Information We Collect
CramHQ may collect account identifiers, name, email, authentication identifiers, path selections, exam goals, onboarding answers, assessment attempts, quiz answers, timing, hint and explanation usage, readiness and Pass Plan activity, flashcards, purchases, payment status metadata, support messages, feedback, device data, log data, product analytics, and masked behavior analytics such as clicks, scroll depth, and session replay on selected product pages when enabled.
For acquisition, reliability, security, and abuse analysis, CramHQ may collect an unmasked IP address, the immediate network peer address, user-agent, request language, Cloudflare request and country signals when received through a trusted proxy, low-entropy browser client hints, a referrer path without its query or fragment, timezone, browser languages, navigation type, touch capability, campaign and advertising click identifiers, and CramHQ anonymous attribution, journey, session, assessment, checkout, and purchase links.
Stripe handles card details. CramHQ does not store full payment card numbers.
How We Use Information
CramHQ uses information to operate the product, personalize assessment and Pass Plan workflows, process purchases, grant access, send transactional emails, provide support, improve reliability, debug issues, prevent abuse, investigate security events, apply rate limits, support country-based checkout behavior, measure acquisition and conversion, and understand product performance.
Network, browser, campaign, and anonymous journey information may be used together to distinguish internal testing, repeated sessions, automated or abusive traffic, and learner journeys. A shared IP or browser signal does not by itself identify a person.
CramHQ may use aggregated, minimized, or operational data to improve content quality, readiness logic, support, and platform reliability.
Service Providers
CramHQ may share limited information with service providers that help operate the platform, including authentication, hosting, database, analytics, payment processing, email delivery, observability, support, and security providers.
Current launch providers may include Auth0 for authentication, Stripe for payments, Brevo for email delivery, hosting and database infrastructure providers, Umami for product analytics, Microsoft Clarity for masked behavior analytics when enabled, and other analytics or observability tools when enabled. This policy update does not add CramHQ anonymous attribution IDs, journey IDs, raw IP addresses, or user-agent values to Microsoft Clarity.
Learning And Generated Content
CramHQ may process learner activity, quiz answers, explanations, support messages, and feedback to generate or improve recommendations, remediation, flashcards, explanations, and quality-review workflows.
Do not submit secrets, passwords, payment card data, live exam content, confidential employer data, or personal data of others.
Email
Transactional emails may include account, assessment claim, Pass Plan, purchase, access, receipt, support, and security messages. These are separate from marketing emails.
Marketing or path-reminder emails are sent only where the product flow records permission or the account preferences allow them. Commercial emails must include an unsubscribe or preference path and required sender identity.
Retention And Security
CramHQ keeps raw acquisition request context, including IP addresses, network peer addresses, user-agent, request language, Cloudflare request identifiers, browser client hints, and query-free referrer paths, in primary attribution storage for up to 180 days. CramHQ then clears those raw fields while retaining linked attribution, learning, checkout, purchase, campaign, country, and derived device records for their applicable operational, billing, security, support, and legal purposes.
Scheduled local backups and scheduled encrypted off-host backups use their documented retention schedules. Manual and pre-migration recovery copies may retain earlier values for longer and may require manual retirement. Before a restored database is returned to routine service, overdue raw acquisition request context must be cleared again.
CramHQ uses technical and operational safeguards, but no system can guarantee perfect security.
No Sale Of Personal Information
CramHQ does not sell personal information. CramHQ may share information with service providers to operate, secure, support, and improve the platform.
Contact [email protected] for privacy or account questions, including requests concerning personal information. Some records may be retained where needed for access, billing, tax, disputes, security, abuse prevention, legal obligations, or recovery integrity.
