, a summary of your recorded practice performance by domain and section, including scores, question counts, practice dates and supported study priorities.

Psi is instructed to answer only from the EPPPPrep.ai study content sent with your message, to stay on EPPP study and not to give clinical, medical, legal or personal advice. Replies can still be wrong, so check important facts against the Study Guide and other authoritative sources (Terms of Service, section 5).

What is not sent. We do not send your name, email address, account ID, exam date or IP address to our AI provider. The request comes from our server, not from your browser. Outside Metrics, your wider learning history is not sent. On Metrics, we include the performance summary described above.

Please do not share personal information with Psi. Our AI provider receives whatever you type. Do not include personal, health or financial details, or any information about clients, patients, research participants or other people. A line under the Psi text box reminds you of this: "Don't include personal, health or client information."

What we keep. We do not store your Psi conversations. The conversation stays in your browser while the Psi panel is open and is cleared when you close the panel or leave the page. We keep only:

• a count of the messages you send each day, to apply the daily limit; and
• technical log entries about each request, such as its status, timing and size. These entries do not include your messages or Psi's replies.

What our AI provider does. OpenAI processes Psi requests through its API. We request that responses are not saved for later retrieval. This does not mean zero data retention. OpenAI's published API data controls state:

• API content is not used to train its models unless the customer opts in;
• abuse-monitoring logs may retain content for up to 30 days, or longer for legal or safety reasons; and
• prompt caching may retain encrypted representations for up to 24 hours.

[Confirm: the selected OpenAI project has data sharing disabled, applicable contractual terms, processing locations and any approved retention controls before activation.]

Study suggestions. Progress summaries and study suggestions, including those shown with Psi's name, are calculated by our own software from your recorded results. They support your own study. We do not use them, or Psi, to make decisions about you such as admissions, grades, employment or licensure.

5. How we share information

We share personal information only as described in this section.

Service providers. These companies process personal information on our behalf, under contracts that limit how they may use it:

Cloudflare also uses the security-check information to improve how it detects automated programs, under its own Turnstile privacy terms.

Google. If you use Google sign-in, Google and we exchange sign-in information as described in section 2.3. Google acts under its own terms and privacy policy.

Legal and safety reasons. We may disclose information if we believe in good faith that the law, a subpoena or a court order requires it, or that it is needed to protect the rights, property or safety of our learners, the public or EPPPPrep.ai, or to investigate fraud, security problems or violations of our Terms of Service.

Business transfers. If EPPPPrep.ai is involved in a merger, acquisition, financing, reorganization or sale of all or part of its business, personal information may be transferred as part of that transaction. We will require the recipient to protect it in line with this policy, and we will tell you if control of your information changes. [Confirm: whether to include this clause.]

Institutions. We share your information with an institution only if you have access to EPPPPrep.ai through that institution, only as our agreement with the institution allows, and only after we have told you what the institution will see. Today, no institution receives learner information (section 12).

At your direction. We share information when you ask us to or give us your consent.

No sale, no advertising. We do not sell personal information, share it for cross-context behavioral advertising or allow advertising networks on the service.

6. Cookies and similar technologies

We use only the cookies needed to run the service and one preference cookie. We do not use analytics, advertising or tracking cookies, and we do not let other companies place them on our site.

The time-zone cookie is set for every visitor and holds only the name of a time zone.

Browser storage. The service saves some information in your browser's local storage and session storage:

• work in progress, such as a quiz, diagnostic test or exam, so you can pick up where you left off. Your exam notes, flags and highlights are kept only there;
• a summary of your diagnostic or exam results when you are not signed in, so you can see them; and
• the email address you just entered to sign up, sign in or reset your password, so you can ask us to send the email again. It is kept only until you close the tab.

Depending on the item, it is removed when you close the tab, finish the activity, sign out or delete your account in that browser, or clear your browser data. An unfinished exam that is more than 2 days old is removed the next time you open the Full-Length Exams pages.

Pages visited during Google sign-in. When you use Google sign-in, your browser visits our sign-in provider's pages and Google's pages. Those services may set their own cookies under their own policies.

The security check. On the forms in section 2.5, Cloudflare's check runs in a frame from Cloudflare's own website, under Cloudflare's policies. [Confirm: whether Cloudflare Turnstile stores anything in your browser.]

Your controls. You can block or delete cookies in your browser settings. If you block the session cookie, you will not be able to sign in. If you block the time-zone cookie, dates will show in Coordinated Universal Time (UTC).

