Privacy Policy

1. Introduction

Introduction

Aqoryn, LLC ("Aqoryn," "we," "us," "our," or "Company") operates the website and application located at aqoryn.com, including all associated services, features, and content (collectively, the "Platform"). This Privacy Policy describes how we collect, use, disclose, and otherwise process your information, including personal information, in connection with your access to and use of the Platform.

We are committed to protecting your privacy and ensuring you have a positive experience on the Platform. This Privacy Policy applies to all visitors and users of the Platform, including students, bar exam candidates, and other individuals who interact with our services.

By accessing and using the Platform, you acknowledge that you have read this Privacy Policy and agree to the practices described herein. If you do not agree with our privacy practices, please do not use the Platform. Your continued use of the Platform following any changes to this Privacy Policy constitutes your acceptance of such changes.

2. Information We Collect

Information We Collect

We collect information in several ways to provide, improve, and personalize our Platform and services. The information we collect includes:

A. Information You Provide

We collect information that you directly provide to us when you interact with the Platform:

• Account Registration: When you create an account, we collect your name, email address, and password. We also collect your state bar exam jurisdiction selection to personalize your study experience.
• Subscription and Billing Information: When you purchase a subscription, we collect billing information including your billing address. Payment processing is handled entirely by Stripe, our third-party payment processor. We do NOT store, process, or have access to your full credit card numbers. Stripe securely processes and stores payment information in compliance with PCI-DSS standards.
• Study Guide and Course Purchases: We maintain a record of which study guides, courses, and educational materials you have purchased to ensure proper access and licensing.
• Support Communications: When you contact our support team via email or through the Platform, we collect your name, email address, contact information, and the content of your messages to respond to your inquiries and resolve any issues.
• Profile Information: You may voluntarily provide additional information in your account profile, such as educational background, study goals, or preferred learning styles.

B. Information Generated Through Use

We automatically collect information about your use of the Platform that helps us understand how you learn, track your progress, and provide personalized recommendations:

• Question Response Data: We collect information about every question you answer, including the question ID, whether your response was correct or incorrect, the text of your response (for essay questions), and the timestamp of your answer. This data forms the foundation of our learning analytics.
• Progress Tracking Data: We generate and store metrics related to your progress, including your accuracy rate by subject area, your current streak (consecutive correct answers), your completion rates for lessons and study modules, and your overall performance trends over time.
• Weak Area Identification Data: Based on your question responses and performance metrics, our system identifies areas where you may need additional study and generates recommendations for targeted practice and review.
• Exam Readiness Scores: We calculate proprietary exam readiness scores and percentile rankings that estimate your likelihood of passing the bar exam and your relative performance compared to other users (in anonymized form).
• Essay Submissions and Drafting Lab Responses: When you submit essays or complete drafting lab exercises, we store the text of your submissions, along with any feedback, scores, or analytics generated from your work.
• Cold-Call Simulator Session Data: When you participate in our cold-call simulator, we record information about your responses, including the question presented, your oral or written response, and performance metrics related to your communication and legal reasoning.

C. AI Interaction Data

We collect information related to your interactions with our Qendrixa-powered features to improve these features and provide you with personalized assistance:

• Qendrixa Chat Sessions: Our Qendrixa-powered study assistant processes your questions and requests in real time. Chat session content is currently stored in component state and is NOT persisted to our database servers. This means your chat history with Qendrixa is not retained after you close your session.
• Case Brief Generator Queries: When you use our Case Brief Generator powered by AI, we process the case text or information you provide to generate briefing assistance. These queries are processed through the Anthropic Claude API and are grounded in our access to verified legal databases containing authenticated court opinions and authoritative legal sources.
• AI-Generated Study Recommendations: Our AI system generates personalized study recommendations based on your performance data and learning patterns. These recommendations are stored to improve future personalization.
• Important Note on AI Data Usage: While we use the Anthropic Claude API to process AI interactions, your data is NOT used by Anthropic to train, improve, or develop their foundation models. Anthropic's API Data Usage Policy explicitly prohibits using customer API data for model training. You can view Anthropic's privacy practices at https://www.anthropic.com/privacy.
• Legal Database Access and Processing: Aqoryn accesses verified legal databases containing authenticated court opinions, statutory texts, and authoritative legal sources on behalf of users to ground AI-generated legal content in legitimate primary sources. These legal database queries are processed securely and are not shared with third parties or used for any purpose other than providing accurate, authoritative educational content.

