Privacy Policy

1. Information We Collect

• Account information: email, name, language preference
• Authentication: OAuth provider IDs (Google, GitHub) when applicable
• Usage: worksheets generated, modules used, storage quota consumed
• Payment: handled by Stripe (global cards + PromptPay) — we do not store card details
• Technical: IP address (hashed, for analytics and fraud prevention), browser, OS

2. How We Use Information

• To provide the Service (generate worksheets, manage your plan and quota)
• To process payments and prevent fraud
• To send transactional emails (receipts, password resets)
• To improve the Service (aggregated analytics)

3. Our Roles: Controller and Processor

MathPrepAI plays two different legal roles depending on whose data it is.

When we are the controller. For your own account — the email, name, language, login credentials, plan, and usage records you create when you sign up with us directly — MathPrepAI is the data controller. We decide why and how that data is used, and this Privacy Policy governs it.

When we are the processor. When a teacher, school, university, or event organiser creates a class or room and enters their students’ or participants’ information (for example a display name, or an adult student’s institutional email, together with attendance and scores), that teacher, school, or organiser is the data controller for that information. MathPrepAI acts only as their data processor — we store and process that data on their documented instructions, solely to provide the classroom features, and never for our own purposes. We do not use it to train models, to market, to profile, or to sell.

Because the school or organiser is the controller of the room’s data, they are responsible for having a lawful basis to collect it and for giving their students or participants the required privacy notices. Our contractual terms with them are set out in our Data Processing Agreement.

If you are a student or participant in someone’s class or room and you want to access, correct, or delete your data, please contact the teacher, school, or organiser who runs that room first — they are the controller and decide such requests. We will promptly assist them. Where the law lets you exercise a right directly (for example, an adult student erasing their own class-scoped data), you can also do so from your student home page or by emailing privacy@mathprepai.com, and we will route the request to the controller where required.

4. Data Sharing & Sub-processors

We do not sell your personal information and we never share it for third-party advertising. We share data only with the service providers (“sub-processors”) that operate the platform, each under a contract requiring confidentiality and data protection: Neon (PostgreSQL database, Singapore), Railway (math-generator API, Singapore — no student personal data stored), Vercel (web hosting and CDN, US primary + global edge) and Vercel Blob (worksheet-PDF file storage), Resend (transactional email, US), Stripe (payments, global — we never store card details), Sentry (error monitoring, US — pseudonymised), Google Analytics 4 (by Google LLC — web analytics, United States — adults only, loaded only if you accept optional analytics cookies and never for children; runs with Consent Mode with all advertising cookies denied, and stays off until an administrator configures a measurement ID), and PostHog (product analytics, United States — adults only, used only if you accept optional analytics cookies and never for children; currently disabled). We do not use classroom or student data for our own purposes.

5. Data Retention

We retain account data while your account is active. Upon account deletion, we anonymize or delete personal data within 30 days, except where retention is legally required (e.g., tax records).

6. Your Rights (GDPR / PDPA)

You may request access, correction, export, or deletion of your data at any time. Email privacy@mathprepai.com.

7. Cookies

We keep cookies to a minimum. Essential cookies are required for the site to work and are always on; optional analytics cookies are set only if you choose “Accept all” in the cookie banner. You can decline the optional ones with no loss of functionality. We use no third-party advertising cookies.

8. Children’s Privacy

MathPrepAI is designed for educators, not for direct use by young children without a teacher or guardian. We do not knowingly collect personal information from children under 13 (or the equivalent age in your jurisdiction) beyond the minimal data a teacher enters to run their classroom: a student’s display name and class membership. We do not collect a child’s email, photo, date of birth, or contact details, and we never show children behavioral advertising.

