Privacy Policy

This Privacy Policy ("Policy") describes how PMP IntelliPrep ("we", "us", or "our") collects, uses, discloses, and safeguards your personal information when you use the PMP IntelliPrep application, website at https://pmpintelliprep.com, and all related services (collectively, the "Service").

This Policy applies to all users globally. Where specific regional laws impose additional obligations or rights (e.g., GDPR, CCPA, Australian Privacy Act), those are addressed in dedicated sections below.

For the purposes of the GDPR and other applicable data protection laws, PMP IntelliPrep acts as the data controller — the entity that determines the purposes and means of processing your personal data.

We collect the following categories of personal data:

We collect personal data through the following means:

• Directly from you: When you register an account, complete the onboarding flow, purchase a subscription, or interact with the AI tutor.
• Automatically: Through cookies, local storage, and server logs when you use the Service.
• From third parties: From Stripe for payment-related data; from authentication providers if you use social login.
• From your device: Via browser APIs (e.g., Web Speech API for voice input) when you grant permission.

We use your personal data for the following purposes:

• Service Delivery: To create and manage your account, personalise your learning experience, and provide the features of the Service.
• AI Tutoring: To process your messages and generate personalised educational responses via AI models. Conversation data is sent to our AI provider (OpenAI) for this purpose.
• Payment Processing: To process subscriptions and billing via Stripe.
• Communication: To send transactional emails (account confirmations, billing receipts), service announcements, and — where you have consented — marketing communications.
• Analytics & Improvement: To understand how users engage with the Service and to improve features, content, and user experience. Analytics data is aggregated and/or anonymised where possible.
• Safety & Security: To detect, investigate, and prevent fraud, abuse, and other harmful activities.
• Legal Compliance: To comply with applicable legal obligations, including responding to lawful requests from public authorities.
• Engagement: To send study reminders and progress summaries to support your learning goals, where you have not opted out.

We do not use your data for targeted advertising to third parties. We do not sell your personal data.

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, our legal bases for processing personal data are:

• Contract Performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service you have signed up for, including account management, delivering learning content, and processing payments.
• Legitimate Interests (Art. 6(1)(f) GDPR): Improving the Service, preventing fraud, maintaining security, and sending service-related communications. We have conducted legitimate interest assessments and determined these interests are not overridden by your rights.
• Consent (Art. 6(1)(a) GDPR): For marketing emails and use of non-essential cookies. You may withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c) GDPR): Where we are required to process data to comply with a legal requirement (e.g., tax and financial records).

We do not sell, rent, or trade your personal data. We may share your data in the following limited circumstances:

• Service Providers: With trusted third-party vendors who process data on our behalf and are contractually obligated to protect it (see Section 8).
• Legal Requirements: Where required by law, court order, or governmental authority, including to comply with a subpoena, discovery request, or applicable regulation.
• Protection of Rights: To protect the rights, property, or safety of PMP IntelliPrep, our users, or the public as required or permitted by law.
• Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets, with appropriate confidentiality agreements in place and notification to you.
• With Your Consent: With your explicit consent for any other purpose not listed here.

We use the following categories of third-party providers. Each is bound by data processing agreements (DPAs) or equivalent contractual protections:

OpenAI processes conversation data in accordance with their Privacy Policy. We use the API version of OpenAI, which operates under more restrictive data policies than the consumer product (OpenAI does not use API data to train models by default).

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account data: Retained for the duration of your account and for 30 days after deletion (to allow recovery), then permanently deleted.
• Learning & progress data: Retained for the duration of your account. You may request deletion at any time.
• AI tutor conversations: Retained for up to 90 days for service improvement purposes, then deleted. Session history visible to you in-app may be cleared at any time.
• Payment records: Retained for 7 years to comply with financial and tax regulations.
• Technical logs: Retained for up to 90 days.
• Backup data: Encrypted backups may persist for up to 30 days after deletion.