Do Not Track and Global Privacy Control. We do not track you across other websites, so there is nothing for a Do Not Track signal to turn off. We treat a Global Privacy Control signal as a request to opt out of the sale and sharing of your personal information. We do neither, so the signal does not change how the service works.

7. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy.

[Confirm: whether to delete accounts that have not been used for [Inactive account retention period], with advance notice by email. Until then, accounts stay until you delete them.]

We may keep information longer when the law requires it, or when we need it to resolve disputes or enforce our agreements. When we no longer need information, we delete it or de-identify it.

8. Your choices and rights

8.1 Choices in your account

On your Account page you can:

• see and change your name, email address and exam date;
• change your password, if you sign in with one;
• download a copy of your data with "Download My Data" (section 8.4); and
• delete your account.

You can see your results on the Progress, diagnostic results and exam results pages.

Recorded answers cannot be edited, because they are a record of your practice. You can remove them by deleting your account.

8.2 Deleting your account

You can delete your account at any time from the Account page. To confirm, you type your account email address. Deletion permanently removes your account, profile, learning records and Psi message counts from our database right away. It also signs you out and clears the EPPPPrep.ai work saved in that browser.

Some copies remain for a limited time after deletion:

• backups, for up to [Backup retention period];
• server, security and sign-in logs, for up to [Log retention period];
• recent Psi messages held by our AI provider (section 4);
• delivery records kept by our email provider;
• EPPPPrep.ai work saved in other browsers or devices you used, until you sign out there or clear your browser data; and
• the time-zone cookie, until it expires after 1 year or you clear your browser data.

8.3 Email

We send account emails only: sign-up confirmations, sign-in links, password resets and email-change confirmations. You need them to use your account, so you cannot opt out of them while your account is open.

We do not send marketing email. If we start, every marketing email will include an unsubscribe link, and unsubscribing will not affect your account emails. [Confirm: whether marketing email will be sent.]

8.4 Your privacy rights

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you, and learn how we use and share it;
• correct inaccurate personal information;
• delete your personal information;
• get a copy of your personal information in a portable, commonly used electronic format;
• opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects (we do none of these);
• limit the use of sensitive personal information (we use your account log-in only to provide the service and keep your account secure, as the law allows); and
• appeal if we decline your request.

We offer access, correction, deletion and a copy of your data to every user, wherever you live.

Download My Data. On your Account page, "Download My Data" saves a copy of your data as a JSON file, a common machine-readable format. It includes your account details (name, email address, exam date, and the time and version of our Terms of Service and this policy that you accepted), every learning activity record we hold for you, and your daily Psi message counts. For anything the file does not include, such as the records our sign-in provider keeps, or if the download does not work for you, email us (section 8.6).

8.5 California residents

If you live in California, the California Consumer Privacy Act gives you the right to know and access, correct and delete your personal information, to get a portable copy, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be treated differently for using these rights (section 8.9). This section gives the other details that law requires.

• The purposes for each category are in sections 3 and 4, and how long we keep each is in section 7.
• We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.
• We use sensitive personal information only to provide the service and keep accounts secure. We do not use it to infer characteristics about you.
• Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

8.6 How to make a request

Email [Privacy contact email] with your request. If you can, send it from the email address on your account.

• Verification. We confirm your identity before we act. Usually we ask you to reply from, or confirm access to, the email address on your account. We may ask for more information if we need it. We use the information you give us for verification only for that purpose.
• Timing. We confirm that we received your request within 10 business days and respond within 45 days. If we need more time, up to another 45 days, we will tell you why. [Confirm: request response times.]
• Cost. Requests are free. Where the law allows, we may decline, or charge a reasonable fee for, requests that are clearly unfounded or excessive.

8.7 Authorized agents

You can ask an authorized agent to make a request for you. We will ask for your signed permission for the agent, and we may ask you to confirm your identity with us directly, unless the agent has a valid power of attorney.

8.8 Appeals

If we decline all or part of your request, we will explain why. You can appeal by emailing [Privacy contact email] with "Privacy appeal" in the subject line. We will respond within 45 days and explain our decision. If you are not satisfied with the result, you can contact the attorney general of your state. [Confirm: appeal process and response time.]

8.9 No discrimination

We will not deny you the service, charge you a different price or give you a different level of service because you exercised your privacy rights.

