Privacy Policy

1. INTRODUCTION & PURPOSE

AMCAcademic ("Platform", "we", "us", "our") is operated by Dafne Technologies, a New Zealand-based company in Auckland, New Zealand. This Privacy Policy explains how we collect, use, store, protect, and share your personal data when you access, register for, or use our platform, website, mobile app, and related services. We are committed to protecting your privacy and being transparent about our data practices. This Privacy Policy applies to all users in all jurisdictions including New Zealand, Australia, United Kingdom, European Union, India, United States, and internationally. We process your personal data on the legal bases set out in Section 3.8. Where we rely on your consent, we ask for it separately and you may withdraw it at any time; using the platform is not by itself consent to everything described in this policy. If you do not agree with our practices, please do not use the platform. This policy is incorporated into and forms part of our Terms of Service.

2. INFORMATION WE COLLECT

2.1 Account Information: When you create an account, we collect: email address, username, password (encrypted/hashed, never stored in plain text), full name (optional), country of residence, age confirmation (18+), and account creation date.

2.2 Payment Information: When you make a subscription payment, we collect: subscription plan selected, payment date, amount paid, currency, payment method type (e.g., credit card, PayPal). Payment data is processed by PCI-DSS compliant third-party providers (Stripe, PayPal). We do NOT directly store full credit card numbers, CVV, or complete payment card details.

2.3 Learning & Activity Data: We collect: quiz scores, time spent on questions, topics studied, practice patterns, mock exam results, learning progress analytics, percentage completion of content, weak areas identified by the algorithm. This data is used to personalize your learning experience and provide recommendations.

2.4 Usage & Technical Data: We collect: IP address, device type (desktop/mobile/tablet), operating system, browser type and version, pages visited, time on site, referring website, error logs, crash reports, clickstream data, search queries within the platform. This helps us improve performance, security, and user experience.

2.5 Communication Data: If you contact us via email, support form, or chat, we collect and retain: your message content, timestamp, email address, any attachments. This is used for customer support, complaint resolution, and service improvement.

2.6 Cookies & Tracking Data: We use cookies and similar technologies (local storage, pixels, beacons) to track: session information, user preferences, login status, analytics, user behavior patterns. See Section 9 for detailed cookie information.

2.7 AI & Astra Data: When you interact with Astra AI tutor, we collect: your questions, the AI's responses, interaction history, topics you ask about. These records are linked to your account. This data is used to improve the AI and provide better responses. See Section 10 for details.

2.8 What We Do NOT Collect: We do NOT intentionally collect: real patient data, medical records, government ID numbers, biometric data (fingerprints, facial recognition), financial information beyond payment processing, data from users under 18 years old, sensitive health data (HIV status, genetic information). Users must NOT enter this data into the platform. We do not want this information and have no use for it. If you enter any of it, including into an Astra conversation, we will delete it once identified, and entering it does not give us permission to keep or process it. If you believe you have entered patient-identifying information, email support@amcacademic.com and we will remove it.

3. HOW WE USE YOUR INFORMATION

3.1 Platform Operations: We use your data to: provide access to the platform, manage your account, process payments and refunds, verify your identity, communicate important platform updates, maintain platform security, comply with legal obligations.

3.2 Personalization & AI: We use your learning data to: customize your learning experience, identify your weak areas, provide personalized question recommendations, track your progress, generate performance analytics, train and improve Astra AI (see Section 10.4 for how to opt out).

3.3 Customer Support: We use communication data to: respond to your inquiries, resolve issues and complaints, provide technical support, improve our support processes.

3.4 Analytics & Improvement: We use technical and usage data to: understand how users interact with the platform, identify technical issues and bugs, optimize platform performance, improve features and content, conduct research on exam preparation effectiveness.

