Policy
Privacy Policy
RichiePrep is an online SSAT and ISEE practice-test service used by students around the world, most of them minors. This policy says exactly what we collect, why we are allowed to, and what you can make us do about it. Plain terms, no hidden clauses.
Who is responsible
RichiePrep is the controller of the personal data described here. Questions, requests and complaints: privacy@richieprep.com. We answer data requests within 30 days.
Accounts: the two ways in
You can create an account with an email address and a password, or with Sign in with Google. Both produce the same account and you can add the other method later from the Account page.
When you use Google, we receive only your Google account identifier, your email address, whether Google has verified that address, and your display name. We never receive or ask for your Google password, and we request no access to Gmail, Drive, Contacts or any other Google service. Removing the link from your Account page ends that connection.
Because an email address can be claimed before its owner arrives, one rule matters: if someone had already registered a password account under your address without ever confirming it, and you then sign in with Google having proved to Google that the mailbox is yours, we give you the account and switch that unconfirmed password off. We tell you when this happens.
What we collect
| Category | What it is | Why we hold it |
|---|---|---|
| Account | Email address, display name or nickname, country, password (stored only as a salted scrypt hash), linked Google identifier. | To create the account, sign you in, and apply the right children’s-privacy rules for where you live. Necessary to provide the service you asked for. |
| Student profile | A nickname, an optional grade level, and the year of birth. We ask you not to enter a full legal name, and we never ask for a full date of birth. | To separate one student’s work from another’s and to decide whether guardian permission is required. |
| Practice work | Answers, timings, flags, section progress, written responses, the reports built from them, and progress in the word games. | This is the service — a report that names your next step cannot exist without it. |
| Consent records | Which consent, which policy version, granted or declined, how it was captured, and when. | To prove we asked and you answered. Keeping this record is itself a legal obligation. |
| Guardian permission | The guardian’s email address, and their decision with its timestamp. | Required before a student under the age of consent can use the service. |
| Commerce | Orders, entitlements and payment events; the country of residence you choose at checkout; when and from which IP address you accepted the Refund Policy at checkout, and which version; and for each paid test, when it was first opened, from which IP address, and that the notice before it was confirmed. Card numbers never reach our servers. | To give you the access you bought, to apply the refund rules of your country of residence, to keep the transaction records the law requires of a seller, and as evidence if a payment is disputed. |
| Support and help chats | Messages you send through the Contact page or by email and our replies; messages typed into the help assistant and its replies, with the page and the time. | To answer you, to hand a chat to a person when you ask, and to keep the record of an order or refund conversation the law requires. See the help assistant and support messages below. |
| Technical | Three strictly necessary cookies (session, selected profile, and a 30-minute sign-up cookie), the local-storage items listed under Cookies below, and server logs. | To keep you signed in, keep the test player working, and notice when saving breaks mid-test. |
What we deliberately do not do
- No advertising pixels, ad SDKs, or third-party trackers of any kind.
- No sale or sharing of personal information, under any definition, for any price.
- No profiling or automated decision-making with legal or similarly significant effects.
- No marketing email to a student who is under the age of consent where they live — the opt-in is not even offered.
- No public display of a student’s work, scores or profile.
- No use of student practice data to train models or to build products for anyone else.
- No use of help-assistant chats or support messages to train AI models — by us or by anyone we work with.
Legal bases
Where the GDPR or UK GDPR applies: account, profile and practice data are processed to perform the contract you entered into; consent records and transaction records are kept to meet a legal obligation; security logging rests on our legitimate interest in keeping accounts safe; marketing email and the use of the service by a child below the age of digital consent rest on consent, which you can withdraw at any time. Withdrawing consent does not affect processing already carried out. Support messages and help-assistant chats are processed because you asked us something, and in our legitimate interest in answering it well and keeping the service safe; records of order and refund conversations are kept to meet a legal obligation.
Children and guardian permission
Below the age of digital consent where the student lives — 13 in the United States and the United Kingdom, 14 in Korea and China, 18 in India, 12 in Brazil, 10 in Thailand, 13 to 16 across the EEA, and 13 anywhere else — a parent or guardian must give permission before any practice work is recorded. Until that permission arrives we hold only what the request itself needs — the profile’s nickname, grade and birth year, and the guardian’s email address — and no answers, timing or results. A profile that is refused or never confirmed can be deleted by the account holder at any time, and is deleted with the account. The full mechanics, including how a guardian withdraws permission, are in the Children’s Privacy notice.
The help assistant
The Help button in the corner of our public pages opens a help assistant. It is a computer program, not a person: it finds the help articles that match your question and shows what they say, with a link to each. The replies are picked from our help articles by the site itself, and your messages are not sent to any other company to write them. It tells you this before you type anything. It can make mistakes, and our published policies apply if anything it says differs from them.
