Privacy Policy

Effective date: August 25, 2026  ·  Replaces all prior versions

Companion document: our Cookie Policy lists every cookie and browser-storage key by name.

This Privacy Policy describes how QuantegyAI ("QuantegyAI," "we," "us," or "our") collects, uses, discloses, and protects information that we receive when you visit, sign up for, or use our test-preparation services (the "Services"). This Policy applies to information collected through our website, the QuantegyAI application, and related communications.

By creating an account or using the Services, you confirm that you have read this Policy and agree to the practices it describes. If you do not agree, please do not use the Services.

1. Who we are and how to contact us

QuantegyAI is operated by Dr. Mienie Roberts at 118 Harvest Loop, Harker Heights, TX 76548. For privacy-related questions, requests, or complaints, contact us at support@quantegyai.com or by phone at 903-705-9703 (Mon–Fri, 9 am–6 pm CT).

2. Categories of information we collect

We collect information in three broad categories: information you give us, information we collect automatically when you use the Services, and information we receive from institutional partners when you participate in a cohort.

2.1 Information you provide

• Account information: your email address, a password (stored only as a salted bcrypt hash; we never see or store your plaintext password), the display name you choose, and an attestation timestamp confirming that you are thirteen years of age or older or are signing up under institutional sponsorship.
• If you are a teacher, the redemption record of your single-use teacher-invite code.
• If you join a cohort, the cohort invite code you redeemed and the resulting cohort membership.
• If you purchase a paid product, billing information you provide to our payment processor (see Section 6).
• If you contact us by email or via support channels, the content of your message and any information you choose to share.
• If you complete the free diagnostic, the name and email address you provide to unlock your results, and your answers to two short questions — when you plan to take the exam, and whether this is a first attempt or a retake.

Diagnostic results gate — Mailchimp and lookalike audiences. On that same screen there is a separate, unticked-by-default checkbox for marketing email. If you tick it, we also send your name and email address to Mailchimp, our email marketing provider, along with which exam you're preparing for, your timeframe, and first-attempt/retake answer, so we can send relevant study tips and reminders. We also attach basic campaign information to that record: which advertisement or link brought you to the site (the campaign tags in the web address you arrived on, including Google and Meta click identifiers), which page you first landed on, whether you were on a mobile or desktop device, and the date you signed up. This tells us which campaigns reach people who actually want to hear from us; it says nothing about you personally and nothing about how you performed. We may use this information, inside Mailchimp's own tools, to build lookalike or similar-audience segments for our future advertising campaigns. We do not upload your email address to Google Customer Match or Meta Custom Audiences — this permission governs Mailchimp only — and it is never combined with your exam responses, scores, mastery estimates, or diagnostic results. Declining the checkbox still unlocks your results. See Section 5 for how to change your mind, and our Cookie Policy §8 for more on Mailchimp.

2.2 Information we collect automatically

• Learning interactions: the items you are administered, your responses, the time you take to respond, the skill and competency tags associated with each item, the calculated probability that you would have answered correctly under our Item Response Theory model, and per-skill mastery estimates produced by our Bayesian adaptive engine. This information is the substantive content of the Services and is necessary for the adaptive coaching to function.
• Session and authentication metadata: a signed session token, session start and end timestamps, the IP address from which you accessed the Services, and the browser user-agent string. We use this information to authenticate you, to enforce session-expiry rules, and to defend against credential-stuffing and other automated abuse. On the web the session token is held in your browser's local storage rather than in a cookie; when you reach us through your school's learning-management system, a short-lived first-party cookie carries the launch session instead. Neither has any third-party tracking purpose. Our Cookie Policy lists both.
• Audit events: timestamped records of sensitive actions including login successes and failures, account lockouts, signups, teacher-invite creation and redemption, cohort creation, viewing of student detail by a teacher, profile export, profile deletion, and purchase events. Audit records carry the actor, the target (if any), the source IP, and a request correlation ID. They support security investigations, institutional access reviews, and the access and erasure obligations described in Section 9.
• Server-side performance and error telemetry: structured JSON logs with per-request correlation identifiers, and (when configured) reports to an error-monitoring vendor.
• Marketing-campaign and advertising data — only if you consent. If you accept advertising and analytics cookies when we ask, our advertising and measurement partners may set cookies or similar identifiers in your browser. These record which advertisement or campaign brought you to the site, which marketing pages you viewed, and whether you went on to start a free diagnostic or buy a pass. We use this to measure which campaigns are worth running and to let the advertising platforms show our ads to people who have visited the site. If you decline, these technologies are not loaded at all. See our Cookie Policy for the full list and Section 5 for how to change your mind.