3.5 Marketing & Communications (Optional): If you consent, we may use your email address to: send educational content, announce new features, share exam tips and resources, notify you of special offers or pricing changes. You can opt out of marketing emails at any time by clicking "Unsubscribe" in any email or contacting support@amcacademic.com. We will NOT send marketing emails without your consent (except transactional emails about your account).

3.6 Legal Compliance: We may use your data to: comply with legal obligations, respond to lawful requests from authorities, enforce these Terms and our Disclaimer, protect the platform and user safety, investigate fraud or security breaches.

3.7 Data Anonymization & Pseudonymization: Where we state that data has been anonymized, we mean it has been aggregated so that no individual record survives and it can no longer be linked to you. Where we remove or replace direct identifiers such as your name, email and account ID but the underlying records remain, that data is pseudonymized rather than anonymized, and we continue to treat it as personal data and protect it accordingly.

3.8 Legal Bases for Processing: We only use your personal data where we have a legal basis to do so. For users in the EU and UK these are the bases in Article 6 of the GDPR and UK GDPR; for users in New Zealand we act in accordance with the information privacy principles in the Privacy Act 2020; equivalent principles apply under the Australian Privacy Act 1988 and the Indian Digital Personal Data Protection Act 2023. Our bases are: (a) Performance of our contract with you: creating and administering your account, giving you access to the question bank and mock exams, adapting difficulty and recommendations to your performance, operating Astra, taking payment and issuing invoices, and responding to your support requests. (b) Legal obligation: keeping financial records, and complying with lawful requests. (c) Our legitimate interests: keeping the platform secure and preventing fraud and account sharing, understanding how the platform is used and improving it, improving Astra's accuracy and educational quality, reviewing a sample of Astra conversations for quality, and establishing or defending legal claims. You may object to any processing based on legitimate interests under Section 6.5, and you may request a summary of our assessment by emailing support@amcacademic.com. (d) Your consent: sending you marketing emails, and setting non-essential cookies. You may withdraw consent at any time, as easily as you gave it; withdrawal does not affect processing carried out beforehand.

4. DATA SHARING & THIRD PARTIES

4.1 Third-Party Service Providers: We share data with essential third-party services: (a) Payment Processors (Stripe, PayPal): Full name, email, transaction details, subscription plan, payment amount. Used for payment processing only. (b) Hosting Provider: Account information, learning data, support correspondence and Astra conversations. Our hosting provider holds the production database, which contains identifiable personal data. They cannot use it for their own purposes. Used for platform infrastructure and security. (c) Analytics Platforms (Google Analytics): Behavioral data, device information, IP address, pages visited, session duration. Used for understanding user engagement. (d) Customer Support Tools: Email, name, support messages. Used for ticket management and support. (e) Email Service Providers: Email address, communication preferences. Used for sending emails. (f) Newsletter Provider (MailerLite): Email address, subscription preferences. Used for sending our newsletter. If we add or change a provider, we will update this list.

4.2 Data Processing Agreements: We require all third-party vendors to: protect your data with industry-standard security, use data only for the purpose we specify, comply with applicable data protection laws (GDPR, NZ Privacy Act, etc.), delete data when no longer needed, notify us of data breaches.

4.3 Legal Disclosure: We may disclose your data to: law enforcement agencies if required by court order, subpoena, or legal process, government authorities where a valid and binding legal instrument compels disclosure, other parties where necessary to protect our legal rights or user safety. We assess each request for validity and disclose no more than the request requires. We will provide notice when possible unless prohibited by law.

4.4 No Sale of Personal Data: We do NOT sell your personal data to third parties for marketing or commercial purposes. Your data is not bought or sold on data markets.

4.5 Business Transfers: If our business is sold, merges with another company, is restructured, or enters administration, liquidation or receivership, personal data may be transferred as part of that transaction. We will require the recipient to handle your data in accordance with this policy, and we will notify you before the transfer takes effect so that you may delete your account and your data first if you prefer.

5. DATA STORAGE & SECURITY

5.1 Data Location: Your data is stored on servers located in Switzerland. Our team accesses it from New Zealand. Section 7 explains how international transfers are protected.

