Privacy Policy

1. INTRODUCTION & PURPOSE

AMCAcademic ("Platform", "we", "us", "our") is operated by DAFNE TECHNOLOGIES, a New Zealand- based company. This Privacy Policy explains how we collect, use, store, protect, and share your personal data when you access, register for, or use our platform, website, mobile app, and related services. We are committed to protecting your privacy and being transparent about our data practices. This Privacy Policy applies to all users in all jurisdictions including New Zealand, Australia, United Kingdom, European Union, India, United States, and internationally. By accessing AMCAcademic, you consent to the data practices described in this Privacy Policy. If you do not agree with our practices, please do not use the platform. This policy is incorporated into and forms part of our Terms of Service.

2. INFORMATION WE COLLECT

2.1 Account Information: When you create an account, we collect: email address, username, password (encrypted/hashed, never stored in plain text), full name (optional), country of residence, age confirmation (18+), and account creation date.

2.2 Payment Information: When you make a subscription payment, we collect: subscription plan selected, payment date, amount paid, currency, payment method type (e.g., credit card, PayPal). Payment data is processed by PCI-DSS compliant third-party providers (Stripe, PayPal). We do NOT directly store full credit card numbers, CVV, or complete payment card details.

2.3 Learning & Activity Data: We collect: quiz scores, time spent on questions, topics studied, practice patterns, mock exam results, learning progress analytics, percentage completion of content, weak areas identified by the algorithm. This data is used to personalize your learning experience and provide recommendations.

2.4 Usage & Technical Data: We collect: IP address, device type (desktop/mobile/tablet), operating system, browser type and version, pages visited, time on site, referring website, error logs, crash reports, clickstream data, search queries within the platform. This helps us improve performance, security, and user experience.

2.5 Communication Data: If you contact us via email, support form, or chat, we collect and retain: your message content, timestamp, email address, any attachments. This is used for customer support, complaint resolution, and service improvement.

2.6 Cookies & Tracking Data: We use cookies and similar technologies (local storage, pixels, beacons) to track: session information, user preferences, login status, analytics, user behavior patterns. See Section 9 for detailed cookie information.

2.7 AI & Astra Data: When you interact with Astra AI tutor, we collect: your questions, the AI's responses, interaction history, topics you ask about. This data is used to improve the AI and provide better responses. Astra may store anonymized versions of interactions for AI training and improvement purposes. See Section 10 for details.

2.8 What We Do NOT Collect: We do NOT intentionally collect: real patient data, medical records, government ID numbers, biometric data (fingerprints, facial recognition), financial information beyond payment processing, data from users under 18 years old, sensitive health data (HIV status, genetic information) unless voluntarily provided by adult users. Users should NOT enter this data into the platform.

3. HOW WE USE YOUR INFORMATION

3.1 Platform Operations: We use your data to: provide access to the platform, manage your account, processpayments and refunds, verify your identity, communicate important platform updates, maintain platform security, comply with legal obligations.

3.2 Personalization & AI: We use your learning data to: customize your learning experience, identify your weak areas, provide personalized question recommendations, track your progress, generate performance analytics, train and improve Astra AI (using anonymized data).

3.3 Customer Support: We use communication data to: respond to your inquiries, resolve issues and complaints, provide technical support, improve our support processes.

3.4 Analytics & Improvement: We use technical and usage data to: understand how users interact with the platform, identify technical issues and bugs, optimize platform performance, improve features and content, conduct research on exam preparation effectiveness. Analytics data is typically anonymized and aggregated.

3.5 Marketing & Communications (Optional): If you consent, we may use your email address to: send educational content, announce new features, share exam tips and resources, notify you of special offers or pricing changes. You can opt out of marketing emails at any time by clicking "Unsubscribe" in any email or contacting support@amcacademic.com. We will NOT send marketing emails without your consent (except transactional emails about your account).

3.6 Legal Compliance: We may use your data to: comply with legal obligations, respond to lawful requests from authorities, enforce these Terms and our Disclaimer, protect the platform and user safety, investigate fraud or security breaches.

3.7 Data Anonymization: We regularly anonymize data for analytics, research, and AI improvement purposes. Anonymized data cannot be linked back to you and is not subject to data protection laws.