D. Automatically Collected Data

We automatically collect certain information about your device and how you interact with the Platform:

• Device Information: We collect information about the device(s) you use to access the Platform, including device type, device model, device identifier, and hardware specifications.
• Browser and System Information: We collect information about your web browser, including browser type, browser version, operating system, and operating system version.
• IP Address and Location: We automatically collect your Internet Protocol (IP) address. We may derive general location information (such as country or state) from your IP address, but we do not collect or store precise GPS location data.
• Usage Patterns: We collect information about how you use the Platform, including which pages you visit, which features you access, how long you spend on the Platform, the order in which you access content, and which links you click.
• Session Duration: We track how long your sessions are and when you log in and out of your account.
• Cookies and Similar Technologies: We use cookies, local storage, and session storage to collect information about your browsing activities and preferences (see Section 7 for more details).

3. How We Use Your Information

How We Use Your Information

We use the information we collect for a variety of purposes, all related to providing you with an exceptional educational experience and improving our Platform. Specifically, we use your information to:

• Provide and Maintain the Platform: We use your information to create and manage your account, process your requests, and deliver the Platform's features and services to you.
• Process Subscriptions and Payments: We use your billing information to process your subscription purchases, issue invoices, and manage your subscription status.
• Generate Personalized Study Recommendations: We use your performance data and learning patterns to generate personalized study recommendations through our Qendrixa AI assistant, helping you focus on areas where you need the most improvement.
• Calculate Progress Metrics and Analytics: We use your question response data and engagement information to calculate your accuracy rates, completion rates, progress trends, and other performance metrics.
• Generate Percentile Rankings and Exam Readiness Scores: We calculate your percentile ranking relative to other users and your exam readiness score based on your performance. These metrics help you understand your preparation level for the bar exam.
• Identify Weak Areas and Study Sequencing: We analyze your performance data to identify subject areas where you struggle and recommend optimal study sequences to help you efficiently build competency.
• Generate Anonymized Global Ranking Metrics: We create anonymized, aggregated metrics about overall user performance, trends, and benchmarks that we may use for platform improvements, research, or reports (without identifying individual users).
• Improve AI Features and Educational Content: We use aggregated and anonymized data about how users interact with our AI features and educational content to improve the accuracy, relevance, and helpfulness of these features.
• Send Account-Related Communications: We use your email address to send you account-related notifications, such as account creation confirmations, password resets, subscription confirmations, invoice notifications, and important platform updates. These communications are transactional and not promotional.
• Detect and Prevent Fraud: We use your information to monitor for and investigate fraudulent activity, unauthorized access attempts, and other security threats to protect the integrity of the Platform and the privacy of our users.
• Comply with Legal Obligations: We may use your information to comply with applicable laws, regulations, court orders, and other legal requirements.
• Respond to Your Requests: We use the information you provide when contacting support to respond to your inquiries and resolve issues you may encounter.

4. How We Share Information

How We Share Information

We do not sell your personal information, and we do not engage in "cross-context behavioral advertising." We share your information only in the following limited circumstances:

A. Service Providers

We share your information with trusted third-party service providers who help us operate the Platform and provide you with our services. These service providers are contractually obligated to use your information only to provide the services we request and to maintain the confidentiality and security of your information. Our service providers include:

• Supabase: We use Supabase for database hosting, user authentication, and backend infrastructure. Your account information, progress data, and other user-generated data are stored on Supabase's secure servers.
• Stripe: We use Stripe for payment processing. Stripe handles all payment information in compliance with PCI-DSS standards. We do not receive or store your full credit card numbers; Stripe securely processes and tokenizes this information.
• Anthropic: We use Anthropic’s Claude API to power our AI features, including Qendrixa and the Case Brief Generator. When you use these features, certain queries and prompts are processed through Anthropic’s API. Anthropic does not use API request data to train or improve their models (per their API Terms of Service).
• Mux: We use Mux for video content delivery and streaming. If you watch video content on the Platform, Mux may collect information about your viewing behavior.
• Vercel: We use Vercel for application hosting and deployment. Vercel hosts the front-end of our Platform.
• ElevenLabs: We plan to integrate ElevenLabs for text-to-speech functionality to enhance our educational content. When this feature is implemented, text content you study may be processed by ElevenLabs for voice generation.
• HeyGen: We use HeyGen for video production and AI-generated instructor content. HeyGen does not receive personal user data; it is used only for content production purposes.

