Privacy Policy

SHSATlab is built for NYC middle school students (typically ages 11–14) preparing for the SHSAT. Accounts are created by a parent or legal guardian, who provides consent for any student under 13, in line with COPPA.

We do not knowingly collect personal information directly from children under 13 without verifiable parental consent. If we learn we collected data from a child under 13 without consent, we will delete it promptly. Contact hello@shsatlab.com if you believe this has happened.

Account information (from the parent)

• Parent email address and password
• Student first name, grade, and target SHSAT score
• School name and study preferences (optional, during onboarding)

Usage and practice data

• Practice answers, scores, and streaks
• Diagnostic test responses and estimated scaled scores
• Study plan progress and completed units
• AI tutor (Iko) conversation history per session

Automatically collected information

• Browser, operating system, and device type
• Pages visited, session duration, and referral source
• IP address (anonymized before storage)

Payment information

Subscriptions are processed by a third-party payment processor. We do not store full card numbers on our servers. Payment data is governed by that processor's own privacy policy.

• Provide and personalize the Service — study plans, adaptive practice, and progress tracking
• Improve the platform — aggregate analytics to improve questions and learning outcomes
• Communicate with you — account emails and, with consent, product updates
• Keep the platform safe — fraud and abuse prevention
• Meet legal obligations — COPPA, student-privacy laws, and valid legal requests

We do not sell personal information or use student data for advertising profiles.

We work with trusted third-party service providers to operate the Service. These providers act on our behalf and are contractually required to protect your information. We do not sell your data to any third party.

• Authentication & database — stores account credentials and practice data securely in the cloud
• Analytics — aggregated, anonymized usage data to understand how the platform is used; no personally identifiable student data is shared
• AI content services — generates practice questions and tutor responses; data submitted through our API is not used to train third-party AI models under our service agreements
• Payment processing — handles subscription billing; we never store full card numbers on our servers
• Cloud hosting & infrastructure — servers and deployment infrastructure located in the United States

If you have questions about a specific provider or wish to exercise data rights, contact hello@shsatlab.com and we will respond within 30 days.

If your child is under 13, you may:

• Review personal information we hold about your child
• Request deletion of your child's information
• Refuse further collection or use of your child's data

Email hello@shsatlab.com from the parent address on the account. We respond within 30 days.

We keep account and practice data while your account is active. After deletion, we remove or anonymize personal information within 30 days, except where law requires retention.

We use industry-standard encryption in transit and at rest, secure authentication, and role-based access controls. No online system is 100% secure; we cannot guarantee absolute security.

We use session cookies for login and analytics cookies for aggregate usage. You may disable cookies in your browser, but some features may not work correctly.

New York: We follow NY student data privacy guidelines and applicable state education laws.

California: California residents have CCPA rights (know, delete, opt out of sale). We do not sell personal information.

We may update this policy and will notify registered users of material changes by email or in-app notice. Continued use after the effective date means you accept the updated policy.

• Email: hello@shsatlab.com
• Mailing address: 1718 Capitol Ave, Cheyenne, WY 82001-4528
• Website: shsatlab.com