4. DATA SHARING & THIRD PARTIES

4.1 Third-Party Service Providers: We share data with essential third-party services:
(a) Payment Processors (Stripe, PayPal): Full name, email, transaction details, subscription plan, payment amount. Used for payment processing only.
(b) Hosting Providers (AWS, Google Cloud): Anonymized usage data, account information, learning analytics. Used for platform infrastructure and security.
(c) Analytics Platforms (Google Analytics): Anonymized behavioral data, device information, pages visited, session duration. Used for understanding user engagement.
(d) Customer Support Tools (Zendesk or similar): Email, name, support messages. Used for ticket management and support.
(e) Email Service Providers (SendGrid or similar): Email address, communication preferences. Used for sending emails.

4.2 Data Processing Agreements: All third-party vendors are required to sign Data Processing Agreements (DPAs) ensuring they: protect your data with industry-standard security, use data only for the purpose we specify, comply with applicable data protection laws (GDPR, NZ Privacy Act, etc.), delete data when no longer needed, notify us of data breaches.

4.3 Legal Disclosure: We may disclose your data to: law enforcement agencies if required by court order, subpoena, or legal process, government authorities for national security reasons, other parties where necessary to protect our legal rights or user safety. We will provide notice when possible unless prohibited by law.

4.4 No Sale of Personal Data: We do NOT sell your personal data to third parties for marketing or commercial purposes. Your data is not bought or sold on data markets.

5. DATA STORAGE & SECURITY

5.1 Data Location: Your data is primarily stored on servers located in the United States/Australia (via AWS Cloud hosting providers). By using AMCAcademic, you consent to your data being stored and processed in these locations.

5.2 Encryption & Protection: We implement industry-standard security measures:
(a) HTTPS/TLS encryption for all data transmission between your device and our servers (end-to-end encrypted).
(b) Password hashing using bcrypt or similar cryptographic algorithms. Passwords are never stored in plain text.
(c) Database encryption at rest for sensitive data.
(d) Firewall protection and DDoS mitigation.
(e) Regular security audits and penetration testing.
(f) Access controls limiting employee access to sensitive data.
(g) Secure key management for encryption keys.

5.3 Data Retention Periods:
(a) Account Data: Retained while your account is active. After account deletion, retained for 30 days then permanently deleted (except where required by law).
(b) Payment Data: Retained for 7 years for tax and legal compliance (Australian Taxation Office, NZ IRD requirements).
(c) Learning/Activity Data: Retained for platform improvement. Anonymized after 2 years.
(d) Communication Data: Retained for 2 years then deleted (unless required by law).
(e) Technical Logs: Retained for 90 days then deleted.
(f) Cookies: Most expire after 1-2 years; you can delete them anytime.
(g) AI Training Data: Anonymized data may be retained indefinitely for AI improvement.

5.4 No Guarantee of Security: While we implement reasonable security, no system is 100% secure. We cannot guarantee protection against all cyber attacks, sophisticated hackers, or unforeseen breaches. Users assume inherent risk when using any online platform.

5.5 Breach Notification: If a data breach occurs that impacts your personal data, we will:
(a) Notify affected users within 72 hours (as required by GDPR) or as soon as practicable.
(b) Notify relevant regulatory authorities where required by law.
(c) Provide details about the breach, data affected, and steps we're taking.
(d) Offer credit monitoring or similar remedies if appropriate.

6. YOUR DATA RIGHTS

To exercise any of the following rights, email support@amcacademic.com with the appropriate subject line and proof of your identity.

6.1 Right to Access: You have the right to request a copy of your personal data that we hold. To exercise thi right, email support@amcacademic.com with subject line "Data Access Request" and proof of your identity. We will respond within 30 days with your data in a portable format (e.g., CSV, JSON).

6.2 Right to Correction: If your data is inaccurate, incomplete, or outdated, you have the right to request correction. Email support@amcacademic.com with "Data Correction Request" and describe what needs correcting. We will update within 14 days.

6.3 Right to Deletion (Right to Be Forgotten): You have the right to request deletion of your personal data. Email support@amcacademic.com with "Data Deletion Request". We will delete personal data within 30 days, except where we must retain it for legal, tax, or security reasons. Anonymized data is not subject to deletion.

6.4 Right to Data Portability: You have the right to receive your data in a portable, structured format (e.g., CSV, JSON) suitable for transfer to another service. Email support@amcacademic.com with "Data Portability Request". We will provide within 30 days.

6.5 Right to Object to Processing: You have the right to object to certain uses of your data (e.g., marketing, analytics, profiling). Email support@amcacademic.com with "Objection to Processing" and specify which processing you object to. We will stop the objectionable processing where feasible.

6.6 Right to Restrict Processing: You have the right to request that we restrict use of your data (i.e., we store it but do not actively use it) while you verify accuracy or investigate misuse.

