Skip to main content
← Trang chủ

Privacy Policy

Effective date: August 18, 2026

1. Who we are

LeaPrep ("we", "us", "our") is an online CFA exam preparation platform accessible at https://leaprep.com. This Privacy Policy explains what personal data we collect, how we use it, and your rights.

Contact for privacy questions: contact@leaprep.com.

2. Data we collect

  • Account data: email, display name, password (stored as a bcrypt hash — we never see your plaintext password).
  • Google Sign-In data (if you choose to sign in with Google): Google account ID, email, display name, and profile picture URL received from Google. We do not receive your Google password.
  • Learning data: quizzes you take, answers you submit, time spent per question, wrong-answer review schedule, daily streaks, bookmarks, and personal notes you create.
  • Profile content: avatar image you upload (hosted on Cloudinary), optional display name.
  • AI tutor conversations: messages you send to the in-app AI tutor, which are forwarded to OpenAI for processing. We log these conversations for quality and abuse prevention.
  • Technical logs: IP address, user agent, and timestamps for security and debugging. Logs are retained for 30 days.

Payment data:Pro upgrades are paid by Vietnamese bank transfer through SePay. We receive only the transfer amount, the reference code we generated for your order, and the bank's transaction reference. We never receive or store your card number or banking credentials.

3. How we use your data

  • Provide the service: authenticate you, show your quiz history, recommend wrong answers for review.
  • Personalize learning: compute performance analytics, streaks, and spaced-repetition schedules.
  • Improve the product: aggregated, anonymized usage analytics.
  • Security: detect abuse, prevent fraud, protect other users.
  • Communicate: send transactional emails (password reset, account notices). We do not send marketing emails without opt-in.

4. Third-party processors

We share minimum-necessary data with the following processors to operate the service:

  • Cloudflare— application hosting (Workers), database (D1), DNS, and edge protection. Data is processed in Cloudflare's global network.
  • Cloudinary — avatar image hosting.
  • OpenAI — AI tutor chat completions. Per OpenAI policy, API data is not used to train OpenAI models.
  • Google — Sign-In (only if you choose it), Google Analytics, and Google Ads measurement. See section 5.
  • Amazon Web Services (SES) — transactional email delivery (region: ap-southeast-1).
  • SePay — bank-transfer payment confirmation for Pro upgrades. We never receive or store your card or banking credentials.

5. Cookies, analytics, and advertising

We use strictly necessary cookies to keep you signed in and to protect against CSRF, plus a first-party identifier that counts visits without naming you. See the Cookie Policy for the full list.

Google Analytics. We use Google Analytics 4 to understand how many people visit the site, which pages they read, and which sources bring them here. Analytics storage is on by default; press Reject on the cookie banner and we switch it off immediately.

Google Ads measurement. We run Google Search ads and measure three milestones: account creation, first completed mock exam, and Pro purchase. We do not upload your email, name, or exam results to Google.

Meta Pixel. Since 18 August 2026 we also run Facebook and Instagram ads and use the Meta Pixel to see which ad led to a sign-up. It is active by default and stops entirely if you press Reject on the cookie banner. We do not upload your email, name, or exam results to Meta.

Google signals. Google Analytics on this site has Google signals enabled. For visitors who are signed in to a Google account and have turned on Ads Personalization, Google may associate their visit here with information held in that Google account — which can include age range, gender, interest categories, and activity across devices. We only ever see this as aggregated reporting; we never receive information that identifies an individual.

How to opt out. You have several independent options:

  • Press Reject on our cookie banner — advertising and analytics storage is switched off immediately and the Meta Pixel stops sending anything.
  • Turn off Ads Personalization in your Google account at myadcenter.google.com — this disables Google signals association everywhere, not just here.
  • Install the Google Analytics Opt-out Browser Add-on.
  • Review or delete the data Google holds about you at myactivity.google.com.

6. Data retention

  • Account data: for the life of your account. Deleted within 30 days after you request account deletion.
  • Learning data: as long as your account is active; anonymized aggregates may be retained for research.
  • Technical logs: 30 days.
  • AI tutor messages: 90 days, then permanently deleted.

7. Your rights

Regardless of where you live, you may request to: access a copy of your data, correct inaccuracies, export your data, restrict or object to processing, and delete your account. EU/UK/California residents have additional rights under GDPR/CCPA including non-discrimination for exercising them. Send requests to contact@leaprep.com. We respond within 30 days.

8. Security

Passwords are hashed with bcrypt. All traffic is served over HTTPS (TLS 1.3 where supported). Database connections use SSL. Access to production systems is limited to the founder and requires SSH key + 2FA on the hosting account. We cannot guarantee absolute security — please use a unique, strong password.

9. Children

LeaPrep is intended for users aged 18 and above. We do not knowingly collect data from children under 13. If we learn we have done so, we will delete the account.

10. International transfers

Your data is stored and processed on Cloudflare's global network, which may route requests to the location closest to you. Transactional email is sent through Amazon SES in Singapore (ap-southeast-1). By using LeaPrep you consent to these transfers.

11. Changes to this policy

We may update this policy. Material changes will be announced by email (where we have your address) or an in-app notice at least 7 days before taking effect.

12. Contact

Questions or requests: contact@leaprep.com.

Terms of ServiceCookie PolicyHome