5.2 Encryption & Protection: We implement industry-standard security measures: (a) HTTPS/TLS encryption for all data transmission between your device and our servers. (b) Password hashing using bcrypt or similar cryptographic algorithms. Passwords are never stored in plain text. (c) Database encryption at rest. (d) Firewall protection and DDoS mitigation. (e) Access controls limiting employee access to personal data. We do not describe the platform as end-to-end encrypted. End-to-end encryption would mean we could not read your data, and we can: our team can access support correspondence and, as Section 10.3(e) explains, a sample of Astra interactions.

5.3 Data Retention Periods: (a) Account Data: Retained while your account is active. After account deletion, retained for 30 days then permanently deleted (except where required by law). (b) Payment Data: Retained for 7 years for tax and legal compliance (NZ Inland Revenue requirements). (c) Learning/Activity Data: Retained while your account is active. Pseudonymized after 2 years of inactivity. (d) Communication Data: Retained for 2 years then deleted (unless required by law). (e) Technical Logs: Retained for 90 days then deleted. (f) Cookies: Most expire after 1-2 years; you can delete them anytime. (g) AI Training Data: Pseudonymized data may be retained for as long as it remains useful for AI improvement, reviewed annually. (h) Astra Conversation Logs: Retained while your account is active, then deleted with your account data.

5.4 No Guarantee of Security: While we implement reasonable security, no system is 100% secure. We cannot guarantee protection against all cyber attacks, sophisticated hackers, or unforeseen breaches. Nothing in this section limits our obligations to you under the Privacy Act 2020, the GDPR, or any other applicable data protection law, and nothing here transfers responsibility for our security to you.

5.5 Breach Notification: If a data breach occurs that impacts your personal data, we will: (a) Notify affected regulators within the period each requires: the Office of the Privacy Commissioner in New Zealand as soon as practicable, the relevant EU or UK supervisory authority within 72 hours as required by the GDPR, and the Office of the Australian Information Commissioner as required. (b) Notify affected users without undue delay where the breach is likely to result in a high risk to your rights, and in any event within 72 hours of us establishing that this is the case. (c) Provide details about the breach, data affected, and steps we're taking. (d) Offer credit monitoring or similar remedies if appropriate.

6. YOUR DATA RIGHTS

To exercise any of the following rights, email support@amcacademic.com with the appropriate subject line and proof of your identity. Exercising your rights is free and we will not treat you differently for doing so. Response times: in New Zealand, no later than 20 working days as required by the Privacy Act 2020; in the EU and UK, within one month, extendable by up to two further months for complex requests where we tell you within the first month; elsewhere, within 30 days.

6.1 Right to Access: You have the right to request a copy of your personal data that we hold. To exercise this right, email support@amcacademic.com with subject line "Data Access Request" and proof of your identity. We will respond within the period above with your data in a portable format (e.g., CSV, JSON).

6.2 Right to Correction: If your data is inaccurate, incomplete, or outdated, you have the right to request correction. Email support@amcacademic.com with "Data Correction Request" and describe what needs correcting. We will update within 14 days.

6.3 Right to Deletion (Right to Be Forgotten): You have the right to request deletion of your personal data. Email support@amcacademic.com with "Data Deletion Request". We will delete personal data within the period above, except where we must retain it for legal, tax, or security reasons, and we will tell you if any exception applies and why. Data that has been aggregated into statistics cannot be extracted and will remain.

6.4 Right to Data Portability: You have the right to receive your data in a portable, structured format (e.g., CSV, JSON) suitable for transfer to another service. Email support@amcacademic.com with "Data Portability Request".

6.5 Right to Object to Processing: You have the right to object to any use of your data that we base on legitimate interests, including analytics and profiling. Email support@amcacademic.com with "Objection to Processing" and specify which processing you object to. If you object to direct marketing we will stop immediately and without exception. For other processing we will stop unless we can demonstrate compelling legitimate grounds that override your interests, and we will explain our reasoning if we reach that conclusion.

