Altus Prep™ is committed to protecting the academic and personal data of our students and families. This policy outlines how we handle data in accordance with UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law) and the UK GDPR / Data Protection Act 2018.

1. Data Storage & Transfers

We utilize secure global infrastructure (Cloudflare & Supabase) located in the EU and Singapore regions. By using Altus Prep™, you consent to the cross-border transfer of data necessary for high-performance AI processing, protected by industry-standard encryption. We rely on Standard Contractual Clauses (SCCs) for transfers outside the UAE.

2. Protection of Minors

As a platform used by students aged 14-18, we prioritize the protection of minors. We do not engage in targeted advertising or behavioral profiling of students. Parental or guardian consent is required for account creation and the processing of any academic data.

3. Automated Communications (WhatsApp & n8n)

Progress reports and alerts may be processed via secure automation workflows (n8n) and delivered to parents via the WhatsApp Business API. By opting into these reports, parents consent to the use of their contact information for this specific diagnostic purpose. You may opt-out at any time.

4. Information We Collect

Academic email and full name for authentication.
Learning progress, mastery percentages, and knowledge gaps.
AI chat interactions for socratic quality control.

5. How We Use Your Data

We process your data on the following legal bases:

Contract performance: account creation, learning progress tracking, quiz generation, and AI companion learning.
Consent: WhatsApp progress reports and marketing communications (withdrawable at any time).
Legitimate interest: anonymized analytics, platform security, and fraud prevention.

6. Data Retention

Active subscription data is retained for the duration of your subscription plus 12 months after cancellation.
AI chat logs are retained for 90 days, then permanently anonymized.
Semantic cache entries expire automatically after 30 days.
Upon account deletion, all personal data is permanently deleted within 30 days.

7. Third-Party Processors

We share data with the following processors, each bound by data processing agreements:

Supabase Inc. — database hosting and authentication (EU region).
Cloudflare Inc. — CDN, security, AI processing, and file storage.
Google LLC — AI companion via Gemini and OAuth authentication.
Groq Inc. — AI processing.
Stripe Inc. — payment processing.
Meta Platforms Inc. — WhatsApp Business API for parent notifications.

A full sub-processor list is available upon request at legal@altusprep.com.

8. Cookies & Tracking

Essential: Supabase auth session cookies and Cloudflare Turnstile security cookies.
Functional: altus_consent cookie (cookie preference storage, 150-day expiry).
Third-party: Google OAuth (if signing in with Google) and Stripe (payment processing).

We do not use advertising or behavioral tracking cookies. Selecting “Essential Only” in the cookie banner disables all non-essential cookies.

9. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users via email within 72 hours of discovery. Where applicable, we will also notify the UAE supervisory authority and the UK Information Commissioner’s Office (ICO) in accordance with regulatory requirements.

10. Your Rights

Under UAE Law No. 45, you have the right to access, correct, or request the deletion of your personal data. To exercise these rights, please contact our Data Protection Officer at legal@altusprep.com.