Lumora PrepPrivacy Policy
Lumora Prep
Last updated: August 5, 2026
This privacy notice for Lumora Prep ("Lumora Prep," "we," "us," or "our") describes how and why we collect, store, use, and/or share your information when you use our services ("Services"), including our website, our SAT preparation platform, our AI tutoring feature ("Lumi"), and related features.
If you have questions or concerns about this privacy notice, please contact us at contact@lumoraprep.com.
1. What Information Do We Collect
Personal information you provide. When you register or use the Services, this may include:
- Name and email address
- Account credentials and authentication data
- Billing information (processed and stored by our payment processor — we do not receive or store your full card number)
Student and educational data. When you use our SAT preparation features, we collect:
- Practice question responses, scores, and performance metrics
- Diagnostic and mock exam results
- AI tutor ("Lumi") conversation history
- Vocabulary and course progress
- Score report images you may submit (e.g., for testimonials, only with your explicit consent)
- Study preferences and adaptive-practice data
Information collected automatically. IP address, browser and device information, and usage data (pages viewed, features used), collected to secure and operate the Service and for internal analytics.
2. How We Use Your Information
- To provide and personalize the Service — adaptive practice, study plans, progress tracking, and AI tutoring
- To create and manage your account and process payments
- To respond to support inquiries and send service-related communications
- To maintain the security and integrity of the Service
- To comply with legal obligations
What we do not do with your information:
- We do not sell your personal information or student data to any third party
- We do not use student data for targeted advertising
- We do not build commercial profiles of students for purposes unrelated to their education
3. AI-Powered Features
Lumora Prep uses artificial intelligence to power Lumi (our AI tutor), question generation, and adaptive learning features.
How AI is used. When you interact with Lumi, your messages, relevant practice history, and question context are sent to a third-party AI provider for processing, so it can generate an explanation or response.
Data handling. Our AI provider processes this data under commercial API terms that contractually prohibit using customer data to train their models, and retains it only as long as needed to provide the response, in accordance with their own retention policy.
Data minimization. Where possible, we avoid sending unnecessary personal identifiers (such as your name) along with AI requests — only what's needed to generate a relevant response (e.g., the question and your recent mistake history on that topic).
Feedback. If we collect feedback on AI-generated content (such as a helpful/not helpful rating), it's used internally to improve our own prompts and content — it is not shared with our AI provider for their model training.
4. Minors and Student Privacy
Lumora Prep is designed for SAT preparation, and many of our users are high school students.
Age requirement. The Service is not directed at, and we do not knowingly collect personal information from, children under the age of 13. If you are between 13 and the age of majority in your jurisdiction, we encourage a parent or guardian to review this policy with you. If we become aware that a child under 13 has provided us with personal information, we will delete it — contact us at contact@lumoraprep.com if you believe this has occurred.
Parents and guardians. A parent or legal guardian of a student user may contact us to review, correct, or request deletion of their child's information.
Student data privacy laws. We are committed to aligning our practices with the principles of applicable student data privacy laws, including FERPA (the Family Educational Rights and Privacy Act) and applicable state student privacy laws, as our Service grows to serve students in those contexts.
If Lumora Prep is used under a school or district agreement (not currently applicable — we operate as a direct-to-student product today), the following commitments would apply to student data collected under that agreement:
- Student data would not be owned by Lumora Prep — student-generated work (AI tutor conversations, practice responses) remains the property of the student or their parent/guardian.
- We would not use that data for any purpose beyond providing and improving the contracted educational service, and never to train AI models.
- We would delete such data upon request by the student, parent/guardian, or the institution, and notify the institution of any data breach without unreasonable delay.
- A separate Data Processing Agreement executed with that institution would govern the specifics and take precedence over this general policy where they conflict.
5. When and With Whom We Share Information
We share information with third-party service providers who help us operate the Service, in these categories:
- Database, authentication, and account storage providers
- AI providers (see Section 3)
- Payment processing providers
- Video hosting providers for course content
A description of the categories of service providers we use, and the data each processes, is available on request at contact@lumoraprep.com.
