This Privacy Policy explains how ScorelyPrep LLC ("we", "us", "our") collects, uses, shares and protects personal information when you use Scorely, our websites, web and mobile applications, AI tutor and the embeddable website chat widget (the "Service"). It applies to students, parents and guardians, and visitors. Our Terms of Service also apply.
Scorely is built for students preparing for the SAT and their families. We do not sell personal information, we do not use it for targeted advertising, and we do not use any advertising trackers or third-party analytics. We measure how the Service is used with our own cookieless tools, described in Section 2.2.
1. Who is responsible for your information
ScorelyPrep LLC is responsible for (the "controller" of) the personal information described here. You can contact us at support@scorelyprep.com or 8735 Dunwoody Place, Ste N, Atlanta, GA 30350, USA.
2. Information we collect
2.1 Information you or your parent give us
| Category | Examples | Who provides it |
|---|---|---|
| Account details | Name, email address, password (stored only as a one-way Argon2id hash), account type (student or parent) | You, or a parent creating a student login |
| Age and consent records | Your age statement at sign-up (for example "13–17 with a parent's agreement"), the version of the Terms you accepted, when, and from which IP address and browser | You |
| Study profile | Grade, target scores, test date, weekly study hours and days, self-reported starting scores, your strongest and weakest areas (in your own words) | You |
| Learning activity | Answers to practice and test questions, correctness, time per question, mock tests and reports, skill estimates, study plans and completed tasks, error-log notes, root causes and prevention rules, practice sets | Created as you use the Service |
| AI tutor content | Messages you send to the AI tutor, its replies, actions it took for you, saved prompts | You (and the AI) |
| Family links | Which parent account is linked to which student account | Parent and student |
| Support and requests | Anything you send when you contact us | You |
2.2 Information collected automatically
| Category | Examples | Why |
|---|---|---|
| Sign-in and security data | Session records (a hashed session token, IP address, browser type, last activity), failed sign-in counts, security and audit logs of sensitive actions | To keep you signed in, protect accounts and investigate misuse |
| Rate-limit records | Your IP address or email address combined with a counter | To stop abuse (deleted after about 2 days) |
| AI usage counts | Number of AI "tokens" used, the model used, and when | To apply your plan's AI allowance |
| Website widget | Messages typed into the public chat widget and a one-way hash of your IP address and browser (not linked to an account) | To answer questions and prevent abuse |
| Page visits (our own, cookieless measurement) | The page you opened (with record IDs removed), the website that referred you and any campaign tag in the link, your device type (mobile, tablet or desktop), the time, your account if you're signed in, and a one-way hash of your IP address and browser combined with a secret that changes every day. We do not store your IP address or set a cookie, and the daily hash means we can't recognise you from one day to the next. We honor "Do Not Track" and Global Privacy Control signals by not recording visits from browsers that send them. | To understand which pages and features are used, where visitors come from, and how to improve the Service |
| Error reports | Technical details of errors in the app or your browser (the page, the error message, and your account if signed in), with contact details and secrets removed | To find and fix problems |
| Problem reports you send | What you write in "Report a problem" or "Report this question", the page you sent it from and your browser type | To investigate and fix what you reported |
We do not collect precise location, contacts, photos, audio, video, biometric information or government ID numbers, and we do not use advertising, social-media or third-party analytics trackers.
2.3 Information from others
- Payments. Our payment processor, Stripe, collects your card details directly. We receive only a customer identifier and subscription status (plan, renewal date, trial status). We never see or store full card numbers.
- Parents. A parent may create a student login, providing the student's name and email address.
3. How we use information
We use personal information to:
- Provide the Service: create and manage accounts; select practice questions at the right level; score practice and mock tests; estimate skill levels and projected scores; build and update study plans; power the AI tutor; and let linked parents follow their student's progress.
- Keep it safe and working: authenticate users, prevent fraud and abuse, enforce our Terms and usage limits, secure our systems, and fix problems.
- Communicate with you: send password-reset and account emails (including reminders that your free trial is ending), receipts and important notices, and respond to requests.
- Process payments and manage subscriptions.
- Improve the Service: for example, review question quality and fix incorrect content, measure which features help students and families, and understand how people find and use the Service, using aggregated or de-identified data where possible.
- Comply with law and protect our rights and the rights of others.
We do not use student personal information for targeted advertising, do not sell or rent it, and do not build profiles of students except to provide the Service's educational features (such as skill estimates and study plans) at the student's or parent's request.
4. Artificial intelligence (AI)
4.1 What we send to AI providers. AI features (the tutor, explanations, mistake analysis, practice sets, plan suggestions and test-report narratives) are generated by third-party AI providers. To answer a request, we send the provider your message, recent conversation history, and pseudonymous learning-performance data relevant to it: skill accuracy and estimates, projected and practice-test scores, mistake patterns, prevention rules you wrote, and your study plan's tasks.
4.2 What we never send. We do not send your name (it is replaced with a label such as "the student" or "Student A"), email address or other contact details, account or user IDs, IP address, payment information, or your study profile and preferences — your grade, target scores, test date, study schedule, self-reported scores or self-descriptions. Email addresses, phone numbers, postal addresses, card and ID numbers, and passwords are also automatically removed from anything you type and from your notes before they are sent. Automatic removal can't catch everything, so please don't type sensitive personal information (yours or anyone else's) into the AI tutor; if you choose to tell the tutor something like your target score, that message is sent.
