Privacy Policy

1. Introduction

ExamPilot ("we", "our", "us") operates the website at exampilot.help. We are committed to protecting your privacy and being transparent about how we handle your personal information. This Privacy Policy explains what data we collect, why we collect it, and how you can manage it.

2. Information We Collect

We collect the following types of information:

• Account information — your name, email address, and profile picture when you create an account.
• Study progress — your quiz results, flashcard progress, study streaks, and learning preferences.
• Payment information — billing details processed securely through Stripe. We never store your full card number on our servers.
• Device & usage data — browser type, operating system, IP address, pages visited, and how you interact with the platform.
• Cookies & local storage — session tokens and preferences stored on your device. See our Cookie Policy for details.

3. How We Use Your Information

• Providing and maintaining the ExamPilot service.
• Personalising your learning experience with AI-generated content.
• Processing payments and managing subscriptions.
• Improving our AI models and study materials based on aggregate usage data.
• Sending important service-related communications (e.g. billing receipts, security alerts).
• Analysing usage patterns to improve the platform (analytics).

4. Third-Party Services

We use trusted third-party services to operate ExamPilot. Each has its own privacy policy:

• Clerk — authentication and user management.
• Stripe — payment processing and subscription management.
• Convex — database and backend services.
• Vercel — website hosting and edge delivery.

We do not sell your personal data to any third party.

4.1 Research Participation (Optional)

If you opt in to research participation in Account → Privacy & Research, we may invite you to answer optional banded questions about your exam prep (which exam, months out, study habits) and basic demographics (age range, household income range, the first 3 digits of your ZIP code). Participation is always optional per question — you can pick “Prefer not to say” for any of them.

If you choose to participate, we share only aggregated results — combined with at least 9 other users' answers (k ≥ 10), with no field or combination of fields that could identify you. We never share your name, email, exact age, exact location, study-session content, scan uploads, or payment information with research partners or with ad networks.

We will not sell raw, user-identifiable data to brokers, ad networks, or any other third party. The opt-in toggle controls participation in aggregated research only; it cannot authorize sale of individual-level records.

You can withdraw at any time in Account → Privacy & Research. Withdrawal stops future invitations and removes you from future cohorts; it cannot recall aggregated results already shared.

4.2 Your Privacy Rights (Research Data)

You have the right to:

• Know what information we collect (this Section 2 and 4.1).
• Access a copy of your data (Account → Privacy & Research → Download my research data).
• Correct inaccurate data (Account → Edit Profile and Account → Privacy & Research).
• Delete your data (Account → Privacy & Research → Delete my research data).
• Opt out of research participation (Account → Privacy & Research).
• Limit use of sensitive data (Account → Privacy & Research).
• Non-discrimination — declining research will never restrict your use of any feature of ExamPilot, and we will not offer different pricing or service tiers based on your research-participation choice.

4.3 Campus Ambassador Program (Optional)

If you apply to or participate in the ExamPilot Campus Ambassador Program, we process additional information specifically tied to that commercial relationship. This data is collected only from people who choose to apply and is separate from your regular study account.

We collect the following ambassador-specific categories. Categories are listed using Apple App Privacy and Google Play Data Safety terminology so they line up with the Nutrition Label and Data Safety form for our mobile apps.

• Contact Info — full legal name and the email tied to your ExamPilot account.
• User Content — the free-text answer you write in the “Why you'd be a good ambassador” box on the application.
• Identifiers — your institution name, institution type, role (student / grad student / alum / faculty / staff), graduation year, and the unique 8-character referral code we assign on approval.
• Device ID — a randomly generated device identifier stored in your browser's local storage and sent with your application. We use it only to detect duplicate or coordinated applications from the same device. It is not an advertising ID and is not shared with ad networks.
• Usage Data — clicks on your referral link, signups attributed to your code, and conversion events (subscription started / paid / refunded) that determine your commissions.
• Diagnostics — the IP address, user-agent, and origin header of your application submission, kept in an audit log for rate-limiting and fraud review only.
• Financial Info — the bank ACH details (US) or PayPal address (international) you provide to our operator to receive payouts, and the Form W-9 (US) or Form W-8 series (non-US) you complete before your year-to-date earnings reach $600. This information is collected by our operator over email and stored in our operator's records (a separate tax-document file outside the ExamPilot product database); it is NOT stored in your in-app account or in our Convex database. The database only retains the commission ledger (amounts, dates, state changes) and a flag indicating that the W-9/W-8 has been received, not the form contents themselves. We retain commission and payout records (the in-app fields, not the form contents) for at least 7 years to meet US tax-record retention rules.
• Age confirmation — the timestamp at which you confirmed you are 18 or older (no date of birth is stored).

We use this data only to: review your application, attribute referrals to you, calculate commissions, hold commissions through the 30-day chargeback-safety window, pay you, prevent fraud and cheating, and meet IRS reporting obligations (Form 1099-NEC for US ambassadors who earn $600 or more in a calendar year).

We share ambassador data only with: Stripe (for the underlying subscription event that generated each commission), Clerk (the account identity that the application is tied to), Convex (our database provider), and the IRS or other tax authority when legally required. We never sell ambassador data, share it with ad networks, or use it to train AI models.

You can withdraw from the program at any time by emailing ambassadors@exampilot.help. Termination details (including the 30-day notice period for non-fraud terminations) are described in Section 10 of the Ambassador Agreement. We retain commission and payout records for at least 7 years to meet US tax-record retention requirements; you can request deletion of all non-required fields at any time.

5. Cookies and Local Storage

We use cookies and local storage to keep you signed in, remember your preferences, and understand how you use ExamPilot. Essential cookies are required for the platform to function. For full details, please see our Cookie Policy.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are legally required to keep it (e.g. billing records). Aggregated, anonymised data that cannot identify you may be retained indefinitely for analytics purposes.

7. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data.
• Portability — receive your data in a portable format so you can transfer it elsewhere.
• Objection — object to certain types of processing, such as marketing.

To exercise any of these rights, please contact us at support@exampilot.help.

8. Children's Privacy

ExamPilot is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If we discover that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child under 13 is using ExamPilot, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or by placing a notice on the platform. Your continued use of ExamPilot after changes are posted means you accept the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please reach out:

• Email: support@exampilot.help
• Website: exampilot.help