Before a student can sign in, a teacher must either (a) attest they are authorized — through their school or as the child’s teacher — to consent on the parents’ behalf for educational use (the COPPA “school consent” exception, the model Google Classroom uses), or (b) obtain verifiable consent from the student’s parent or guardian through our per-parent consent flow. A parent or guardian may at any time ask us or the teacher to review, correct, or delete their child’s data, or to stop further collection, by contacting the teacher or emailing privacy@mathprepai.com. When consent is withdrawn or a student is removed from a roster, the child’s access ends immediately and their data is deleted or de-identified per our retention policy.

If you believe we have collected a child’s information without appropriate consent, contact privacy@mathprepai.com and we will delete it promptly.

9. Classroom & Student Data (Schools and Universities)

When a teacher creates a classroom they choose whether it is a school (K-12), secondary, or higher-education class, which determines what data is stored — always the minimum needed:

• School (K-12) classes: only a display name and class membership — no email, photo, date of birth, or contact details for a child (see §8).
• Secondary (minor) classes using email: students join with a school email but are still minors — email verification alone is not consent; they still rely on school or guardian consent (see §8), exactly as K-12 classes do.
• Higher-education / adult-student classes: we store only a display name and an institutional email — no student number, phone, date of birth, or address. The student verifies their own email with a one-time passcode (OTP) and affirms they are 18 or older in order to self-consent. Anyone who does not affirm adulthood is treated as a minor and requires teacher or guardian consent.

Lawful basis: for K-12 and secondary (minor) classes we rely on school or parental consent (§8). For adult students, the school or teacher is the data controller and provides the lawful basis for the educational relationship; the student’s OTP verification together with their 18+ affirmation is their own affirmative confirmation. We never use a student’s email for marketing or profiling. Signing in to a class with an email does not create a MathPrepAI account — it is only a student identity scoped to that specific class, separate from any general user account.

Retention and rights: student data is deleted when a teacher deletes the class (if the student isn’t in another class), when a teacher deletes a student’s data, or when the student erases it themselves. Adult students can view or delete all of their own data from their student home page; for minors this is handled via the teacher/guardian or by emailing privacy@mathprepai.com.

10. International Data Transfers

MathPrepAI is operated from Thailand and serves users worldwide, so your data is processed in more than one country. Our primary database is hosted in Singapore (Neon PostgreSQL), our math-generator service runs in Singapore (Railway — stateless, no student personal data stored), and web delivery, file storage, email, payments, error monitoring, and analytics (including Google Analytics) use providers located in the United States and globally distributed edge networks (see §4).

We do not rely on your bare consent to legitimise these transfers. Instead, we put appropriate safeguards in place under each applicable regime:

• Thailand (PDPA B.E. 2562): Where personal data is transferred from Thailand to a country that the Personal Data Protection Committee has not designated as providing adequate protection, we rely on the appropriate safeguards permitted under Section 28 and Section 29 of the PDPA — principally standard contractual clauses (based on the ASEAN Model Contractual Clauses or the EU Standard Contractual Clauses) incorporated into our contracts with sub-processors.
• European Economic Area (GDPR, Chapter V): For transfers to the United States we rely on the EU–US Data Privacy Framework where the recipient is certified under it, and on the 2021 EU Standard Contractual Clauses for all other transfers, including to Singapore, together with supplementary measures where appropriate.
• United Kingdom (UK GDPR): We rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and on the UK Extension to the EU–US Data Privacy Framework for certified US recipients.
• Switzerland (FADP): We rely on the Swiss–US Data Privacy Framework for certified US recipients, and on the Swiss Standard Contractual Clauses otherwise.
• Other regions (e.g. Brazil, LGPD Art. 33, and other jurisdictions): We apply an equivalent contractual safeguard, or another lawful transfer mechanism available under local law.

These safeguards contractually require each recipient to protect your data to a standard consistent with the originating country’s law and to assist us in upholding your rights. You may request a copy of the relevant transfer mechanism, or more information about the safeguards we use, by emailing privacy@mathprepai.com.

11. Contact

Email privacy@mathprepai.com for any privacy-related question.