What we do not do. We never send your exam responses, scores, mastery estimates, diagnostic results, or any other measure of your academic performance to an advertising or analytics partner. Advertising measurement sees ordinary web-browsing events only — which page was viewed, and whether a purchase happened — never what you answered or how well you did. We do not run advertising or marketing-analytics technologies inside the signed-in learning application, with one narrow exception: the moment you start checkout and the moment a purchase completes, so we can measure whether our advertising is actually working. Those two moments report only the fact of a transaction — a plan name, the exam, an amount, and an order reference — never anything about what you studied or how you performed, and only with your advertising consent (Section 5). Nothing else about your use of the signed-in application is measured for advertising or marketing-analytics purposes, and none of this runs on institutional or cohort deployments at all.

2.3 Information from institutional partners

If you join a cohort created by a teacher, the teacher's institution may provide us with information necessary to establish your cohort membership. The categories and uses of that information are governed by the data-processing addendum negotiated with the institution; the categories typically include the cohort roster, optional internal student identifiers, and (where the institution requests it) limited demographic information for institutional reporting.

3. How we use information

We use information collected through the Services for the following purposes:

• To deliver the adaptive learning experience: present items, estimate ability and per-skill mastery, schedule spaced review, generate readiness assessments, and produce student-facing dashboards.
• To deliver teacher-facing tools: cohort rosters, drill-down on individual student progress (within a teacher's own cohorts), the audit-log view scoped to that teacher's reach, content-governance dashboards, and CSV roster exports.
• To authenticate users, enforce rate limits, and defend against credential-stuffing, signup flooding, and other automated abuse.
• To send transactional communications: account verification, password reset, purchase receipts, and security or service-availability notices.
• To improve item quality: aggregate exposure rates, classical test-theory difficulty (p-values), and discrimination (point-biserial correlations) inform item retirement and editorial review.
• To comply with legal obligations and to protect the rights, property, and safety of QuantegyAI, our users, and others.
• With your consent, to measure and improve our advertising: to see which campaigns bring visitors who go on to study with us, and to show our advertisements to people who have previously visited our marketing pages.

We do not sell your information for money, and we never have. We should be precise about one thing, because California and several other states define the words unusually broadly: if you consent to advertising cookies, the resulting disclosure of online identifiers to advertising platforms may count as a “sale” or a “share” for cross-context behavioural advertising under those laws, even though no money changes hands. We treat it that way and give you the opt-out those laws require — see Section 5 and Section 9. If you never accept advertising cookies, no such disclosure happens at all.

We do not use your responses to train models for any party other than QuantegyAI itself, and only in the service of improving the adaptive engine and content.

4. Legal bases (for users in jurisdictions where required)

Where the General Data Protection Regulation, the United Kingdom GDPR, or a similar regime applies, we rely on the following legal bases: performance of a contract with you (delivering the Services you signed up for); our legitimate interests in operating, securing, and improving the Services; and your consent (for any optional processing where consent is the relevant basis).

5. Cookies, advertising, and analytics

Our Cookie Policy is the detailed document: it names every cookie and browser-storage key we use, what each one is for, and how long it lasts. This section is the summary.

We sort everything we store in your browser into two groups:

• Strictly necessary. Your signed-in session, your security and rate-limiting state, your saved learning progress, and your cookie choice itself. The Services cannot work without these, so they are set without asking — which is what data-protection law permits for this category, and only this category.
• Advertising and analytics. Everything described in Section 2.2 above. These are off by default. They are loaded only after you actively accept them, and declining costs you nothing: every part of the product works identically either way.

Changing your mind. You can withdraw or grant consent at any time from the “Cookie settings” link in the footer of any page. Withdrawing consent stops the advertising technologies from loading on your next page view and clears the choice we stored. You can also clear the cookies your browser already holds through your browser's own settings, and browser or extension signals such as Global Privacy Control are honoured as a valid opt-out where the law requires it.

Learners under eighteen. We do not knowingly run behavioural advertising to anyone we know to be under eighteen, and we do not permit advertising platforms to build advertising profiles from their activity, regardless of any consent given. See Section 11.

Institutional and cohort deployments. Advertising and marketing-analytics technologies are not used in the signed-in learning application and are not used at all where students reach us through an institutional cohort. Institutional customers can rely on that in procurement review; it is also reflected in our Data Processing Addendum.

6. Payment information

QuantegyAI currently offers five paid products — the Full Access Pass, the Mock Exam Pass, the Pass Guarantee, Premium Coaching, and the School License ($1,500 per year, 30 seats). Prices and access periods vary by exam; the price and access period shown at checkout apply, and the full product table is in our Terms of Service. A free diagnostic tier is available with no payment required. No recurring subscriptions are offered. All purchases are processed through Stripe, Inc. We do not see, store, or transmit your full payment card number, your card verification value, or any other element of your payment card data. We retain only the Stripe customer and payment-intent identifiers needed to apply your entitlements and process refunds where applicable. For the full refund terms, see our Refund Policy.