We implement industry-standard technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Hashed and salted password storage
• Access controls restricting data access to authorised personnel only
• Regular security reviews and dependency audits
• Payment data handled exclusively by PCI-DSS compliant Stripe (we never store card details)

No method of electronic transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities as required by applicable law (within 72 hours under GDPR).

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention requirements.
• Right to Restriction: Request that we limit the processing of your data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format (GDPR / UK GDPR users).
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of prior processing).
• Right Not to be Subject to Automated Decision-Making: Right not to be subject to a decision based solely on automated processing that produces significant effects.

To exercise any of these rights, contact us at privacy@pmpintelliprep.com. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

Right to Lodge a Complaint: If you are in the EEA or UK and believe we have not complied with applicable data protection law, you have the right to lodge a complaint with your local supervisory authority. EU supervisory authorities are listed at edpb.europa.eu. UK users may contact the ICO at ico.org.uk.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights:

• Right to Know: Know what personal information we collect, use, disclose, and sell (we do not sell).
• Right to Delete: Request deletion of your personal information.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioural advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to Limit Use of Sensitive Personal Information: You may direct us to limit our use of sensitive personal information to what is necessary to perform the Service.

To submit a CCPA request, email privacy@pmpintelliprep.com with "CCPA Request" in the subject line. We will respond within 45 days.

Categories of Personal Information Collected (CCPA): Identifiers (name, email), commercial information (subscription records), internet activity (usage data), and inferences (learning progress). We do not collect biometric data, geolocation data, or financial account information beyond what Stripe securely processes.

For users in Australia, we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This includes:

• APP 1: Open and transparent management of personal information (this Policy).
• APP 5: Notification of the collection of personal information (provided at collection).
• APP 6: Use and disclosure of personal information — used only for the primary purpose of collection or with your consent.
• APP 7: Direct marketing — you may opt out of direct marketing at any time.
• APP 11: Security of personal information — measures described in Section 10.
• APP 12: Access to personal information — contact us as described in Section 11.

Australian users may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe your privacy rights have been breached.

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at privacy@pmpintelliprep.com and we will delete such information from our records.

For users between the ages of 13 and 18, we encourage parental involvement. Parents or guardians may contact us to review, delete, or restrict the processing of their minor child's data.

We comply with the Children's Online Privacy Protection Act (COPPA) for US users, the GDPR's special provisions for children, and equivalent laws in other jurisdictions.

Your data may be transferred to and processed in countries outside your jurisdiction, including the United States, where our servers and third-party providers are located. These countries may have data protection laws that differ from those in your country.

For transfers from the EEA, UK, or Switzerland to third countries, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission where applicable
• UK International Data Transfer Agreements (IDTAs) for UK data

By using the Service from outside Australia or the US, you consent to the transfer of your personal information to our servers and service providers located in other jurisdictions.

We use cookies and similar tracking technologies (local storage, session storage) to operate and improve the Service.

• Strictly Necessary Cookies: Required for the Service to function (authentication session, security). Cannot be disabled.
• Functional Cookies: Remember your preferences (e.g., theme, study settings). Can be disabled, but may affect functionality.
• Analytics Cookies/Local Storage: Track usage patterns to improve the Service. Aggregated and anonymised where possible.

We do not use third-party advertising cookies or sell browsing data to advertisers. You can control cookies through your browser settings. For EEA/UK users, non-essential cookies require your consent, which can be withdrawn at any time.

If you downloaded PMP IntelliPrep from a third-party app store, the following additional disclosures apply:

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will: (a) update the "Last Updated" date at the top of this page; (b) notify you by email to your registered address; and/or (c) display a prominent in-app notification.

We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Policy.

For any privacy-related questions, requests to exercise your rights, or concerns about how we handle your personal data, please contact us:

We will acknowledge your request within 5 business days and provide a substantive response within 30 days (or as required by applicable law). If we cannot resolve your concern, you have the right to contact your local data protection supervisory authority.