Privacy Policy

1. Information We Collect

We collect information you provide directly, including:

• Account details such as name, email address, authentication provider, and user ID.
• Profile and study details such as test date, preparation goals, theme preferences, and progress settings.
• Onboarding details such as courses you are applying to, institutions of interest, previous real CASPer attempt dates, and reported result quartiles.
• Practice content such as typed answers, video or audio responses, transcripts, reflections, scores, AI critique, saved notes, and attempt history.
• Community or feedback content such as forum posts, comments, support requests, feature requests, and issue reports.
• Billing identifiers such as Stripe customer IDs, subscription IDs, checkout session IDs, plan status, and access expiry dates. Full card numbers are processed by Stripe and are not stored by us.

We may also collect technical information automatically, including IP address, browser type, device information, referring URLs, feature interactions, error logs, cookies, local storage identifiers, and approximate location derived from network information. Optional analytics are limited to redacted page paths and product events after you choose to allow analytics.

2. How We Use Information

We use information to:

• create and secure your account;
• provide timed practice, scoring, feedback, transcripts, and practice plans;
• save progress, attempts, plan limits, and dashboard history;
• process payments, renewals, cancellations, invoices, and plan access through Stripe;
• send service messages, optional weekly activity reports, account notices, billing notices, and deletion reminders;
• respond to support, feedback, and community moderation requests;
• detect abuse, enforce fair-use limits, prevent membership-limit evasion, and protect the service;
• debug reliability issues and, where you consent, measure and improve product usage; and
• comply with legal, tax, accounting, and security obligations.

For UK and EEA users, the legal bases may include contract performance for account, payment, and practice features; legitimate interests for security, abuse prevention, service diagnostics, and basic administration; consent for optional analytics; and legal obligation where records or notices are required by law.

3. AI Feedback, Transcripts, and Practice Data

When you request AI critique, your scenario, answers, transcript, reflection responses, and related scoring context may be sent to AI service providers to generate feedback. Video responses may be transcribed with AI. You can edit transcripts before re-running critique where that feature is available.

AI and transcription requests are rate limited and size limited to reduce abuse, cost, and unnecessary data transfer. We send only the content needed to produce the requested critique, coaching response, or transcript.

Do not include sensitive personal information, patient information, confidential school or workplace information, or identifying information about other people in practice answers unless it is necessary for the exercise. We do not use your practice data to make admissions decisions and we do not send your practice results to schools or programs.

Your CASPer test date, selected courses, previous results, practice answers, recordings, transcripts, and AI feedback are not shared with Acuity Insights, universities, schools, admissions programs, or other applicants.

4. Cookies and Analytics

We use cookies, local storage, and similar technologies for authentication, session security, remembering the browser, saving preferences, and optional analytics. Essential storage is required for sign-in, account security, theme preferences, and session continuity. Analytics and product usage diagnostics are off until you choose to allow them in the site privacy banner.

When analytics are allowed, we avoid sending full query strings, disable product session recording in PostHog, and limit Sentry replay sampling to error sessions only after analytics consent. You can change your choice from the Privacy choices button in the footer or by contacting support.

Essential browser storage includes the casper_auth cookie used to recognise an authenticated browser, together with local-storage values for session continuity, theme and display preferences, selected currency, camera and microphone preferences, notification state, and saved Study Buddy history. These values support requested features and are not used for advertising. The privacy-consent choice is stored locally as casper_privacy_consent_v1. Optional PostHog and Vercel Analytics storage is activated only after analytics consent; PostHog uses local storage for its analytics persistence. Browser storage can be cleared through the browser settings, although doing so may sign you out or reset preferences.

5. Service and Marketing Communications

We send essential service communications needed to operate your account, including email verification, password recovery, account-security notices, purchase and access confirmations, billing or service notices, and responses to support requests. These messages may still be sent when you opt out of optional communications.

With your consent, or where another lawful marketing exception applies, we may send optional product updates, study reminders, activity reports, offers, coupons, or other promotional messages. Every optional email includes a clear “Unsubscribe from all optional emails” link. Unsubscribing does not delete your account or cancel a paid plan. We record the unsubscribe request and suppress future optional messages, subject to limited records needed to honour the request and comply with law.

You can also contact hello@ioi.net.au to withdraw optional email consent or ask questions about communications. We do not use an unsubscribe request as consent to send a later re-subscription or re-engagement campaign.

6. When We Share Information

We may share information with service providers that help us operate the service, including:

• Google Firebase and Google Cloud for authentication, database, storage, hosting support, and functions;
• Stripe for payments, billing, invoices, subscriptions, fraud prevention, and customer portal access;
• Resend for delivery of service, support, and optional email communications;
• OpenAI for AI-generated critique and audio/video transcription;
• Vercel for hosting and Vercel Analytics, plus PostHog and Sentry for optional product measurement, logging, and reliability diagnostics; and
• professional advisers, regulators, or authorities where required by law.

We do not sell your personal information. We do not share personal information for cross-context behavioral advertising. We do not provide your practice answers, scores, course list, previous results, or account history to admissions programs.

Service providers are expected to process information only for the contracted service, protect it with appropriate safeguards, and support deletion or retention requests where applicable.

7. Security

We use technical and organizational safeguards designed to protect personal information, including authenticated access controls, encrypted transport, managed cloud infrastructure, Firebase App Check for callable-function abuse protection, rate limits on expensive AI routes, security headers, limited administrative access, and payment processing through Stripe. No online service can guarantee perfect security, so you should use a strong password, protect access to your email account, and notify us if you believe your account has been compromised.

