Privacy Policy

VoraPrep LLC (“VoraPrep,” “we,” “us,” or “our”) operates the VoraPrep exam preparation platform at voraprep.com (the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Display name
• Profile photo (optional, if you sign in via Google)
• Authentication credentials (managed by Firebase Authentication; we do not store passwords directly)
• Selected exam course(s) and target exam date(s)

1.2 Study Data

To provide personalized learning, we collect:

• Practice question responses, scores, and time spent per question
• Lesson and flashcard completion progress
• Exam simulation results and section-level performance
• Daily study activity logs and streaks
• Bookmarks, notes, and study plan preferences
• AI tutor conversation history
• Performance analytics by topic, blueprint area, and difficulty level

1.3 Payment Information

When you subscribe, payment is processed by Stripe, Inc. We receive and store your Stripe customer ID, subscription status, and plan type. We do not receive or store your full credit card number, CVV, or bank account details — these are held solely by Stripe in accordance with PCI DSS standards.

1.4 SMS / Text Messaging Data

If you enroll in VoraPrep Daily CPA (our SMS-based practice product), we additionally collect:

• Mobile phone number (US numbers only)
• SMS opt-in consent and timestamp
• Inbound and outbound message logs (retained for 90 days)
• Preferred daily send time and timezone

Message frequency: 1–3 messages per day. Message and data rates may apply. Reply STOP at any time to unsubscribe. Reply HELP for help. Your phone number is never shared with third parties for marketing purposes.

1.5 Technical Data

We automatically collect:

• Device type, operating system, and browser information
• IP address and approximate geographic location (city/region level)
• Pages visited, features used, and session duration
• Referring URL and how you arrived at the Service
• Error logs and performance data

1.6 Information from Third-Party Sign-In

If you sign in using Google, we receive your name, email address, and profile photo from Google. We do not receive your Google password or access your Google Drive, Gmail, or other Google services.

2. How We Use Your Information

We use your data to:

• Provide the Service: Deliver lessons, questions, simulations, flashcards, and audio content
• Personalize your experience: Power the adaptive learning engine, score predictor, and AI tutor recommendations based on your performance
• Track progress: Show your study analytics, streaks, blueprint mastery, and readiness estimates
• Process payments: Manage subscriptions, trials, and billing through Stripe
• Communicate with you: Send study reminders, exam date notifications, product updates, and transactional emails (you can opt out of non-essential emails)
• Improve the Service: Analyze aggregate usage patterns to improve content quality, fix bugs, and develop new features
• Ensure security: Detect fraud, prevent abuse, and enforce our Terms of Service
• Comply with law: Respond to legal obligations, subpoenas, or government requests

3. Data Sharing

We do not sell your personal information. We do not rent, trade, or otherwise monetize your data. We may share data with the following categories of third parties solely to operate the Service:

3.1 Service Providers

3.2 Partner / Institutional Access

If your employer or educational institution provides you access through a partner agreement, limited account and progress data (e.g., completion status, aggregate scores) may be shared with your organization's administrator as specified in that agreement.

3.3 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

3.4 Business Transfers

If VoraPrep is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.

3.5 SMS Data

No mobile information (phone numbers or message content) is shared with third parties or affiliates for marketing or promotional purposes. SMS data is used solely to deliver the Daily CPA practice question service you opted into.

4. AI and Your Data

The Service includes an AI-powered tutor (currently powered by Google Gemini). When you use the AI tutor:

• Your questions and the study context (current topic, section) are sent to the AI model to generate a response
• We do not send your name, email, or other personally identifiable information to the AI model
• AI conversations may be stored on our servers to improve the Service and for your review history
• AI responses are not reviewed by humans unless you report an issue
• Google's use of data sent to Gemini is governed by Google's Privacy Policy

5. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential cookies: Required for authentication, session management, and security. Cannot be disabled.
• Functional cookies: Remember your preferences (dark mode, selected course, study settings).
• Analytics cookies: Firebase Analytics / Google Analytics collect anonymized usage data to help us understand how the Service is used. You can opt out of analytics in your account settings or by using browser-level controls.

We do not use advertising cookies or third-party ad trackers. We do not participate in cross-site behavioral advertising.

6. Data Security

We implement industry-standard technical and organizational security measures, including:

• Encrypted data transmission (HTTPS/TLS) for all connections
• Encrypted data at rest (Google Cloud / Firebase infrastructure)
• Firebase Security Rules enforcing per-user data isolation (users can only access their own data)
• Secure authentication via Firebase Auth (supports email/password, Google sign-in, and multi-factor authentication)
• Environment-separated infrastructure (development, staging, production)
• Regular automated backups of user data
• API keys restricted by domain and service

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your data, we cannot guarantee absolute security. If we become aware of a security breach that affects your personal data, we will notify you and any applicable regulatory authorities as required by law.

7. Your Rights

Regardless of where you live, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information in your account settings or by contacting us
• Deletion: Request deletion of your account and associated personal data
• Data portability: Request an export of your study progress data in a machine-readable format
• Opt-out of communications: Disable push notifications and email reminders in account settings. For SMS, reply STOP to immediately unsubscribe.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at privacy@voraprep.com. We will respond within 30 days (or sooner if required by applicable law). We will not discriminate against you for exercising your privacy rights.

8. Data Retention

• Active accounts: We retain your data for as long as your account is active and for a reasonable period afterward to fulfill legal obligations and resolve disputes.
• Account deletion: Upon request, we delete your personal data within 30 days. Anonymized, aggregated analytics data (which cannot be used to identify you) may be retained indefinitely.
• SMS logs: Inbound and outbound message logs are retained for 90 days, then automatically deleted.
• AI conversations: Stored for the life of your account. Deleted upon account deletion.
• Backups: Personal data may persist in encrypted backups for up to 90 days after deletion.

9. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@voraprep.com.

10. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer. We process data in accordance with applicable US privacy laws.

11. State-Specific Privacy Rights

12. Changes to Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice via email to the address associated with your account or through a prominent in-app notification at least 30 days before the changes take effect. The “Last updated” date at the top of this page indicates when this policy was last revised. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, data requests, or to exercise your rights:

• Email: privacy@voraprep.com
• General support: support@voraprep.com