B. Legal Requirements

We may disclose your information if required to do so by law, including in response to a subpoena, court order, legal process, or other governmental request. We may also disclose information when we believe in good faith that disclosure is necessary to:

• Protect our legal rights, privacy, safety, or property;
• Protect the legal rights, privacy, safety, or property of our users or the public;
• Detect, investigate, and address fraud, security issues, or technical problems;
• Enforce our Terms of Service or other applicable agreements; or
• Comply with applicable law or legal process.

C. Business Transfers

If Aqoryn is involved in a merger, acquisition, bankruptcy, asset sale, or other business transaction, your information may be transferred as part of that transaction. We will provide notice of any such change and any choices you may have regarding your information.

D. With Your Direction

We may share your information when you request or authorize us to do so, such as when you give permission to share information with a third-party service or when you consent to specific uses of your data.

E. Data Sales and Advertising

We do not sell your personal information to third parties. We do not engage in "cross-context behavioral advertising," which is the practice of collecting information about your activities across different websites or services to target you with personalized advertisements. We respect your privacy and do not participate in data brokerage or ad targeting schemes that depend on selling your information.

5. Data Retention

Data Retention

We retain your information for as long as necessary to provide you with our services and to comply with our legal obligations. The retention periods for different types of information are as follows:

• Account Information: We retain your account information (name, email, password, account settings) for as long as your account is active and for a reasonable period thereafter to support your account recovery, address disputes, and comply with legal obligations.
• Performance and Progress Data: We retain your question response data, progress metrics, accuracy rates, exam readiness scores, and related analytics for as long as your account is active. We retain this data to provide you with ongoing analytics and to improve our Platform based on how users learn.
• Payment and Billing Information: Stripe retains payment records and transaction history in accordance with their own retention policies and applicable law, typically for a minimum of 7 years for tax and accounting purposes.
• Support Communications: We retain records of your support communications for as long as necessary to respond to your inquiries and resolve issues, typically for 1-2 years after your last communication.
• AI Interaction Data: Chat sessions with Qendrixa are not persisted to our servers and are cleared when you close your session. AI-generated study recommendations are retained for as long as your account is active to support ongoing personalization.
• Log and Security Data: Server logs, IP addresses, and security-related data (such as failed login attempts and rate-limiting records) are retained for up to 90 days for security monitoring and fraud prevention, after which they are automatically deleted or anonymized.
• After Account Deletion: When you request deletion of your account, we will delete or anonymize your personal information within 90 days. However, we may retain certain information if required by law, for fraud prevention purposes, to address disputes, or for legitimate business purposes related to protecting the integrity of the Platform. We may also retain anonymized or aggregated data that cannot identify you.
• Cookies and Tracking Data: We retain cookie and tracking data in accordance with the expiration times set in the cookies themselves. Most session cookies expire when you close your browser; persistent cookies may last for months or years depending on their purpose.

Some information may be retained longer than others based on legal requirements, contractual obligations, or legitimate business interests. If you have questions about the retention of specific information, please contact us at support@aqoryn.com.

6. Data Security

Data Security

We take the security of your information very seriously and implement reasonable and appropriate administrative, technical, and physical measures to protect your information against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption in Transit: All data transmitted between your device and our Platform is encrypted using TLS (Transport Layer Security) 1.2 or higher. This ensures that your information is protected while it travels over the internet.
• Encryption at Rest: Sensitive data stored on our servers is encrypted at rest using industry-standard encryption algorithms.
• Supabase Row-Level Security: We use Supabase's row-level security (RLS) policies to ensure that users can only access their own data and that data is properly segregated.
• Stripe PCI-DSS Compliance: Payment processing is handled by Stripe, which is fully compliant with PCI Data Security Standard (PCI-DSS). Stripe is certified at the highest level of compliance and undergoes regular independent security audits.
• Secure Authentication: We use secure authentication protocols to verify the identity of users and prevent unauthorized account access. We recommend using a strong, unique password for your account.
• Access Controls: We restrict access to personal information to authorized employees and service providers who need to access the information to provide our services and perform their job functions.
• Regular Security Updates: We regularly update our systems and software to patch known security vulnerabilities and address emerging threats.

Important Limitation: While we implement strong security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your password and account credentials. If you believe your account has been compromised, please contact us immediately at support@aqoryn.com.

7. Cookies and Similar Technologies

Cookies and Similar Technologies

We use cookies, local storage, and other similar tracking technologies to collect information about your activities on the Platform and to enhance your user experience. Below is a summary of how we use these technologies:

Cookies

A cookie is a small text file that is stored on your device when you visit a website. Cookies serve many purposes and can help websites recognize you, remember your preferences, and track your activities.