We do not load third-party advertising or tracking scripts on authenticated student pages, and student educational data (practice responses, AI tutor conversations, progress records) is never shared with analytics or marketing tools.
Business transfers. If Lumora Prep is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to protections no less protective than those described here.
Legal requirements. We may disclose information where required by law or to protect the rights, safety, or security of Lumora Prep, our users, or others.
6. How Long We Keep Your Information
General users. We retain your account and educational data while your account is active, and for up to 12 months after account termination, after which it is deleted or anonymized — except where a longer period is required by law (e.g., payment records for accounting purposes).
AI provider retention. Data sent to our AI provider is subject to their own retention policy under their commercial API terms — not used for training, and retained only as long as needed to provide the response.
Backups. Data may persist in encrypted backups for a limited period after deletion from active systems. Backups are encrypted at rest, access is restricted, and backup data is purged automatically according to our retention schedule.
7. How We Protect Your Information
- Encryption in transit: all data between your browser, our servers, and our service providers is encrypted using TLS.
- Encryption at rest: data stored in our database, including backups, is encrypted at rest.
- Access controls: row-level security ensures your data is only ever readable by you; administrative access to production systems is restricted, requires multi-factor authentication, and administrative actions are logged.
- Secrets management: API keys and credentials are stored securely as encrypted environment configuration, never in source code.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security — but we design the Service to be a difficult, low-value target, and to respond quickly if something does go wrong.
8. Your Privacy Rights
All Users.
Depending on your location, you may have the following rights regarding your personal information:
- The right to access the personal information we hold about you
- The right to request correction of inaccurate personal information
- The right to request deletion of your personal information
- The right to withdraw consent to processing, where applicable
- The right to opt out of marketing communications
- The right to data portability, where applicable
To exercise any of these rights, please contact us at contact@lumoraprep.com. We will respond to your request in accordance with applicable law.
Parents and Guardians.
Parents and legal guardians of student users have the right to review their child's personal information, request corrections, and request deletion. These rights may be exercised by contacting us directly at contact@lumoraprep.com.
Students in District-Contracted Accounts.
We do not currently offer accounts provisioned through school or district contracts. If we do in the future, students with such accounts would be able to exercise their rights directly or through their parent/guardian or school district, and student-generated content created through the Service would remain the property of the student or their parent/guardian, as described in Section 4.
California residents: the CCPA/CPRA provides rights including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.
Connecticut, Virginia, Colorado, and other U.S. state residents: we aim to honor applicable state privacy rights (access, correction, deletion, and opt-out of targeted advertising/sale) upon request at contact@lumoraprep.com. We do not sell personal data or engage in targeted advertising.
EU/UK users: you have rights under GDPR, including access, rectification, erasure, and data portability, exercisable at contact@lumoraprep.com.
9. Third-Party Websites and Content
The Services may contain links to third-party websites and content that are not owned or controlled by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We do not warrant the offerings of any of these entities or their websites.
10. Data Breach Notification
In the event of a data breach involving personal information, we will:
- Take prompt steps to contain the breach and prevent further unauthorized access
- Notify affected individuals without unreasonable delay, as required by applicable law
- Notify any contracted educational institution whose students' data was affected without unreasonable delay, and in no event later than 60 days after discovery, or sooner if required by applicable law
- Cooperate with relevant authorities in investigating and remediating the breach
11. Do-Not-Track Signals
Most browsers offer a Do-Not-Track ("DNT") setting. Because no uniform technical standard for DNT has been finalized, we do not currently respond to DNT browser signals.
12. International Data Transfers
Our service providers may process and store your data in countries other than your own, including the United States. By using the Service, you consent to this transfer.
13. Changes to This Notice
We may update this notice from time to time, indicated by a new "Last updated" date. If we make material changes, we will notify you via the Service or by email before they take effect.
14. Cookies
We use cookies necessary to keep you logged in and maintain your session. We do not currently use third-party advertising or tracking cookies.
15. Contact Us
If you have questions about this privacy notice or wish to exercise your privacy rights, contact us at:
Lumora Prep Email: contact@lumoraprep.com