7. How we share information

We share information only as described in this Section. We do not sell information for money.

• Service providers ("subprocessors"): we use a small set of vendors to host the Services, send transactional email, process payments, measure site usage, and (optionally) collect error telemetry. The current list of subprocessors is published at /legal/subprocessors.html and is updated when material changes occur. Each subprocessor is bound by a written agreement that requires the protection of information at a level no less stringent than this Policy.
• Advertising and measurement platforms — only with your consent. If you accept advertising cookies, the platforms we advertise on receive online identifiers and the campaign, page-view, and purchase events described in Section 2.2, so that we can measure our campaigns and so that they can show our advertisements to people who have visited the site. They never receive your responses, scores, or any measure of your academic performance. The platforms we use are named in our Cookie Policy and on the subprocessor list. If you decline, nothing is disclosed to them.
• Institutional partners: if you participate in a cohort, your cohort progress is visible to the teachers within that cohort's institution to the extent described in the data-processing addendum signed by that institution. We do not share your information with other institutions.
• Legal and safety: we may disclose information when required by law, when responding to validly served legal process, or when we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of QuantegyAI, our users, or others.
• Business transactions: if QuantegyAI is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. The receiving party will be bound by a privacy notice no less protective than this one.

8. How long we keep information

We retain account information and learning records for as long as your account is active. If you delete your account (see Section 9), the email, display name, and password hash on your account row are scrubbed and the row is marked deleted; your responses, mastery estimates, and audit records are retained in de-identified form to support content-governance statistics and to satisfy institutional record-retention obligations consistent with the Family Educational Rights and Privacy Act and Texas state record-retention requirements.

9. Your rights

Every authenticated user has the following rights, exercisable directly within the Services:

• Access. You can download a JSON file containing your complete record, including your profile, purchase history, sessions, responses, per-skill mastery estimates, and the audit events you are the actor of, by visiting your profile settings and clicking "Download my data." This export is rate-limited to one per hour per user, is scoped strictly to your account, and is itself audited.
• Correction. You can update your display name at any time in your profile settings. To correct your email address, contact us at support@quantegyai.com.
• Erasure. You can delete your account from your profile settings. Deletion irreversibly scrubs your identifying information. De-identified learning records may be retained as described in Section 8.
• Objection and restriction. If you are in a jurisdiction that provides these rights, you may contact us to object to or restrict our processing of your information. We will respond within the timeframe required by applicable law.
• Portability. The data-download feature described above provides your information in a machine-readable JSON format.
• Opting out of targeted advertising. You can withdraw consent for advertising and analytics cookies at any time from the "Cookie settings" link in the footer of any page. For residents of California, Colorado, Connecticut, Texas, Virginia and other states with equivalent laws, that control is also our "Do Not Sell or Share My Personal Information" and "Opt out of targeted advertising" mechanism, and we honour Global Privacy Control browser signals as a valid opt-out. You do not need an account to use it, and we will not treat you differently for using it.
• Complaints. If you believe we have not handled your information in accordance with this Policy or applicable law, you may contact us at support@quantegyai.com. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data-protection authority.

10. Security

We maintain technical and organisational measures designed to protect your information against unauthorised access, disclosure, alteration, and destruction. These measures include TLS encryption in transit, encryption at rest for the database, bcrypt hashing for passwords, row-level security policies, rate limiting on authentication endpoints, and structured audit logging. No system is completely secure; if you believe you have found a security vulnerability, please disclose it responsibly to support@quantegyai.com.

11. Children

The Services are not directed to, and we do not knowingly collect personal information from, anyone under the age of thirteen. If we learn that we have collected personal information from a person under thirteen outside of an institutional sponsorship context, we will take reasonable steps to delete that information promptly. Contact us at support@quantegyai.com if you have concerns.

Users between thirteen and eighteen years of age may use the Services only with the knowledge and consent of a parent or legal guardian. A parent or guardian may review, request correction of, or request deletion of their child's personal information by contacting us at support@quantegyai.com. We collect the same limited account and progress information described in section 2 regardless of a user's age. We do not sell personal information for money, and we do not use the personal information of anyone we know to be under eighteen for targeted advertising or disclose it to an advertising platform — whether or not consent to advertising cookies was given on that device.

For institutional deployments involving Education Records, see our FERPA Posture and Data-Handling Memorandum.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the effective date at the top of this page. If you continue to use the Services after the updated Policy is posted, you accept the revised Policy. If a change materially affects your rights, we will make reasonable efforts to notify you by email or by a notice within the Services before the change takes effect.

13. Contact

For any privacy-related questions or requests, contact us at support@quantegyai.com or by phone at 903-705-9703 (Mon–Fri, 9 am–6 pm CT).