GraphPrep Privacy Policy

Last Updated: May 21, 2026

This Privacy Policy describes how GraphPrep, operated by Kestela LLC ("GraphPrep," "we," "us," or "our"), collects, uses, and shares personal information in connection with our website at graphprep.com and the related products and services we make available (collectively, the "Service"). GraphPrep is an AI-powered study tool that helps students work through SAT and ACT math problems with step-by-step walkthroughs, including interactive graphing calculator walkthroughs when appropriate.

This Privacy Policy applies to individuals who use the Service directly. GraphPrep may in the future offer the Service to schools, tutors, and educational programs ("Institutions"). If you access the Service through an Institution, separate agreements between GraphPrep and that Institution may govern the processing of your personal information. This Privacy Policy continues to apply to the extent personal information is processed by GraphPrep outside the scope of any such Institutional agreement.

European users: Please see the "Notice to European Users" section below for additional information for individuals located in the European Economic Area or United Kingdom.

1. Personal Information We Collect

1.1 Information You Provide

When you create an account and use the Service, the personal information you provide may include:

• Account information: your name, email address, and password. Passwords are stored only as cryptographically hashed values and are never accessible to GraphPrep employees or systems in their original form.
• Math problem content: the text and images of the SAT, ACT, or other math problems you submit through the Service for analysis. We process this content to generate walkthroughs and explanations.
• Answer data: the answers you select or enter when working through problems, and whether those answers were correct.
• Communications data: the contents of messages you send to us through email or support channels.
• Payment information: if you purchase a paid subscription, payment information is collected and processed directly by our payment processor, Stripe. GraphPrep does not receive or store your full payment card number or banking details. We receive a limited record of the transaction (e.g., a Stripe customer identifier and subscription status) that we use to manage your subscription.

1.2 Information We Generate About Your Use of the Service

• AI-generated content: when you submit a math problem, our AI service provider (currently Google's Gemini API) generates a walkthrough, classification, step-by-step solution, and related explanatory content. We store this generated content together with the problem you submitted so that you can revisit your question history.
• Usage data: we track basic usage information, including the number of questions you have submitted in a given day, to enforce limits on free-tier accounts and to operate the Service.
• Device and technical data: when you use the Service, our hosting provider and we may automatically log technical information such as your IP address, browser type and version, operating system, device type, language settings, the pages or screens you view, the time and duration of your visit, and links you click. This information is used to operate, secure, and improve the Service.

1.3 Information Stored Locally on Your Device

The Service stores limited information in your browser's local storage to support session continuity, including your basic account profile (name, email, plan tier) and daily usage counters. This information is stored only on your device and is cleared when you log out or clear your browser data.

1.4 Information We Do Not Collect

GraphPrep does not knowingly collect:

• Government identification numbers (e.g., Social Security numbers, passport numbers, driver's license numbers);
• Financial account numbers (other than payment information processed by Stripe);
• Health or medical information;
• Information about your race, ethnicity, religion, or other sensitive categories.

Please do not submit any of the above categories of information through the Service.

2. How We Use Your Personal Information

We use your personal information for the following purposes:

2.1 To Provide and Operate the Service

• Create and maintain your user account;
• Process math problems you submit and generate AI-powered walkthroughs in response;
• Store your question history so that you can revisit past problems without re-processing them;
• Enforce free-tier usage limits and manage paid subscriptions;
• Communicate with you about the Service, including service-related announcements, security alerts, and responses to your support requests.

2.2 To Improve and Develop the Service

• Analyze aggregate, de-identified usage patterns to understand how users interact with the Service and to identify areas for improvement;
• Develop new features and capabilities;
• Diagnose technical problems, monitor performance, and improve system reliability.

We may apply technical optimizations, including caching of generated content, to improve performance and reduce processing costs. Such optimizations do not involve the sharing of personal information between users.

2.3 For Compliance, Security, and Legal Protection

• Comply with applicable laws, lawful requests, and legal process, such as responding to subpoenas or requests from government authorities;
• Protect the rights, privacy, safety, or property of GraphPrep, our users, or others;
• Audit our internal processes for compliance with legal and contractual requirements;
• Enforce our Terms of Use and other applicable agreements;
• Detect, investigate, and prevent fraud, abuse, security incidents, and other harmful or unlawful activity.