4.3 AI providers' use of data. AI providers process this data to generate responses, under their own terms and policies. Where a provider offers settings that stop data from being used to train its models or retained beyond what's necessary, we use them; however, some providers (particularly free or low-cost model endpoints) may log or retain requests, and we cannot guarantee every provider's practices. We do not use your personal information to train our own AI models.
4.4 De-identified analysis to improve the Service. About once a week we send aggregated usage statistics and a small, de-identified sample of recent AI tutor conversations to our AI provider to summarise common questions, problems and feature requests for our team. Before anything is sent, names are replaced with "the student", contact details, ID and card numbers and secrets are removed, and no account IDs or email addresses are included. The result is used only by our staff to improve the Service.
4.5 No automated decisions with significant effects. We do not use AI or automated processing to make decisions about you that have legal or similarly significant effects. Skill estimates and plans are study suggestions you choose whether to follow.
4.6 Human review. AI conversations are stored so you can return to them. Authorized staff may review conversations for safety, quality, abuse prevention and support. You can delete your conversations in the AI tutor at any time.
6. Children and students
6.1 Children under 13. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Student sign-up asks for a date of birth without saying what the cut-off is, uses it only to work out the student's age (we don't store the date itself), and refuses anyone under 13. To stop the date being changed and resubmitted, we then set a cookie that blocks student sign-up from that browser for 7 days; we keep nothing else about the attempt, not even the name, email or IP address entered. Parents can still create a parent account. If we learn we have collected personal information from a child under 13, we will delete it. If you believe this has happened, contact support@scorelyprep.com.
6.2 Students aged 13 to 17. Students aged 13 to 17 may use the Service with the involvement and consent of a parent or legal guardian. A parent or guardian may contact us to review, correct or delete their child's personal information, or to stop further collection.
6.3 Student data commitments. We use student information only to provide and improve the Service's educational features and to keep it secure. We do not sell it, use it for targeted advertising, or create profiles for non-educational purposes, and we delete it on request as described in Section 9.
6.4 Schools and FERPA. We offer the Service directly to students and families. We do not currently contract with schools or districts and do not receive education records from them. If we offer school accounts in the future, they will be covered by a separate agreement that addresses the Family Educational Rights and Privacy Act (FERPA) and applicable state student-privacy laws.
8. How long we keep information
We keep personal information only as long as needed for the purposes in this Policy:
| Data | How long |
|---|---|
| Account, study profile and learning activity | While your account is active; deleted within 30 days after you ask us to delete your account, except as noted below |
| AI conversations | Until you delete them or your account is deleted |
| Sign-in sessions | Up to 30 days after last activity |
| Password-reset links | 30 minutes (deleted after expiry) |
| Rate-limit records | About 2 days |
| Page-visit records | 13 months |
| Error reports | 90 days |
| Problem reports you send | Until resolved and no longer needed, and deleted with your account |
| Terms acceptances, payment and subscription records, security and audit logs | As long as needed for legal, tax, accounting, dispute and security purposes, then deleted or de-identified |
| Backups | Overwritten on a rolling basis after deletion from live systems |
9. Your rights and choices
9.1 Everyone. You (or, for a minor, a parent or guardian) can ask us to access, correct, download (export) or delete your personal information, or to stop using it for a particular purpose. You can update your study profile in Settings, delete AI conversations in the tutor, and cancel your subscription online. To make any other request, email support@scorelyprep.com from the email address on your account. We will verify your identity before acting, respond within the time the law requires (generally 30 to 45 days), and won't treat you differently for exercising your rights. You may use an authorized agent where the law allows; we may ask for proof of authorization.
9.2 Appeals. If we decline your request, you can appeal by replying to our decision. If you remain unhappy, you may contact your state attorney general or, in the EU/UK, your data protection authority.
9.3 Marketing. We do not currently send marketing emails. If we do in the future, we will ask for consent where required and include an unsubscribe link.
10. U.S. state privacy rights (including California)
Residents of California and other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have the rights in Section 9, where those laws apply.
California notice at collection. In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described above: identifiers (name, email, account and session identifiers, IP address); customer records (account and subscription details); characteristics such as age range; commercial information (subscription and purchase history); internet or other electronic activity (sign-in, security and usage data within the Service); education-related information (learning activity, scores and estimates, study plans); and inferences (skill estimates and projected scores). The only "sensitive personal information" we process is account login credentials, which we use only to sign you in. We do not sell or share personal information, and we do not knowingly sell or share the personal information of consumers under 16.
11. EU and UK users
11.1 Legal bases. We process personal information to perform our contract with you (providing the Service); for our legitimate interests (keeping the Service secure, preventing abuse, and improving our content, balanced against your rights); to comply with legal obligations; and with your consent where required (which you can withdraw at any time).
11.2 International transfers. We and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK equivalents.
11.3 Your rights. In addition to the rights in Section 9, you can object to processing based on legitimate interests and restrict processing in certain cases, and you can complain to your local data protection authority.
12. Security
We protect personal information with measures including encryption in transit (TLS), Argon2id password hashing, hashed and revocable session tokens, role-based access controls, rate limiting, audit logging of sensitive actions, and removing names and contact details from data sent to AI providers. No system is completely secure, so we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you and regulators as required by law.
13. Changes to this Policy
We may update this Policy. If we make material changes, we will update the date above and notify you by email or in the Service before the changes take effect. We will not use previously collected personal information in a materially different way without your consent where the law requires it.
14. Contact us
- ScorelyPrep LLC
- 8735 Dunwoody Place, Ste N, Atlanta, GA 30350, USA
- Privacy requests and questions: support@scorelyprep.com