- What is processed: the messages you type, the replies, the page you were on when you asked, and the time. The page holds a chat identifier only while it is open, so the conversation can continue — nothing is stored in your browser and no cookie is set. To limit how many messages one visitor can send, your internet address is held as a short-lived counter, cleared within two days; the chat itself keeps only a one-way code made from it.
- What it is used for: only to answer you, to hand the conversation to a person if you ask for one, and to keep the service secure. If you are signed in, the chat is linked to your account so a person can follow it up — except for a student below the age of digital consent, whose chat is never linked.
- What it cannot do: it cannot see your account, your orders or your practice results, and it cannot change anything. A person decides anything about payments, refunds, accounts or personal data; the assistant points you to the right page or to a person.
- What it is not used for: no profiling and no advertising, and your chats are never used to train any model.
- Please don’t type personal details — your name, email address, phone number, school, where you live, or anything about health. Email addresses and phone numbers we detect are removed before a message is stored.
- How long: a chat is deleted 30 days after its last message. A chat with a student below the age of digital consent, or with anyone who tells the assistant they are under 13, is deleted within one day. “Delete this chat” in the panel removes it from our records at once.
- If someone may be in danger: a message that suggests it gets a fixed reply with crisis lines, written by people in advance, and the chat is flagged so that a person at RichiePrep reads it.
Support messages
When you write to us through the Contact page or by email, we keep the conversation — your messages, our replies, and the address to reply to — so we can answer you and put things right.
- How long: a conversation about an order, a refund or a complaint is kept for 3 years after it is closed, because Korea’s e-commerce consumer-protection act requires a seller to keep those records. Any other conversation is kept for 12 months after it is closed, and spam is deleted after 30 days.
Who processes data for us
We keep the list short on purpose. Each acts only on our instructions under a data-processing agreement, and none may use your data for its own purposes or to train AI models.
| Role | Company | Country | What it does | Data it receives | When it receives data |
|---|---|---|---|---|---|
| Hosting | Render Services, Inc. Render (a web service with a persistent disk, in its Virginia region) | United States (Virginia) | Runs the website and stores its database. | Everything the site keeps: account and student-profile details, practice work and reports, orders, support messages and help chats. | Always: the website and its database run on its servers. |
| Backups | Backblaze, Inc. Backblaze B2 Cloud Storage (its US East region) | United States (Virginia) | Keeps an encrypted copy of the website's database away from the hosting company, so the site can be restored if its servers or disk are lost. | An encrypted copy of everything the site keeps (the same as Hosting). It is encrypted on our server before it is sent, and Backblaze cannot read it. | Once a day, encrypted, over an encrypted connection. |
| Email delivery | Named here before paid checkout opens | Named with the company | Delivers the emails the site sends: sign-in links, permission requests, confirmations, receipts and replies. | Your email address, and the content of each email we send you. | Whenever we email you. |
| Mailboxes | Named here before paid checkout opens | Named with the company | Receives and keeps the emails you send to our addresses, such as support@richieprep.com and privacy@richieprep.com. | Your email address, your name if you give it, and what you write to us. | Whenever you email us. |
| Payments | Toss Payments Co., Ltd. | Republic of Korea | Takes payments and returns refunds. We never see or store card numbers. | The order number, amount and currency we send it, and what you enter in its payment window, such as your card details. | Only when you buy: you pay in its payment window, over an encrypted connection. |
| Payments by PayPal, through our Toss Payments contract | PayPal: the company is named here before paid checkout opens | Named with the company | Takes PayPal payments and returns their refunds. | The order amount and currency, and what you enter in PayPal's own window. | Only if you choose PayPal at checkout: you pay in PayPal's window, over an encrypted connection. |
| Sign-in | Google LLC Sign in with Google | United States | Confirms who you are if you choose Sign in with Google. | The sign-in itself: Google returns your Google account identifier, your email address, whether Google has verified it, and your display name. | Only if you use it: your browser goes to Google's sign-in page over an encrypted connection, and Google sends us the result. |
Our payment processor handles card details directly; we receive only the outcome and the last four digits. Our email provider delivers sign-in, permission and service messages, and no marketing lists are shared. Google is used only if you choose Sign in with Google, and only for authentication. Write to privacy@richieprep.com with any question about a provider. We update this policy before adding a new kind of provider.
International transfers
Students use RichiePrep from many countries, so data may be processed outside where you live, including in the United States and the Republic of Korea. Where data leaves the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum, and we assess each destination before sending anything there. Ask us and we will send you a copy of the relevant clauses.
