| Contact and account information | - student name
- parent or guardian name
- email address
- phone number
- login credentials
- account role
| - create and maintain accounts
- start or resume diagnostic sittings
- communicate with families
- provide support
- protect account access
| Kept while the account is active. If a parent does not approve a pending student account, we delete the pending account and contact details within 30 days. After an account closes, we delete or de-identify ordinary account and contact data within 90 days unless a longer period below applies. | - hosting and database providers
- email and communication providers
- authentication and security providers
- support tools
|
| Registration, age, and consent records | - account holder type
- date of birth
- parent or guardian email
- parent approval status and timestamp
- Privacy Policy acceptance
- Terms acceptance
- legal version accepted
- acceptance timestamp
- diagnostic consent and report delivery preferences
| - confirm whether the account is student-created or parent/guardian-created
- route a student account to parent or guardian approval when required
- document privacy and terms acceptance
- document who approved the account and where a report may be sent
- support parent review, deletion, and consent requests
| Date of birth and parent-approval records are kept while the account is active and for 3 years after it closes so we can document account authorization and answer privacy or safety questions. An unapproved pending account is deleted within 30 days. | - hosting and database providers
- authentication and security providers
- authorized UpstartPrep personnel
- professional advisers when needed for legal compliance
|
| Student profile and test-prep context | - grade level
- exam program
- prior score range
- target score range
- testing timeline
- testing accommodations selection
- reported struggle areas
| - recommend an appropriate diagnostic path
- adapt timing and module setup
- prepare parent-facing guidance
- support tutoring and study planning
| Kept while the account is active and for up to 24 months after the student's last activity so the family can return to its plan. We then delete or de-identify the profile unless the family asks us to delete it sooner or another period in this policy applies. | - hosting and database providers
- authorized UpstartPrep personnel
- school or tutoring partners only when applicable to the service requested
|
| Diagnostic, practice, and performance data | - answers
- question views and revisits
- answer changes
- skipped questions
- bookmarked questions
- active question time
- assessment pause and resume events
- section progress
- scores
- percentiles
- accuracy
- pattern analysis results
- readiness states
| - score diagnostic and practice work
- save progress across modules
- generate reports and recommendations
- identify high-yield skill gaps
- improve instructional quality
| Diagnostic responses, final answers, scores, reports, and Pattern Analysis findings are kept while the account is active and for up to 24 months after the student's last activity. Raw assessment interaction events are generally kept for up to 18 months, then deleted or de-identified. We may retain de-identified aggregate item statistics longer for curriculum and assessment quality improvement. | - hosting and database providers
- authorized UpstartPrep instructors and operators
- email providers when reports or private links are sent
|
| Tutoring, class, and recording information | - tutoring session attendance
- student name used during a session
- voice or image if a session is recorded
- chat or shared workspace content
- recording links or access controls
- recording consent or opt-out requests
| - provide live tutoring or class sessions
- make recordings available for review when offered
- limit participation when recording consent is not available
- respond to parent or guardian recording requests
| Kept only as long as needed to provide the tutoring or class service, allow family review, resolve support issues, satisfy legal obligations, or honor deletion and opt-out requests. | - authorized UpstartPrep instructors and operators
- video conferencing or recording providers
- session participants when recordings are shared for review
- hosting and support providers
|
| Progress, navigation, and activity data | - page path
- button or navigation events
- resource viewed
- timestamps
- diagnostic resume state
- private sitting-link access time
| - operate the product
- debug user experience issues
- detect misuse
- understand which workflows need improvement
| Product activity logs are kept for up to 12 months, then deleted or de-identified unless a specific security investigation requires a longer record. | - hosting and database providers
- analytics providers
- security and support tools
|
| Consultation and communication data | - consultation request details
- phone number
- requested exam
- graduation year
- discussion topic
- messages sent to or from UpstartPrep
| - respond to inquiries
- schedule consultations
- recommend services
- maintain support records
| Consultation and ordinary support messages are kept while the request is active and for up to 24 months afterward, then deleted unless the messages become part of a billing, safety, or legal record. | - communication providers
- scheduling providers
- customer support tools
- authorized UpstartPrep personnel
|
| Payment and billing information | - selected plan
- subscription status
- transaction identifier
- coupon or discount
- amount
- tax
- payment-session metadata
| - process purchases
- verify payment status
- provide receipts and support
- maintain financial records
| Transaction and invoice records are kept for 7 years for accounting, tax, disputes, and fraud prevention. Payment card details are processed by the payment provider and are not stored directly by UpstartPrep. | - payment processors
- hosting and database providers
- accounting or professional service providers when needed
|
| Device, browser, and analytics data | - IP address
- browser and device information
- referring page
- pages viewed
- cookie or analytics identifiers
- general usage events
| - measure site performance
- understand traffic and conversion paths
- improve content and navigation
- maintain security
| Website analytics and device records are kept for up to 14 months, subject to shorter browser or provider controls, then deleted or aggregated. | - analytics providers
- hosting providers
- security and anti-abuse providers
|
| Security, support, and compliance records | - server logs
- rate-limit signals
- error details
- support correspondence
- private diagnostic-link tokens or token hashes
- verification records
| - protect the service
- investigate bugs or abuse
- verify requests
- comply with legal obligations
- enforce product terms
| Routine security and verification logs are kept for up to 12 months. Records tied to an active fraud, safety, or legal matter are kept until the matter is resolved and any required record period ends. | - hosting and security providers
- support tools
- professional advisers
- law enforcement or regulators when legally required
|