2.4 We Do Not Use Your Information for Advertising

GraphPrep does not sell your personal information. We do not use your personal information to deliver targeted advertising, and we do not share your personal information with advertising networks or data brokers. We do not allow our AI service providers to use the content you submit to train or improve their AI models.

3. How We Share Your Personal Information

We share your personal information only as described in this Privacy Policy:

• Service providers and sub-processors. We share personal information with third-party service providers who help us operate the Service. These include our database and authentication provider (Supabase), our hosting and serverless function provider (Vercel), our AI service provider (Google's Gemini API), our payment processor (Stripe), and our transactional email provider (Resend). See Section 4 for additional details about our sub-processors.
• Professional advisors. We may share personal information with lawyers, accountants, and other professional advisors where necessary in the course of the professional services they render to us.
• Authorities and legal compliance. We may share personal information with law enforcement, government authorities, or other parties when we believe in good faith that disclosure is necessary to comply with applicable law, legal process, or to protect the rights, property, or safety of GraphPrep, our users, or others.
• Business transfers. If GraphPrep is involved in a merger, acquisition, sale of assets, financing, or similar transaction, personal information may be transferred as part of that transaction. We will notify users of any such transfer and any resulting changes to this Privacy Policy.
• With your consent. We may share personal information for any other purpose with your consent.

4. Sub-Processors and AI Service Providers

GraphPrep relies on the following sub-processors to operate the Service:

4.1 AI Service Provider — Google Gemini API

When you submit a math problem to the Service, we transmit the problem content to Google's Gemini API to generate a walkthrough. We access the Gemini API through Google's paid commercial tier under a billing-enabled Google Cloud account. Under Google's terms applicable to this paid tier (currently available at https://ai.google.dev/gemini-api/terms):

• Google does not use the content you submit through GraphPrep, or the responses Google generates, to train or improve its AI models;
• Google logs the content for a limited period of time solely for the purpose of detecting and preventing abuse of its services and for legal compliance;
• Google's processing is governed by its Data Processing Addendum applicable to its paid services.

GraphPrep does not authorize any AI service provider to use your content for any purpose beyond generating responses to your requests, abuse detection, and legal compliance. We may in the future use additional AI service providers (such as Anthropic's Claude API) on a similar basis, and we will update this Privacy Policy to reflect any such additions.

4.2 Embedded Third-Party Tools

The Service embeds the Desmos Graphing Calculator, a JavaScript-based graphing tool provided by Desmos Studio PBC, to display interactive walkthroughs. The Desmos Graphing Calculator runs in your browser and processes mathematical expressions locally. When your browser loads the Desmos calculator, it may make requests to servers operated by Desmos Studio PBC, which may receive your IP address and basic technical information about your browser as part of any standard web request. Desmos Studio PBC's handling of such information is governed by Desmos Studio PBC's own privacy practices, which you can review at https://www.desmos.com/privacy.

5. Data Retention and Deletion

5.1 Retention Periods

We retain your personal information for as long as your account is active and for so long as needed to provide the Service. Specifically:

• Account information (name, email, hashed password) is retained until you close your account.
• Question history (problem text, answers, AI-generated walkthroughs) is retained until you delete it or close your account.
• Technical logs (IP addresses, browser data) are retained for a limited period determined by our hosting provider for security, debugging, and operational purposes.
• Email delivery logs (sender and recipient addresses, delivery status, timestamps) are retained by our transactional email provider, Resend, in accordance with its standard log retention practices.
• Payment records are retained as required by applicable tax, accounting, and financial regulations (typically several years).

5.2 Your Right to Delete

You have the following options to delete your data:

• Delete individual questions or your full question history through the history page of your account.
• Close your account and delete all associated data by emailing support@graphprep.com. We will process verified account deletion requests within 30 days. Account closure is permanent and immediate upon processing: you will lose access to the Service, including any active subscription or one-time pass, with no refund of any unused portion (see Section 13.3 of our Terms of Use). Once your account is deleted, we will delete your account information and question history from our active systems, except where retention is required by law (e.g., payment records for tax purposes) or as needed to resolve disputes, enforce agreements, or prevent fraud.

Backup copies of data may persist in our backup systems for a limited period after deletion before being overwritten in the ordinary course.

6. Your Choices and Rights

6.1 Access and Update Your Information

You can review and update your account information by logging into your account. You can view your question history through the history page.

6.2 Email Communications

If we send you service-related emails (such as account notifications, security alerts, or responses to support requests), you cannot opt out of these while your account is active because they are necessary to operate the Service. If we send marketing emails in the future, you will be able to unsubscribe through links provided in those emails.