6.6 Right to Restrict Processing: You have the right to request that we restrict use of your data (i.e., we store it but do not actively use it) while you verify accuracy or investigate misuse.

6.7 Automated Decision-Making: Our AI system may make automated decisions about quiz difficulty, topic recommendations, or personalization. These do not produce legal or similarly significant effects, so Article 22 of the GDPR does not apply to them, but you may ask us to explain how a recommendation was reached and you may object to profiling under Section 6.5.

6.8 GDPR Rights (EU Users): If you are in the EU, you have all rights listed above plus: Right to lodge complaints with your national Data Protection Authority, Right to withdraw consent at any time (does not affect prior processing), Right to object to automated profiling.

6.9 CCPA/CPRA Rights (California Users): If you are in California, you have the right to: Know what personal data is collected, Know how your data is used, Know if your data is sold or shared for cross-context behavioral advertising (it is not), Correct inaccurate personal information, Delete your data, Limit use of sensitive personal information (we do not collect it), Opt out of data sales, and not to be discriminated against for exercising these rights.

6.10 NZ Privacy Act Rights: If you are in NZ, you have the right to request your personal information, correct inaccurate information, and lodge complaints with the Privacy Commissioner.

6.11 How to Submit Requests: All data rights requests should be submitted to: support@amcacademic.com with the specific request type in the subject line. Include your full name, email, and account ID if applicable. We will respond within the periods set out at the top of this Section. Requests may require identity verification for security.

7. INTERNATIONAL DATA TRANSFERS

7.1 Cross-Border Data Flow: AMCAcademic is based in New Zealand and globally accessible. Your data is stored in Switzerland and accessed by our team from New Zealand. It may also be processed in other countries where our service providers operate. Different countries have different data protection laws.

7.2 GDPR Compliance (EU Users): If you are in the European Union, your data is protected under the General Data Protection Regulation (GDPR). We ensure transfers to countries outside the EU comply with GDPR Articles 44-49 through: (a) Adequacy decisions. Switzerland and New Zealand both benefit from European Commission adequacy decisions and from UK adequacy regulations, so no additional safeguard is required for transfers to either. (b) Standard Contractual Clauses (SCCs), or the UK International Data Transfer Addendum, with any processor in a country without an adequacy decision, together with a transfer risk assessment where required. (c) Data Processing Agreements (DPAs) requiring GDPR compliance. Transfers are covered by these safeguards and not by your agreement to this policy.

7.3 International Data Transfers: We comply with applicable data protection laws in: New Zealand (Privacy Act 2020, including information privacy principle 12 on cross-border disclosure), Australia (Privacy Act 1988 and the Australian Privacy Principles), United Kingdom (UK GDPR and the Data Protection Act 2018), European Union (GDPR), India (Digital Personal Data Protection Act 2023), United States (CCPA/CPRA for California, state laws). Because our data is hosted in Switzerland, the Swiss Federal Act on Data Protection may also apply to how that data is handled.

7.4 Adequacy of Protections: Even where data is transferred internationally, we ensure adequate protections through encryption, contractual obligations, and compliance with all applicable laws.

8. CHILDREN & AGE RESTRICTIONS

8.1 Minimum Age Requirement: AMCAcademic is intended for users 18 years of age or older (or the age of legal majority in your jurisdiction). We do not knowingly collect, use, or disclose personal data from children under 18 years old.

8.2 Age Verification: During account registration, you must confirm that you are at least 18 years old. By confirming, you represent that this is accurate. False age representation may result in account termination.

8.3 Data from Minors: If we become aware that we have collected data from a user under 18 years old, we will: (a) Immediately notify the account holder at the email address on file, and any parent or guardian who has contacted us about the account. (b) Delete the account and all associated personal data promptly, and in any event within 30 days. (c) Terminate the account.

