Scope and our role
This Privacy Policy applies to the Module Prep websites, the mod web and mobile applications, and related support, practice, reporting, calendar, and account services (collectively, the “Service”). It does not apply to a tutoring center's practices outside the Service or to third-party services governed by their own policies.
A tutoring center or other organization that provides your account (a “Center”) decides which authorized users participate and how it uses student records in mod. Module Prep processes that information to provide the Service to the Center and under the applicable agreement. For an account obtained directly from Module Prep, Module Prep determines the purposes described in this policy. If your Center's notice or agreement gives you additional rights, that notice or agreement also applies.
Information we collect
Account and relationship information
We collect information used to provision and secure accounts, such as name, email address, role, Center affiliation, tutor assignments, parent or guardian links, invitation and onboarding status, grade level, timezone, exam goal, test date, and account preferences.
Practice and learning evidence
We collect assignments, question responses, correctness, completion, elapsed time, confidence, flags, review and explanation activity, repeated attempts, skills and concepts, validated misconception signals, recommendations, staff decisions, progress, and related outcomes. We also preserve the question, curriculum, and policy versions needed to explain how a result or recommendation was produced.
Center operations and submitted material
Centers and authorized users may provide schedules, attendance, tutor or manager notes, quality reports, support messages, external-test records, materials, pasted examples, or private screenshots. Test-event operations may record readiness, stage progress, save health, connection state, page visibility, timing adjustments, and staff-authored incidents. The Service does not use webcam or microphone capture, screen recording, hidden device fingerprinting, or automated misconduct scoring for those events.
Device and usage information
When you use the Service, we may receive IP address, browser and device type, operating system, referring page, timestamps, authentication and security events, page or feature activity, and essential cookie or local-storage identifiers. The public marketing site does not read student or Center product data.
Billing and integrations
If paid features are offered to you, we may receive subscription status, billing contact details, Stripe customer or transaction identifiers, payment status, and limited payment-method descriptors. Stripe processes full payment credentials; Module Prep does not store bank account or routing numbers. If authorized staff connect Google Calendar, we receive the connected account identifier and email, encrypted authorization credentials, app-created calendar and event identifiers, and sync status. The integration is limited to calendars the Service creates and exports privacy-minimized session blocks rather than student learning evidence.
Sources
We collect information from you, your Center and its authorized staff, a linked parent or guardian, other authorized users, your device, and service providers that help deliver authentication, hosting, payments, communications, calendar connection, and security.
How we use information
We use personal information to:
- provide, authenticate, secure, maintain, and support the Service;
- deliver assigned practice and deterministically grade responses;
- identify skill, concept, timing, confidence, completion, and review patterns;
- produce explainable next-assignment recommendations and let authorized staff inspect, modify, pause, or override them;
- show role-appropriate student, parent, tutor, manager, and Center reports;
- operate tutoring schedules, test events, account invitations, integrations, licensing, and billing;
- investigate errors, abuse, security events, content quality, and support requests;
- improve content and recommendation policies using de-identified or privacy-thresholded measurements where appropriate; and
- comply with law, enforce agreements, and protect users, Centers, Module Prep, and others.
Artificial intelligence may help draft narrative summaries or generate and critique educational content only within controlled workflows. AI does not determine answer correctness or silently change recommendation policy. Content-generation requests are designed to exclude student identity, Center identity, raw answers, private notes, confidence history, and timing history. Module Prep does not use personal learning evidence for targeted advertising or to train general-purpose AI models.
Google Account and Calendar data
This section describes all access, storage, use, sharing, retention, and deletion of data received from Google APIs when an authorized Center staff member chooses to connect Google Calendar.
Data and access
Module Prep requests the Google openid and email scopes to identify the connecting Google account and the calendar.app.created scope to create and manage a secondary calendar named mod. This least-privilege scope permits access only to calendars created by the Module Prep application. Module Prep does not request access to, read, import, or modify the user's primary calendar or other calendars, and it does not import Google-side edits into mod.
Storage and protection
Module Prep stores the Google account ID and email, the app-created calendar ID and name, granted scopes, connection and sync status, error and sync timestamps, encrypted OAuth access and refresh tokens, and identifiers that map a mod tutoring session to its exported Google event. OAuth tokens are encrypted at the application layer and these records are restricted to server-side service access. Module Prep does not store unrelated Google Calendar event data.
