1. Who We Are

CISSP Adaptive Prep ("we," "us," or "our") operates the website at cisspadaptiveprep.com and the application at app.cisspadaptiveprep.com. We are the data controller for personal information collected through our platform.

For privacy-related questions, contact us at: support@cisspadaptiveprep.com

2. Information We Collect

Information you provide directly

• Account information: First name, last name, and email address when you register
• Payment information: Billing details processed through Stripe. We do not store your full credit card number — Stripe handles all payment data under their own privacy policy and PCI DSS compliance
• Profile preferences: Any optional information you add to your account settings

Information collected automatically

• Study data: Questions answered, answers selected, time spent, exam session results, domain performance scores, and readiness assessments
• Usage data: Pages visited, features used, session duration, and navigation patterns within the app
• Technical data: IP address, browser type, device type, operating system, and referring URLs
• Authentication data: Login timestamps and multi-factor authentication status

3. How We Use Your Information

Purpose	Data Used	Basis
Provide and operate the platform	Account info, study data	Contract performance
Process payments and manage subscriptions	Email, billing info	Contract performance
Personalize your study experience	Study data, performance history	Legitimate interest
Send account and subscription emails	Email address	Contract performance
Respond to support requests	Account info, correspondence	Legitimate interest
Improve platform content and features	Aggregated usage data	Legitimate interest
Prevent fraud and enforce Terms of Service	Technical data, account info	Legitimate interest
Comply with legal obligations	As required by law	Legal obligation

We do not use your personal data for advertising purposes and do not sell your data to third parties.

4. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase — Database hosting, user authentication, and data storage. Data is stored on Supabase infrastructure. See Supabase Privacy Policy.
• Stripe — Payment processing. Stripe is PCI DSS compliant. We do not store full payment card details. See Stripe Privacy Policy.
• Netlify — Website and application hosting. See Netlify Privacy Policy.

Each of these providers has their own privacy policies governing how they handle data. We select providers that maintain strong data protection standards.

5. Data Retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations or resolve disputes. Specifically:

• Account data: Retained while your account is active and for up to 2 years after account closure
• Study and performance data: Retained for the duration of your account and up to 1 year after account closure
• Payment records: Retained for 7 years as required for financial and tax compliance
• Technical logs: Retained for up to 90 days

You may request deletion of your account and associated data at any time (see Section 7). Note that deletion requests do not apply to payment records required by law.

6. Data Security

We take reasonable technical and organizational measures to protect your personal data, including:

• All data transmitted over HTTPS/TLS encryption
• Passwords hashed and never stored in plain text
• Optional multi-factor authentication (MFA) for your account
• Row-level security policies on our database to restrict data access
• Access to production systems limited to authorized personnel only

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and personal data
• Portability: Request your study data in a portable format
• Objection: Object to processing based on legitimate interest
• Restriction: Request restriction of processing in certain circumstances

To exercise any of these rights, contact us at support@cisspadaptiveprep.com. We will respond within 30 days. Note that exercising deletion rights will result in loss of access to your subscription with no refund.

8. Cookies and Tracking

Our platform uses the following types of cookies and local storage:

• Essential cookies: Required for authentication and maintaining your login session. These cannot be disabled without breaking core functionality.
• Functional storage: Browser local storage used to maintain your session state within the application.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies that track you across other websites.

9. Children's Privacy

Our platform is intended for adults pursuing professional certification. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has created an account, please contact us immediately and we will delete the account.

10. International Users

Our platform is operated from the United States. If you access our platform from outside the US, your data will be transferred to and processed in the United States. By using our platform, you consent to this transfer. We implement appropriate safeguards for international transfers in accordance with applicable law.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at support@cisspadaptiveprep.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Your continued use of the platform after changes are posted constitutes your acceptance of the revised policy.

13. Contact Us

For questions, concerns, or requests related to this Privacy Policy or your personal data:

CISSP Adaptive Prep
Email: support@cisspadaptiveprep.com
Website: www.cisspadaptiveprep.com