8.4 Parental Contact: Parents or guardians who believe their child has provided data to us should contact support@amcacademic.com immediately. We will cooperate in protecting children's privacy.

8.5 Users Under 18: The platform is not directed at children and we do not knowingly collect personal data from anyone under 18, anywhere. We do not offer a route by which a parent or guardian can consent to a minor using the platform. Any account we identify as belonging to a person under 18 is dealt with under Section 8.3.

9. COOKIES & TRACKING TECHNOLOGIES

9.1 What Are Cookies: Cookies are small text files stored on your device (computer, phone, tablet) that contain information about your browsing activity, preferences, and login status.

9.2 Types of Cookies We Use: (a) Session Cookies: Keep you logged in while using the platform. Expire when you close your browser. (b) Persistent Cookies: Remember your preferences and login information across sessions. Stored for up to 2 years. (c) Preference Cookies: Remember your language, theme (light/dark mode), accessibility settings. (d) Analytics Cookies: Track usage patterns for Google Analytics. Help us understand how users interact with the platform. (e) Marketing Cookies (Optional): Used only if you consent. Track your interaction with marketing emails and ads.

9.3 Analytics Providers: We use Google Analytics to collect: Pages visited, time on page, user flow, device information, geographic location, traffic sources. Google Analytics collects your IP address and assigns a device identifier, both of which are personal data, so we do not describe this data as anonymous. Analytics cookies are only set if you consent. You can opt out at https://tools.google.com/dlpage/gaoptout.

9.4 Cookie Consent: (a) Essential Cookies: Session and login cookies are required for platform functionality. Used without explicit consent. (b) Non-Essential Cookies: Analytics and marketing cookies require your consent. On first visit, we will display a cookie consent banner asking you to accept or reject non-essential cookies. Rejecting is as easy as accepting and takes the same number of clicks, and non-essential cookies are not set until you choose. We record your choice and the time you made it. (c) Changing Your Preferences: You can change your cookie preferences at any time using the Cookie Preferences link in the footer of every page, which works whether or not you have an account and whether or not you are logged in. (d) How to Manage Cookies: Most browsers allow you to disable cookies in settings. Be aware that disabling cookies may affect platform functionality (e.g., you may need to log in repeatedly). You can also delete existing cookies from your browser settings.

9.5 Third-Party Tracking: Third-party analytics providers (Google, etc.) may set their own cookies where you have consented to the relevant category. Refer to third-party privacy policies for their cookie practices.

9.6 Do Not Track: Some browsers include a "Do Not Track" (DNT) signal. DNT was never adopted as a standard and we do not respond to it, but we do respect your cookie preferences if you have opted out of tracking cookies.

10. ARTIFICIAL INTELLIGENCE & ASTRA DATA

10.1 How Astra Uses Data: When you interact with Astra AI tutor, we collect: your questions, the AI's responses, interaction history, topics you inquire about, your learning patterns. This data is used to: (a) Provide better, more personalized responses from Astra. (b) Improve Astra's accuracy and educational value. (c) Identify topics users struggle with. (d) Train future versions of Astra, unless you have opted out under Section 10.4.

10.2 Pseudonymization for AI Training: Astra may store pseudonymized versions of your interactions, with direct identifiers such as your name, email and account ID removed, for AI training and improvement purposes. This data: (a) Is not readily attributable to you, but because the underlying records remain we continue to treat it as personal data. (b) Is retained for as long as it remains useful for AI improvement, reviewed annually. (c) Is subject to the security measures described in Section 5.2.

10.3 AI Limitations & Transparency: You acknowledge that: (a) Astra is an AI system with inherent limitations. (b) Astra may generate inaccurate, incomplete, or misleading information. (c) Astra's responses should be verified before reliance. (d) Unless you have opted out under Section 10.4, your data is used to train the AI, which may improve responses for other users. (e) A sample of interactions may be reviewed by our team for quality assurance and improvement. If you opt out under Section 10.4, your conversations are excluded from this review.

