Privacy Policy

1. Information we collect

At sign-up, we collect:

• Name, email address, and password (stored as a hash, never in plain text)
• School, graduation status, and — if applicable — year graduated
• Target board exam date
• How you heard about Carnot (e.g. social media, referral)
• Student number, where required by your program

Through your use of the Platform, we also collect:

• Course progress, exam attempts and scores, and study activity
• Payment status and transaction records, processed through our payment partner
• Device session information, used to enforce concurrent-login limits
• If you use the AI Performance Insight feature, a summary of your exam performance is sent to our AI provider to generate a narrative analysis

2. How we use your information

We use your information to:

• Create and maintain your account, and grant access to programs you've paid for
• Show your rank on exam and course leaderboards, using a pseudonymous username by default
• Group performance data by school for aggregate reporting (e.g. school-level analytics)
• Send account, payment, and announcement emails, which you can opt out of individually except for essential account/security notices
• Improve the Platform and respond to support requests
• Detect and enforce against unauthorized sharing or redistribution of Content (see the Terms of Service) — this may include monitoring account access patterns for signs of credential sharing

3. Who can see your information

Your real name is visible to Carnot administrators and, for courses they teach, instructors. On leaderboards, other students see only your pseudonymous username and school — never your real name. Administrators and instructors viewing leaderboards see both your real name and username.

4. Third-party processors

We share limited information with the following third parties strictly to operate the Platform:

• A payment processor, to process program payments and installment plans
• An email provider, to send account and transactional emails
• An AI provider, to generate performance insights, if you use that feature

We do not sell your personal information to third parties.

5. Data retention

We retain account and performance data for as long as your account is active. Deleted accounts are soft-deleted and may be retained for a limited period for record-keeping and legal compliance before permanent removal.

Payment records are retained as required for financial record-keeping, regardless of account status, and are not deleted on request given the no-refund policy in the Terms of Service.

6. Your rights

Under the Data Privacy Act of 2012 (RA 10173), you have the right to access, correct, and request deletion of your personal data, subject to our legal and record-keeping obligations. Some fields, such as School, can only be edited by an administrator on your behalf — contact support to request a change.

7. Security

Passwords are hashed and never stored in plain text. Login sessions are secured via encrypted tokens, and you can review and revoke your own active device sessions from your Profile page at any time.

8. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

9. Contact

Questions about this Policy, or requests regarding your personal data, can be sent to support@carnot-coaching-center.com.