• Session Cookies: We use session cookies to maintain your login status and session information. These cookies are temporary and expire when you close your browser.
• Persistent Cookies: We use persistent cookies to remember your preferences, such as theme settings, language preferences, and other customizations. These cookies remain on your device until they expire or you delete them.
• Authentication Cookies: We use authentication cookies to securely verify your identity and maintain your logged-in session across different pages of the Platform.

Local Storage and Session Storage

We use browser-based local storage and session storage to store information on your device, such as your study preferences, saved answers, and progress checkpoints. This information enhances your experience by allowing the Platform to remember your choices and provide a more seamless learning environment.

Purposes

We use cookies and similar technologies for the following purposes:

• Authentication and Session Management: To verify your identity and maintain your logged-in session.
• Remembering Preferences: To remember your preferences and customize your experience on the Platform.
• Analytics and Performance Monitoring: To understand how users interact with the Platform, measure the effectiveness of our features, and identify technical issues.
• Security: To detect and prevent fraud and unauthorized access.

Your Choices

Most browsers allow you to control cookies through browser settings. You can typically choose to:

• Accept all cookies automatically;
• Reject all cookies automatically;
• Receive a prompt each time a cookie is requested; or
• Delete cookies from your device.

Please note that disabling cookies may affect the functionality of the Platform. Some features may not work properly if cookies are disabled, such as maintaining your login status, remembering your preferences, or tracking your study progress.

8. Your Rights and Choices

Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal information. We are committed to respecting these rights and providing you with transparent control over your data. You may have the following rights:

• Right of Access: You have the right to request a copy of the personal information we hold about you. We will provide you with a detailed report of the information we have collected, including how we use it and with whom we share it.
• Right to Correction: You have the right to request correction of inaccurate, incomplete, or outdated personal information. You can update your account information directly through your account settings, or you can contact us for assistance.
• Right to Deletion: You have the right to request deletion of your account and associated personal data. To exercise this right, please email support@aqoryn.com with your request. We will delete your data within 90 days, except where retention is required by law or for legitimate business purposes.
• Right to Data Export: You have the right to request an export of your personal data in a portable, machine-readable format. Contact support@aqoryn.com to request your data export.
• Right to Opt-Out of Marketing: If we ever send you marketing or promotional emails, you have the right to unsubscribe from such communications. Every marketing email will include an unsubscribe link. Please note that you cannot opt out of transactional emails (such as account notifications, password resets, and billing information), as these are necessary to maintain your account.
• Right to Information: You have the right to know what personal information we collect, how we use it, and with whom we share it. This Privacy Policy provides that information, and you can contact us for additional details.

How to Exercise Your Rights

To exercise any of these rights, please contact us at support@aqoryn.com. Include in your request:

• A clear description of the right you wish to exercise;
• Your full name and the email address associated with your account;
• Any additional information that will help us locate your data; and
• Proof of your identity (if required for security purposes).

We will respond to your request within the timeframe specified by applicable law, typically within 30 days. If we need additional information to verify your identity or locate your data, we will contact you. We will not charge a fee for exercising your rights, except in cases where your requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

9. California Privacy Rights (CCPA/CPRA)

California Privacy Rights (CCPA/CPRA)

If you are a resident of the State of California, you have additional privacy rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). This section describes your rights and how to exercise them:

A. Right to Know

You have the right to know what categories of personal information we collect, the source of that information, our business purposes for collecting it, and the categories of third parties with whom we share it. You also have the right to request a copy of the specific pieces of personal information we have collected about you.

B. Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions. For example, we may retain information if necessary to complete your transaction, provide requested services, detect security incidents, comply with legal obligations, or enable internal uses reasonably aligned with your expectations.

C. Right to Opt-Out of Sale of Personal Information

We do not sell your personal information, and we do not intend to do so. Therefore, this right does not currently apply. However, if this practice changes in the future, we will provide a clear "Do Not Sell My Personal Information" link on our Platform.

D. Right to Opt-Out of Sharing for Cross-Context Behavioral Advertising

We do not engage in cross-context behavioral advertising. We do not collect information about your activities across different websites or services to target you with personalized advertisements. Therefore, you do not have the need to opt out of this practice.

E. Right to Correct Inaccurate Information

You have the right to request that we correct inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing.

F. Right to Limit Use of Sensitive Personal Information

Under the CPRA, you have the right to limit our use of sensitive personal information to what is reasonably necessary to provide services you request or otherwise perform the uses we have disclosed. We currently do not collect sensitive personal information (such as Social Security numbers, financial account information, or precise geolocation) unless necessary for specific purposes disclosed in this Privacy Policy.

G. Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA or CPRA rights. We will not deny you goods or services, charge you different prices, provide different quality of service, or suggest that you will receive different treatment because you exercised your privacy rights. However, we may offer you financial incentives (such as discounts) in exchange for the collection, sale, or sharing of your personal information, provided that such incentives are offered transparently and you have the right to opt in or opt out.

H. How to Exercise California Privacy Rights

To exercise any of your California privacy rights, please send a verified consumer request to support@aqoryn.com. Include:

• Your full name and the email address associated with your account;
• A clear description of the right you wish to exercise;
• Any relevant account details; and
• Proof of your identity and California residency.

Response Timeline: We will respond to your verified consumer request within 45 days of receipt. If we cannot fulfill your request within this timeframe, we will notify you of the delay and provide an explanation for why we need an extension (up to 90 days total). If we deny your request, we will explain the reason for the denial.

Authorized Agent: If you would like an authorized agent to submit a request on your behalf, please have your agent submit the request with written authorization signed by you and a copy of your government-issued ID.

10. Children's Privacy

Children's Privacy

Aqoryn is designed for users 18 years of age and older. Our Platform is intended for law students, bar exam candidates, and other adult learners. We do not knowingly collect personal information from anyone under the age of 18.

If we discover that we have collected personal information from someone under the age of 18, we will immediately delete such information from our systems. If you believe that we have collected information from a minor, please contact us immediately at support@aqoryn.com so that we can take appropriate action.

Parents and guardians who believe their child has provided information to Aqoryn should contact us immediately at support@aqoryn.com. We take children's privacy seriously and are committed to complying with the Children's Online Privacy Protection Act (COPPA) and other applicable laws protecting minors.

11. European Privacy Rights (GDPR)

European Privacy Rights (GDPR)

If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent local legislation. This section describes those rights and how we comply with the GDPR.

A. Lawful Basis for Processing

We process your personal data on the following lawful bases under Article 6 of the GDPR:

• Contractual Necessity: Processing necessary to perform our contract with you (providing the Platform and its features, managing your account and subscription).
• Legitimate Interests: Processing necessary for our legitimate interests, including improving the Platform, preventing fraud, and ensuring security, provided these interests are not overridden by your data protection rights.
• Consent: Where you have provided explicit consent for specific processing activities, such as receiving marketing communications or the transfer of your data to the United States.
• Legal Obligation: Processing necessary to comply with a legal obligation to which we are subject.

B. Your Rights Under the GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Article 15): You have the right to obtain confirmation of whether we process your personal data and to request a copy of the data we hold about you.
• Right to Rectification (Article 16): You have the right to request correction of inaccurate personal data or completion of incomplete data.
• Right to Erasure (Article 17): You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing and there are no overriding legitimate grounds.
• Right to Restriction of Processing (Article 18): You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
• Right to Object (Article 21): You have the right to object to processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

C. International Data Transfers

Aqoryn is based in the United States and our servers and databases are located in the United States. If you access the Platform from outside the United States, your personal data will be transferred to, stored in, and processed in the United States. Data protection laws in the United States may differ from those in your country of residence.

We transfer your data to the United States based on your explicit consent, which you provide by accepting this Privacy Policy and using the Platform. If you have concerns about the transfer of your data, please contact us at support@aqoryn.com to discuss alternative arrangements.

D. Data Protection Contact

For GDPR-related inquiries, data subject access requests, or to exercise any of the rights described above, please contact our data protection contact at: privacy@aqoryn.com. We will respond to your request within 30 days as required by the GDPR. If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority (data protection authority).

12. Changes to This Policy

Changes to This Policy

We may update this Privacy Policy from time to time as our Platform evolves, as we implement new features, and as laws and regulations change. When we make material changes to this Privacy Policy, we will notify you by:

• Sending you an email notification to the email address associated with your account;
• Posting a prominent notice on the Platform informing you of the changes; or
• Requiring you to affirmatively accept the updated Privacy Policy before continuing to use the Platform.

Your continued use of the Platform following the posting of revised Privacy Policy terms means that you accept and agree to the changes. If you do not agree with any changes, please discontinue use of the Platform.

Non-material changes to this Privacy Policy (such as correcting typos or clarifying existing language) may be made without advance notice. We encourage you to review this Privacy Policy regularly to stay informed about how we protect your information.

13. Contact Information

Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Email: support@aqoryn.com

Company: Aqoryn, LLC

We will respond to your inquiry within a reasonable timeframe, typically within 10 business days. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.