9. International users

EPPPPrep.ai is based in the United States and is intended for candidates preparing for the EPPP. [Confirm: Service regions.] We and our service providers store and process personal information in the United States. [Confirm: the Supabase production region and Vercel function region are in the United States.] Our AI provider may process Psi requests in other countries. [Confirm: OpenAI processing locations.] Our security-check provider, Cloudflare, may process your IP address and browser information in other countries. [Confirm: Cloudflare processing locations.] Privacy laws in the United States may differ from the laws where you live.

If you live in Canada. Your information is stored and processed in the United States, where courts, law enforcement and national security authorities may be able to access it under US law. You can ask to access or correct your information, or ask about our practices, including our use of service providers outside Canada, by emailing [Privacy contact email]. [Confirm with counsel: requirements under PIPEDA, Quebec's Law 25 and other provincial privacy laws.]

If you live in the European Economic Area, the United Kingdom or Switzerland. Where data protection laws in those places apply to our processing:

• EPPP Prep AI, LLC is the controller of your personal information. Our contact details are in section 14. [Confirm with counsel: whether the service targets the EU or UK, and whether an EU or UK representative is required.]
• We rely on these legal bases:

• You have the right to access, correct, delete and receive a portable copy of your personal information, to restrict or object to our processing of it (including processing based on our legitimate interests), and to withdraw consent where we rely on consent. You also have the right to complain to your local data protection authority.
• Your name, email address and a password (or Google sign-in) are needed to create an account. Everything else you give us is optional.
• Where our service providers receive personal information from the EEA, the UK or Switzerland, our agreements with them include safeguards for international transfers, such as the European Commission's Standard Contractual Clauses. [Confirm with counsel: transfer mechanism wording, and whether each provider's agreement covers UK and Swiss transfers.]

10. Security

We use administrative, technical and physical safeguards suited to the information we hold. They include:

• HTTPS encryption for connections to the service and between our servers and our service providers;
• encryption at rest in our database provider's systems;
• database rules that let each learner read only their own records, with scoring done on our servers rather than in your browser;
• passwords stored by our sign-in provider only as one-way hashes, and email confirmation for new accounts and email changes;
• limits on request size and daily use, to prevent abuse;
• a security check on the sign-up, sign-in, password reset, password change and "Send it again" forms, to stop automated sign-ups and sign-in attempts;
• separate development and production systems, so testing never touches learner data; and
• access to production systems and keys limited to the people who need it. [Confirm: who can access the Supabase, Vercel and OpenAI consoles, and whether those accounts use multi-factor sign-in.]

No method of sending or storing information is completely secure, so we cannot guarantee security. Protect your account with a strong password that you do not use elsewhere, and sign out on shared devices. If you think someone has used your account, tell us right away at [Support email].

If a security incident affects your personal information, we will notify you and the authorities as the law requires.

11. Children

EPPPPrep.ai is for adults 18 and older who are preparing for psychology licensure. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13 or from anyone under 18. If we learn that we have, we will delete it. If you believe a child has given us personal information, email [Privacy contact email].

12. FERPA and institutional partners

The Family Educational Rights and Privacy Act (FERPA) protects education records held by schools that receive federal education funding. It applies to those schools. It also limits how others who receive education records from those schools may use and share them.

Today:

• You sign up for EPPPPrep.ai on your own. Institutions do not give us student records, and they cannot see your account, answers or results.
• Using the Helix U pages does not send your information to any institution.

If we offer access through an institution in the future, for example with an invitation token or your school's sign-in:

• We will work under a written agreement with the institution.
• If the institution shares education records with us, we will act as a "school official" under the institution's direct control. We will use the records only to provide the service to the institution and its students, and we will not disclose them to others except as FERPA and the agreement allow. [Confirm with counsel: these commitments before any institutional data feature is built.]
• Before an institution can see any of your information, we will tell you what it will see and update this policy.
• The institution's own privacy policies and FERPA notice will also apply.

13. Changes to this policy

We may update this policy when the service or the law changes. When we do, we will change the "Last updated" date at the top. If we make a material change, we will tell you before it takes effect, by email or with a notice in the service. If a change would let us use personal information we already hold in a materially different way, we will ask for your consent where the law requires it. We review this policy at least once a year.

14. Contact us

EPPP Prep AI, LLC
8500 Wilshire Blvd., Suite 740
Beverly Hills, CA 90211

Privacy questions and requests: [Privacy contact email]
Account help: [Support email]

If you have a disability and need this policy in another format, email [Privacy contact email].