6.7 Automated Decision-Making: Our AI system may make automated decisions about quiz difficulty, topic recommendations, or personalization. You have the right to request human review of automated decisions that significantly affect you.

6.8 GDPR Rights (EU Users): If you are in the EU, you have all rights listed above plus: Right to lodge complaints with your national Data Protection Authority, Right to withdraw consent at any time (does not affect prior processing), Right to object to automated profiling.

6.9 CCPA Rights (California Users): If you are in California, you have the right to: Know what personal data is collected, Know how your data is used, Know if your data is sold (it is not), Delete your data, Opt out of data sales.

6.10 NZ Privacy Act Rights: If you are in NZ, you have the right to request your personal information, correct inaccurate information, and lodge complaints with the Privacy Commissioner.

6.11 How to Submit Requests: All data rights requests should be submitted to: support@amcacademic.com with the specific request type in the subject line. Include your full name, email, and account ID if applicable. We will respond within 30 days (or as required by law). Requests may require identity verification for security.

7. INTERNATIONAL DATA TRANSFERS

7.1 Cross-Border Data Flow: AMCAcademic is based in New Zealand and globally accessible. Your data may be transferred to, stored in, and processed in: New Zealand (primary), Australia, United States, United Kingdom, and other countries where our service providers operate. Different countries have different data protection laws.

7.2 GDPR Compliance (EU Users): If you are in the European Union, your data is protected under the General Data Protection Regulation (GDPR). We ensure transfers to countries outside the EU comply with GDPR Article 44-49 through:
(a) Standard Contractual Clauses (SCCs) with third-party processors.
(b) Data Processing Agreements (DPAs) requiring GDPR compliance.
(c) Adequacy decisions where applicable. By using our platform, you acknowledge and consent to cross-border transfers of your data in accordance with GDPR requirements.

7.3 International Data Transfers: We comply with applicable data protection laws in: New Zealand (Privacy Act 2020, Privacy Principles), Australia (Privacy Act 1988), United Kingdom (Data Protection Act 2018, GDPR-equivalent), European Union (GDPR), India (Personal Data Protection Bill when applicable), United States (CCPA for California, state laws).

7.4 Adequacy of Protections: Even where data is transferred internationally, we ensure adequate protections through encryption, contractual obligations, and compliance with all applicable laws.

8. CHILDREN & AGE RESTRICTIONS

8.1 Minimum Age Requirement: AMCAcademic is intended for users 18 years of age or older (or the age of legal majority in your jurisdiction). We do not knowingly collect, use, or disclose personal data from children under 18 years old.

8.2 Age Verification: During account registration, you must confirm that you are at least 18 years old. By confirming, you represent that this is accurate. False age representation may result in account termination.

8.3 Data from Minors: If we become aware that we have collected data from a user under 18 years old, we will:
(a) Immediately notify the user and/or parent/guardian.
(b) Delete the data within 30 days.
(c) Terminate the account if appropriate.

8.4 Parental Contact: Parents or guardians who believe their child has provided data to us should contact support@amcacademic.com immediately. We will cooperate in protecting children's privacy.

8.5 COPPA Compliance (US): For users under 13 in the United States, we comply with the Children's Online Privacy Protection Act (COPPA) by not knowingly collecting data from children under 13 and requiring parental consent for any data collection from children 13-17.

9. COOKIES & TRACKING TECHNOLOGIES

9.1 What Are Cookies: Cookies are small text files stored on your device (computer, phone, tablet) that contain information about your browsing activity, preferences, and login status.

9.2 Types of Cookies We Use:
(a) Session Cookies: Keep you logged in while using the platform. Expire when you close your browser.
(b) Persistent Cookies: Remember your preferences and login information across sessions. Stored for up to 2 years.
(c) Preference Cookies: Remember your language, theme (light/dark mode), accessibility settings.
(d) Analytics Cookies: Track usage patterns for Google Analytics. Help us understand how users interact with the platform.
(e) Marketing Cookies (Optional): Used only if you consent. Track your interaction with marketing emails and ads.

9.3 Analytics Providers: We use Google Analytics to collect: Pages visited, time on page, user flow, device information, geographic location, traffic sources. This data is anonymized and aggregated. You can opt out at https://tools.google.com/dlpage/gaoptout.

9.4 Cookie Consent:
(a) Essential Cookies: Session and login cookies are required for platform functionality. Used without explicit consent.
(b) Non-Essential Cookies: Analytics and marketing cookies require your consent. On first visit, we will display a cookie consent banner asking you to accept or reject non-essential cookies. You can change your cookie preferences at any time in your account settings.
(c) How to Manage Cookies: Most browsers allow you to disable cookies in settings. Be aware that disabling cookies may affect platform functionality (e.g., you may need to log in repeatedly). You can also delete existing cookies from your browser settings.