If we become aware of a security incident involving personal information, we will assess the incident and provide notices to affected users or regulators where required by applicable law.

8. Retention

We keep account and practice information for as long as needed to provide the service, maintain records, enforce plan limits, resolve disputes, prevent abuse, and comply with legal obligations. Device or account signals may be retained as needed to reduce membership-limit evasion. Billing records may be kept longer where required for tax, accounting, fraud prevention, or chargeback purposes.

• Practice attempts, transcripts, recordings, notes, and profile data are kept while your account or paid plan remains active, unless you delete them earlier.
• Expired or inactive account data may be deleted by an administrator after 7 days, or earlier when you request deletion, subject to records we must retain by law or for tax, accounting, security, fraud prevention, chargebacks, or dispute resolution.
• Security, rate-limit, and diagnostic records are kept only as long as reasonably needed for abuse prevention, troubleshooting, legal, or accounting needs.
• Uploaded practice videos are automatically scheduled for deletion after 90 days from their latest stored timestamp, unless an earlier account or content deletion removes them sooner. Audio or video returned by a browser transcription request is not kept as a separate permanent recording by the application.

Signed-in users can request deletion from Profile. Deletion requests notify the administrator and are processed within 7 days, subject to records we must keep for legal, security, fraud prevention, or accounting reasons.

Signed-in users can also delete selected activity data while retaining their account, including individual practice attempts, all saved practice attempts, selected completed practice planner activities, or all completed practice planner activity history.

9. Automated Processing and AI

AI-generated critiques, scores, quartile estimates, transcripts, plans, and recommendations are produced to support practice and coaching. They are not used to decide admission, interview selection, employment, credit, insurance, or access to an essential service. We do not make solely automated decisions that produce legal or similarly significant effects about you. You should not rely on an AI output as an official assessment, and you can contact support if you believe an account or data decision was made in error.

We do not use practice answers, recordings, transcripts, or critiques to train a public generative-AI model unless we first provide a separate lawful basis and notice where required. AI providers may process the content needed to return the requested output under their applicable service terms and our provider agreements.

10. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal information, request portability, withdraw consent where processing is based on consent, and complain to a privacy regulator.

• United Kingdom and European Economic Area users may have rights under UK GDPR or GDPR, including rights to be informed, access, rectification, erasure, restriction, objection, portability, and complaint to a supervisory authority.
• Australian users may have rights under the Privacy Act 1988 and Australian Privacy Principles, including access, correction, complaint handling, transparent collection notices, data security, and cross-border disclosure protections where applicable.
• New Zealand users may have rights under the Privacy Act 2020, including rights to know why information is collected, request access, request correction, expect secure handling, and complain to the Privacy Commissioner.
• Canadian users may have rights under PIPEDA or applicable provincial privacy laws, including access, correction, openness about practices, limits on collection, use, disclosure and retention, safeguards, and complaint rights.
• United States users may have rights under applicable state privacy laws. California residents may have rights to know, access, delete, correct, opt out of sale or sharing, limit certain sensitive personal information uses, and not be discriminated against for exercising privacy rights. We do not sell personal information.

To make a privacy request, contact hello@ioi.net.au or use the deletion flow in your profile. We may need to verify your identity before completing a request. We aim to respond within the period required by the law that applies to your request.

You may ask for a copy of the personal information we hold about you, correction of inaccurate information, deletion where applicable, or an explanation of how a request was handled. We will explain any lawful reason for refusing or limiting a request and will identify information that must be retained for payment, tax, security, fraud, dispute, or legal purposes.

The Profile page also includes a data deletion section where you can remove practice and practice planner activity data without deleting your sign-in account.

If we cannot resolve your concern, you may complain to the privacy regulator that covers your location. Australian users can contact the Office of the Australian Information Commissioner. UK users can contact the Information Commissioner's Office. New Zealand users can contact the Office of the Privacy Commissioner. Canadian users can contact the Office of the Privacy Commissioner of Canada. EU users can identify their national supervisory authority through the European Commission's data-protection information. United States users may contact their state privacy regulator or Attorney General, where applicable.

11. International Users

Our service is operated using cloud providers and service providers that may process information in the United States, Canada, Australia, the European Economic Area, and other locations. By using the service, you understand that your information may be transferred to and processed in countries with privacy laws that differ from those in your location.

Where required, we rely on contractual, technical, organizational, or other lawful transfer mechanisms to support cross-border processing by our service providers, including data processing terms, standard contractual clauses or equivalent safeguards, and vendor security controls where applicable.

12. Children

The service is intended for students aged 17 and older who are preparing for professional or higher-education admissions assessments. We do not knowingly allow accounts for, or intentionally collect personal information from, anyone under 17. We ask new users to confirm that they meet the minimum age before creating an account. If you are under 18, use of the service may also require parent or legal guardian permission under the laws that apply to you. If you believe someone under 17 has provided personal information, contact us so we can restrict access and review or delete the information where required.

We are monitoring Australia’s Children’s Online Privacy Code, which is due to be finalised by 10 December 2026. For users in the UK, a 17+ restriction does not automatically remove obligations under the ICO Children’s Code because the service may still be accessed by people under 18. We will maintain a documented Children’s Code and data protection impact assessment (DPIA) review and update our practices as regulatory guidance develops. See the OAIC Children’s Online Privacy Code information and ICO Children’s Code guidance.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new last-updated date. If a change is material, we may provide additional notice through the site or by email.

14. Contact

Privacy and support requests can be sent to hello@ioi.net.au or by post to PO Box 7169, Mount Crosby, Queensland 4306, Australia. If you contact us, please include enough information for us to understand and respond to your request.