Privacy Policy

The data controller for personal information processed through the Service is NextEdge Prep, located at [BUSINESS ADDRESS — UPDATE BEFORE LAUNCH]. You can reach our privacy team at nextedge.prep@gmail.com.

We collect the following categories of information:

• Account information. Your name, email address, a hashed password, and a parent or guardian’s email address, which is required to create an account.
• Eligibility information. Your date of birth, used to confirm you are at least 13 years old, and a timestamp recording when that confirmation occurred.
• Educational background. Your city, state, high school, grade level, and target score, collected during sign-up.
• Learning data. Your practice question attempts, answers, scores, the topics and difficulties you study, and your progress toward the goals set by your tutor.
• Tutor interactions. Messages you exchange with the AI tutor, including the question context for each conversation. These are stored so your human tutor can review your progress.
• Audio recordings. If you use voice input, short audio clips you record are sent to our transcription provider, converted to text, and then deleted.
• Technical data. IP address, browser type, device type, pages viewed, and timestamps. This is collected automatically by our hosting and authentication providers.

We do not knowingly collect government identifiers, payment card numbers, precise location, biometric data, or health information. Payments, if any, are arranged off-platform.

We use your information to:

• create and operate your account and keep you signed in;
• deliver the tutoring service, including AI explanations of practice questions;
• track your progress and let your assigned tutor review and respond to it;
• send progress reports to a parent email you choose to provide;
• improve and secure the Service, including preventing abuse and debugging errors;
• comply with legal obligations.

Our legal bases under the GDPR are: performance of our contract with you (operating the Service), your consent (e.g. providing a parent email or using voice input), and our legitimate interests (security, debugging, fraud prevention).

We do not sell your personal information, and we do not use it for behavioral advertising or cross-context targeted ads.

We share personal information only with service providers that help us run the Service. Each provider acts on our instructions, is bound by a contract, and is listed below.

• Supabase Inc. — database and authentication hosting. Stores your account, learning data, and chat history.
• Anthropic, PBC. — AI model provider. Receives your chat messages and the current question context to generate tutoring responses.
• Google Cloud (Speech-to-Text). — transcription provider. Receives audio clips you record for voice input.
• Cloudflare, Inc. (R2). — object storage. Holds the practice diagrams generated for your review questions. These are stored under randomly generated file names that do not contain your name, email address, or account identifier.
• Vercel Inc. — web hosting. Processes the technical data above to serve the Service.
• Resend, Inc. — transactional email delivery for invite and reset emails.
• Google Fonts and Fontshare. — font CDNs that receive your IP address when loading the site’s typography.

We may also disclose information when required by law, to enforce our Terms, or to protect the rights, safety, or property of NextEdge, our users, or others. If we are ever involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction, and we will notify you before it becomes subject to a different privacy policy.

We use a small number of cookies and similar technologies. We do not use advertising trackers, analytics pixels, or social-network plugins.

• Essential cookies. Set by Supabase to keep you signed in. Without these the Service cannot function, so they are exempt from consent under EU law.
• Functional resources. When you load the site, your browser fetches typography from Google Fonts and Fontshare. This transmits your IP address to those providers but does not set tracking cookies in our control.

You can block cookies in your browser settings, but parts of the Service will stop working if you block the essential ones.

The Service is intended for students 13 years old and older. We do not knowingly collect personal information from children under 13. At signup we ask for your date of birth and a confirmation that you are 13 or older; accounts that fail this check are not created.

If you are a parent or guardian and you believe your child under 13 has provided personal information to us, please email nextedge.prep@gmail.com and we will delete the account and any associated information promptly.

For students between 13 and 17, we encourage you to share this policy with a parent or guardian. Creating an account requires a parent or guardian email address, which we use to send progress reports. Accounts created before this requirement may not have one on file.

The providers listed in Section 4 may process your information in the United States and other countries. Where required, transfers from the EEA, the United Kingdom, or Switzerland are covered by the European Commission’s Standard Contractual Clauses or equivalent safeguards put in place by those providers.

We keep personal information only as long as we need it:

• Account. until your tutor removes your account or its access period ends, whichever comes first; deletion then happens automatically.
• Practice attempts and progress data. for the lifetime of your account, then deleted with it — except for the summary record described below, which we keep indefinitely.
• Tutor chat transcripts. for the lifetime of your account, then deleted with it.
• Audio recordings. never stored on our servers; each clip is sent to our transcription provider, converted to text, and discarded. The resulting transcript follows the chat retention period.
• Practice diagrams generated for you. deleted together with your account.
• Invite tokens. deleted when the invited student’s account is deleted. Invitations that are never accepted are currently kept indefinitely.
• Technical and sign-in data. sign-in records, including IP address and browser type, are kept while your account is open and are deleted together with it.

Record kept after an account is deleted. When an account is closed, we remove the account itself along with its practice attempts, chat transcripts, and generated diagrams. We do, however, keep one summary record kept indefinitely: your name, email address, the tutor you were assigned to, your account creation and end dates, the reason the account was closed, and a summary of your progress (practice-test score history, target score, and session counts). We use it to keep an accurate history of the students a tutor has worked with. It is not deleted on a schedule.

Backups containing your data are overwritten on a rolling 30-day cycle. We may retain limited information longer if a law requires it or to resolve a dispute.

If you want the summary record described above removed as well, contact us at nextedge.prep@gmail.com and we will delete it manually.

Depending on where you live, you have some or all of the following rights regarding your personal information:

• access a copy of the personal data we hold about you;
• correct information that is inaccurate or incomplete;
• delete your account and associated data;
• port your data to another service in a structured, machine-readable format;
• restrict or object to certain uses of your information;
• withdraw consent at any time (this does not affect prior processing).

To exercise any of these, email nextedge.prep@gmail.com from the email address on your account, or have a parent or guardian email on your behalf. We will respond within 30 days. We may need to verify your identity before acting on the request.

If you are in the EEA, the UK, or Switzerland and believe we have not handled your data lawfully, you can lodge a complaint with your local data protection authority.

Under the California Consumer Privacy Act, you have the rights described in Section 9 plus the right to know what categories of personal information we have collected, the sources, and the purposes for collection. Those details are in Sections 2 through 4.

We do not sell or share personal information as those terms are defined under the CCPA, and we do not use personal information for cross-context behavioral advertising. We do not knowingly collect or sell the personal information of consumers under 16.

California residents may submit access or deletion requests to nextedge.prep@gmail.com. You may use an authorized agent to make a request on your behalf, in which case we will require written authorization. We will not discriminate against you for exercising your rights.

We use industry-standard safeguards including TLS encryption in transit, encryption at rest for the database, row-level security policies, hashed passwords, and access controls limiting who on our team can view student data. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur, but we will notify affected users without undue delay if a personal data breach occurs that is likely to result in a risk to their rights.

We may update this policy from time to time. When we make material changes, we will update the effective date at the top and, where appropriate, notify you by email or through the Service before the changes take effect. Continued use of the Service after the changes take effect means you accept the updated policy.

Questions, requests, or complaints about this policy or your information can be sent to nextedge.prep@gmail.com or by mail to NextEdge Prep, [BUSINESS ADDRESS — UPDATE BEFORE LAUNCH].