9.5 Third-Party Tracking: Third-party analytics providers (Google, etc.) may set their own cookies. We are not responsible for third-party cookies. Refer to third-party privacy policies for their cookie practices.

9.6 Do Not Track: Some browsers include a "Do Not Track" (DNT) signal. We do not respond to DNT signals, but we do respect your cookie preferences if you have opted out of tracking cookies.

10. ARTIFICIAL INTELLIGENCE & ASTRA DATA

10.1 How Astra Uses Data: When you interact with Astra AI tutor, we collect: your questions, the AI's responses, interaction history, topics you inquire about, your learning patterns. This data is used to:
(a) Provide better, more personalized responses from Astra.
(b) Improve Astra's accuracy and educational value.
(c) Identify topics users struggle with.
(d) Train future versions of Astra using anonymized data.

10.2 Anonymization for AI Training: Astra may store anonymized versions of your interactions (with personally identifying information removed) for AI training and improvement purposes. This anonymized data:
(a) Cannot be linked back to you.
(b) Is protected under anonymization standards.
(c) May be retained indefinitely for AI improvement.
(d) Is subject to robust security measures.

10.3 AI Limitations & Transparency: You acknowledge that:
(a) Astra is an AI system with inherent limitations.
(b) Astra may generate inaccurate, incomplete, or misleading information.
(c) Astra's responses should be verified before reliance.
(d) Your data is used to train the AI, which may improve responses for other users.
(e) Interactions may be reviewed by our team for quality assurance and improvement.

10.4 Opting Out of AI Training: If you do NOT want your data used to train Astra, email support@amcacademic.com with "Opt Out of AI Training". We will flag your account to exclude your data from AI training purposes. This does not affect your ability to use Astra; it only prevents your data being used for AI improvement.

10.5 AI Transparency Reports: We commit to publishing transparency reports (at least annually) describing: how much data is used to train Astra, how Astra's accuracy has improved, any changes to AI practices, user feedback on AI.

11. CHANGES TO THIS PRIVACY POLICY

11.1 Updates & Modifications: We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. Changes will be effective as of the "Last Updated" date shown at the top of this policy.

11.2 Notification of Changes: For material changes (those that significantly affect your privacy), we will:
(a) Notify you via email at least 30 days before the change takes effect.
(b) Post a prominent notice on our website and/or platform.
(c) Require you to re-consent to the updated policy if required by law.

11.3 Continued Use: Your continued use of AMCAcademic after changes are posted constitutes your acceptance of the updated Privacy Policy. If you do not accept changes, you may delete your account and discontinue use.

11.4 Archiving: We maintain a version history of this Privacy Policy. You can request previous versions by contacting support@amcacademic.com.

12. CONTACT INFORMATION & COMPLAINTS

12.1 Privacy Inquiries: For questions about this Privacy Policy, your data, or our privacy practices:
Email: support@amcacademic.com
Response Time: 30 days

12.2 Data Deletion/Access/Correction Requests: Email support@amcacademic.com with the appropriate subject line (Data Deletion Request / Data Access Request / Data Correction Request). Include your full name, email address, and account ID if applicable. Response time: 30 days.

12.3 General Support: Email support@amcacademic.com. Response time: 5-10 business days.

12.4 Complaints & Escalation: If you believe we have violated your privacy rights, you have the right to lodge a complaint with the appropriate regulatory authority in your jurisdiction:
(a) New Zealand: Privacy Commissioner (https://www.privacy.org.nz/)
(b) Australia: Office of the Australian Information Commissioner (https://www.oaic.gov.au/)
(c) United Kingdom: Information Commissioner's Office (https://ico.org.uk/)
(d) European Union: Your National Data Protection Authority
(e) India: Data Protection Authority (once Personal Data Protection Bill is fully effective)
(f) United States (California): California Attorney General (if you are a California resident)

You also have the right to lodge a complaint with us first: Email support@amcacademic.com with subject "Privacy Complaint". Include details of the alleged violation, dates, and your desired resolution. We will respond within 10 business days and work to resolve the issue.

12.5 Legal Representation: If you wish to have legal representation in privacy matters, you may contact us with your attorney's contact information and we will work with them on your behalf.

© 2026 DAFNE TECHNOLOGIES. All rights reserved.
Based in New Zealand | Globally Accessible
Effective: 16 April 2026