Use and actions taken
Google data is used only to authenticate the connection, create the private app-created calendar, and create, update, or delete privacy-minimized event blocks when an authorized mod tutoring session changes. Exported events use a generic title and may include the session time and timezone, delivery format, location or meeting link, and a signed-in link back to mod. They exclude student names and identities, agendas, materials, attendance, outcomes, staff notes, answers, recommendations, and other learning evidence.
Sharing and prohibited uses
Module Prep transmits the event data described above to Google at the connecting user's direction and allows infrastructure providers to process encrypted connection records only as needed to operate and secure the integration. Module Prep does not sell Google user data, use it for advertising, transfer it to data brokers, use it to determine creditworthiness, or use it to train or improve generalized AI or machine-learning models. Module Prep's use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Disconnecting, retention, and deletion
A connected user can select Disconnect in mod at any time. Module Prep then asks Google to revoke authorization, clears the stored access and refresh tokens and token-expiration value, deletes pending sync jobs, and stops future synchronization. Revoking Module Prep from the user's Google Account also stops API access; selecting Disconnect in mod clears the tokens retained by Module Prep. Existing events and the app-created mod calendar remain in Google Calendar until the user deletes them there.
After disconnection, Module Prep may retain a disconnected connection record, account and calendar identifiers, event-mirror identifiers, and limited sync or error history for security, audit, and troubleshooting purposes. A user may request deletion of retained Google connection metadata by emailing hello@moduleprep.com. We will verify the requester and delete or de-identify the data unless continued retention is required for security, legal, contractual, or dispute-resolution reasons. Google data is not retained longer than needed for the user-facing integration and those limited obligations.
Students and children
mod is designed for serious test preparation used with tutoring-center and family oversight. Module Prep does not offer children under 13 a public, self-service account-creation path. A child under 13 may use the authenticated Service only after Module Prep and the responsible Center, parent, or guardian have completed the notice, authorization, and consent steps required for that account.
For a Center-provided account, the Center is responsible for giving Module Prep accurate age or consent context when required, providing appropriate notices, and obtaining permissions it is legally authorized to obtain. Module Prep uses a child's information to provide the educational Service, not for targeted advertising. We do not ask students to publicly post personal information, and we limit access through account roles and Center relationships.
A parent or guardian may ask to review, correct, delete, or stop further collection of a child's personal information by contacting the Center that provided the account and hello@moduleprep.com. We will verify the requester's identity and authority, coordinate with the Center where applicable, and respond as required by law. If you believe a child under 13 is using the Service without the required authorization or consent, contact us promptly so we can restrict the account and investigate.
Retention and security
We retain information for as long as needed to provide the Service, maintain trustworthy academic and audit records, meet a Center's instructions and contractual requirements, resolve disputes, protect security, and comply with law. Retention periods vary by record type and account relationship. High-volume operational events may be retained for less time than finalized learning evidence. When information is no longer needed, we take reasonable steps to delete or de-identify it.
We use administrative, technical, and organizational safeguards designed to protect personal information, including role-based access, tenant boundaries, encrypted transport, restricted service credentials, and audit records. No system is perfectly secure, and we cannot guarantee absolute security. Please protect your credentials and notify us if you suspect unauthorized access.
Your choices and rights
Depending on your location and relationship with Module Prep, you may have rights to access, correct, export, delete, restrict, or object to certain processing of personal information, and to appeal a request decision. You may also disconnect an optional integration or change available account preferences.
If your account was provided by a Center, contact that Center first because it controls many account and student-record decisions. You may also email hello@moduleprep.com. Direct users can submit available export or deletion requests in the Service or by email. We may verify your identity and authority, and legal, security, contractual, or record-integrity obligations may limit a request. We will not discriminate against you for exercising an applicable privacy right.
Essential authentication, security, and preference technologies are required for the Service to function. We do not currently use advertising cookies on the Service.
International use
The Service is operated from the United States. If you access it from another country, information may be processed in the United States or other locations where Module Prep's service providers operate, which may have different data-protection laws. We use appropriate safeguards where required.
Changes and contact
We may update this policy as the Service or legal requirements change. We will update the date above and provide additional notice when a change is material or when law requires consent.
Privacy questions or requests
Module Prep LLC
For a Center-provided account, please include the Center name and your relationship to the student, but do not email passwords, payment credentials, or sensitive practice records.