Transfer outside Korea
RichiePrep is operated from the Republic of Korea. Where a company above is not named yet, it is named with its country before paid checkout opens, and added here if it is outside Korea. Of the companies named above, these receive personal data outside Korea:
| Recipient | Render Services, Inc. (privacy@render.com) |
|---|---|
| Country | United States (Virginia) |
| When and how | Always: the website and its database run on its servers. |
| What | Everything the site keeps: account and student-profile details, practice work and reports, orders, support messages and help chats. |
| Purpose | Runs the website and stores its database. |
| How long it is kept | For as long as we use the service. What we delete is deleted from the database at once; Render's own daily snapshots of the disk keep a copy for at least seven days. |
| How to refuse | Not possible while you use the site, which runs on these servers. You can delete a student profile or close your account at any time from your Account page. |
| Recipient | Backblaze, Inc. (privacyrequest@backblaze.com) |
|---|---|
| Country | United States (Virginia) |
| When and how | Once a day, encrypted, over an encrypted connection. |
| What | An encrypted copy of everything the site keeps (the same as Hosting). It is encrypted on our server before it is sent, and Backblaze cannot read it. |
| Purpose | Keeps an encrypted copy of the website's database away from the hosting company, so the site can be restored if its servers or disk are lost. |
| How long it is kept | Daily copies for 30 days, and one copy a month for five years, the period Korean law requires order, payment and refund records to be kept. Each copy is then deleted. |
| How to refuse | Not possible while you have an account. When you delete a profile or close your account, it disappears from the copies as they reach the end of the periods above. |
| Recipient | Google LLC |
|---|---|
| Country | United States |
| When and how | Only if you use it: your browser goes to Google's sign-in page over an encrypted connection, and Google sends us the result. |
| What | The sign-in itself: Google returns your Google account identifier, your email address, whether Google has verified it, and your display name. |
| Purpose | Confirms who you are if you choose Sign in with Google. |
| How to refuse | Create your account with an email address and a password instead. A linked Google sign-in can be removed from your Account page. |
How long we keep it
| What | How long |
|---|---|
| Account and student profiles | While the account is open, then erased on closure |
| Practice responses and reports | While the account is open, or until you delete the profile |
| A free test taken without an account | 30 days, unless you save the results to an account |
| Word-game progress | While the account is open; erased when you delete the profile or close the account |
| Written responses (essays) | Erased immediately on profile or account deletion |
| Sign-in sessions | 30 days, or until you sign out |
| Record of the emails we sent you | 90 days |
| Help-assistant chats | 30 days from the last message; one day for a chat with a student below the age of digital consent or anyone who says they are under 13; at once when you press Delete this chat |
| Support conversations about an order, a refund or a complaint | 3 years after the conversation is closed (Korea’s e-commerce consumer-protection act) |
| Other support conversations | 12 months after the conversation is closed; spam, 30 days |
| Permission and sign-in links | Single use; 14 days for guardian permission, shorter for the rest |
| Consent records | Kept after closure, as the proof that consent was properly obtained |
| Orders and payment events | Kept in de-identified form for the statutory bookkeeping period |
| IP addresses on an order (the Refund Policy accepted at checkout, each paid test’s first opening) | With the order while the account is open; erased when the account is closed |
| Security and audit logs | 12 months |
Your rights
Depending on where you live you may have the right to access, correct, delete, restrict or object to processing, to portability, and to withdraw consent. Two of these you can exercise yourself, right now, from the Account page:
- Download my data — a machine-readable copy of everything held for your account.
- Close my account — erases your identifiers and every student profile on it.
A guardian can also withdraw permission for one student, or delete that student’s profile, without closing the account. For anything else, write to privacy@richieprep.com. We never charge for a request and never make you accept a worse service for exercising a right. If you are in the EEA or the UK you may also complain to your national supervisory authority; in Korea, to the Personal Information Protection Commission.
Cookies
We set three cookies — a signed session cookie, a selected-profile cookie, and a short-lived sign-up cookie that exists only while a Google registration completes — plus four items in your browser’s own local storage: a timestamp that keeps the welcome message quiet, the text size you chose for reading passages, your progress in the Final Check word games, and answers a timed section could not send because the connection dropped, held only until they reach us. All are strictly necessary, so none asks for consent, and we run no advertising or analytics trackers. The full inventory is on the Cookies page.
Security
Transport encryption everywhere. Passwords hashed with scrypt and a per-account salt; a Google-only account stores no password at all. Session tokens and permission links are stored only as hashes, so a copy of the database does not let anyone sign in as you. Role-based access control, horizontal-privilege checks on every profile and attempt, audit logging on sensitive actions, and answer keys served only after an authorised, completed attempt.
If a breach is likely to put you at risk, we will tell you and the relevant regulator within the deadlines the law sets — 72 hours under the GDPR.
Changes
Every consent we hold is stamped with the policy version it was given against, so a new version never inherits an old agreement. Material changes are announced on Content updates, by email to account holders, and, where the law requires it, we ask again rather than assume.