6.3 Browser Controls

Most browsers allow you to control cookies and local storage through your browser settings. Disabling local storage will prevent the Service from functioning normally because we rely on it to maintain your session and enforce free-tier limits.

6.4 Do Not Track

Some browsers transmit "Do Not Track" signals. The Service does not currently respond to such signals. We do not track users across third-party websites or services.

6.5 California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you certain rights regarding your personal information, including the right to know what personal information we have collected about you, the right to delete your personal information, the right to correct inaccurate personal information, and the right not to be discriminated against for exercising these rights. GraphPrep does not sell personal information and does not share personal information with third parties for cross-context behavioral advertising. To exercise your California rights, please contact us at support@graphprep.com.

7. Other Sites and Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party website or service before providing them with your personal information.

8. Security

We use technical and organizational safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. These include encryption of data in transit, secure password hashing, database-level access controls (Row-Level Security), and authentication through industry-standard practices. However, no security measure is perfect, and we cannot guarantee the security of your personal information. You are responsible for keeping your account credentials confidential.

9. International Data Transfer

GraphPrep is operated from the United States. Our sub-processors operate in the United States and may operate in other countries. If you access the Service from outside the United States, your personal information will be transferred to and processed in the United States or other jurisdictions that may not provide the same level of data protection as your home country.

Users in Europe should also review the "Notice to European Users" section below regarding international data transfers.

10. Children

The Service is intended for use by individuals aged 13 and older. Users under the age of 18 must use the Service only with the consent and supervision of a parent or legal guardian, who agrees to our Terms of Use on the user's behalf.

GraphPrep does not knowingly collect personal information from children under the age of 13. If you are a parent or guardian and believe that we have collected personal information from a child under 13, please contact us at support@graphprep.com and we will delete that information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this Privacy Policy and, where you have an account with us, notify you by email or through the Service. Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the updated Privacy Policy.

12. How to Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Kestela LLC d/b/a GraphPrep
Email: support@graphprep.com

13. Notice to European Users

This section provides additional information for individuals located in the European Economic Area ("EEA"), the United Kingdom ("UK"), and Switzerland (collectively, "Europe").

13.1 Controller

For purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR, Kestela LLC d/b/a GraphPrep is the controller of personal information processed in connection with the Service. Our contact details are set out in Section 12 above.

13.2 Legal Bases for Processing

We process your personal information on the following legal bases:

13.3 Your Rights

If you are located in Europe, you have the following rights under applicable data protection laws:

• Right of access: request information about and a copy of the personal information we hold about you;
• Right to rectification: request correction of inaccurate or incomplete personal information;
• Right to erasure: request deletion of your personal information in certain circumstances;
• Right to restrict processing: request that we restrict the processing of your personal information in certain circumstances;
• Right to data portability: receive a copy of your personal information in a structured, commonly used, and machine-readable format;
• Right to object: object to processing based on our legitimate interests;
• Right to withdraw consent: withdraw consent at any time where we process your personal information based on your consent.

To exercise any of these rights, please contact us at support@graphprep.com. We may need to verify your identity before responding to your request. We aim to respond to all valid requests within one month, although complex requests may take longer.

13.4 Right to Lodge a Complaint

If you believe our processing of your personal information violates applicable data protection laws, you have the right to lodge a complaint with your local data protection authority. For users in the EEA, you can find your data protection authority at https://edpb.europa.eu/about-edpb/board/members_en. For users in the UK, you can contact the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. We would, however, appreciate the opportunity to address your concerns directly before you contact a data protection authority.

13.5 International Data Transfers

When we transfer your personal information from Europe to countries that have not been deemed to provide an adequate level of data protection (such as the United States), we rely on appropriate safeguards as required by applicable law, including the European Commission's Standard Contractual Clauses, the UK Addendum thereto, the EU-U.S. Data Privacy Framework (where applicable to a particular sub-processor), or other lawful mechanisms. You may contact us at support@graphprep.com for more information about the safeguards in place for any specific transfer.

13.6 Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, as described in Section 5 above, and to comply with our legal obligations.

13.7 Automated Decision-Making

The Service uses AI to generate walkthroughs and explanations in response to math problems you submit. This AI processing is not used to make decisions about you that have legal or similarly significant effects on you within the meaning of Article 22 of the GDPR.