10.4 Opting Out of AI Training: If you do NOT want your data used to train Astra, email support@amcacademic.com with "Opt Out of AI Training". We will flag your account to exclude your data from AI training purposes and from the review described at 10.3(e). This does not affect your ability to use Astra; it only prevents your data being used for AI improvement. Opting out applies to future use of your data. It does not remove your data from a model that has already been trained on it, which is not technically reversible, and it does not stop us storing your conversations, because Astra needs your recent history to answer usefully.

10.5 AI Transparency Reports: We commit to publishing transparency reports (at least annually) describing: how much data is used to train Astra, how Astra's accuracy has improved, any changes to AI practices, user feedback on AI.

10.6 Patient Information: Astra is designed for exam scenarios, not real cases. Do not enter real patient details, identifiable clinical information, or anything covered by your professional confidentiality obligations. If you do, our team may see it during the review described at 10.3(e). If you realize you have entered something you should not have, email support@amcacademic.com and we will delete it.

11. CHANGES TO THIS PRIVACY POLICY

11.1 Updates & Modifications: We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. Corrections, clarifications and changes that do not affect your rights take effect as of the "Last Updated" date shown at the top of this policy. Material changes take effect only on the date stated in the notice we give you under Section 11.2, and not before.

11.2 Notification of Changes: For material changes (those that significantly affect your privacy), we will: (a) Notify you via email at least 30 days before the change takes effect. (b) Post a prominent notice on our website and/or platform. (c) Require you to re-consent to the updated policy if required by law.

11.3 Continued Use: Your continued use of AMCAcademic after a material change takes effect constitutes your acceptance of the updated Privacy Policy. If you do not accept a material change, you may object under Section 6.5, withdraw any consent you have given, or delete your account, and where you delete your account for this reason we will refund the unused portion of your subscription on a pro-rata basis.

11.4 Archiving: We maintain a version history of this Privacy Policy. You can request previous versions by contacting support@amcacademic.com.

12. CONTACT INFORMATION & COMPLAINTS

12.1 Privacy Inquiries: For questions about this Privacy Policy, your data, or our privacy practices: Email: support@amcacademic.com. Response Time: within the periods set out at the top of Section 6.

12.2 Data Deletion/Access/Correction Requests: Email support@amcacademic.com with the appropriate subject line (Data Deletion Request / Data Access Request / Data Correction Request). Include your full name, email address, and account ID if applicable. Response time: within the periods set out at the top of Section 6.

12.3 General Support: Email support@amcacademic.com. Response time: 5-10 business days.

12.4 Complaints & Escalation: If you believe we have violated your privacy rights, you have the right to lodge a complaint with the appropriate regulatory authority in your jurisdiction: (a) New Zealand: Privacy Commissioner (https://www.privacy.org.nz/) (b) Australia: Office of the Australian Information Commissioner (https://www.oaic.gov.au/) (c) United Kingdom: Information Commissioner's Office (https://ico.org.uk/) (d) European Union: Your National Data Protection Authority; the list is at https://edpb.europa.eu/about-edpb/about-edpb/members_en (e) India: Data Protection Board of India (f) United States (California): California Privacy Protection Agency (https://cppa.ca.gov/) or California Attorney General (https://oag.ca.gov/privacy) (g) Switzerland: Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/). You do not have to complain to us first. You also have the right to lodge a complaint with us: Email support@amcacademic.com with subject "Privacy Complaint". Include details of the alleged violation, dates, and your desired resolution. We will respond within 20 working days and work to resolve the issue.

12.5 Legal Representation: If you wish to have legal representation in privacy matters, you may contact us with your attorney's contact information and we will work with them on your behalf.

© 2026 Dafne Technologies. All rights reserved.  |  Based in Auckland, New Zealand  |  Globally Accessible