Privacy Policy

This Privacy Policy explains how AP Practice Exam Online ("we," "us," or "our") collects, uses, discloses, and protects personal data when you use our website, applications, and related services (the "Service"). It applies to visitors, registered users, moderators, and anyone who interacts with us.

Last updated: July 2026 · Version: 2.0

We process personal data in accordance with applicable laws, including the EU General Data Protection Regulation (GDPR), Türkiye Personal Data Protection Law (KVKK), U.S. state privacy laws (including CCPA/CPRA), and regional laws in the Middle East and North Africa (MENA) where relevant.

For cookie-specific information, see our Cookie Policy. For terms of use, see our Terms of Service.

---

Data Controller

The data controller responsible for your personal data is the operator of AP Practice Exam Online.

Service	AP Practice Exam Online
Contact email	info@apracticexamonline.com
Privacy requests	info@apracticexamonline.com (subject: "Privacy Request")
Postal address	[Legal address — to be completed]

If you have questions about this Policy or wish to exercise your rights, contact us using the details above. We may request information to verify your identity before responding.

Scope of This Policy

This Policy covers personal data we process when you:

• Visit our website or use the Service;
• Create or manage an Account;
• Upload PDFs, take practice exams, or publish content;
• Interact with consent banners, modals, or Privacy settings;
• Receive emails from us; or
• Contact support or moderation.

This Policy does not apply to third-party websites, services, or AI providers linked from or integrated with the Service. Those parties process data under their own policies. We describe key sub-processors below.

Categories of Personal Data We Collect

We collect the categories of data below depending on how you use the Service.

Category	Examples	Typical source
Account & identity	Email address, username, password hash, country, legal region	You, at registration
Profile & preferences	AP/SAT program preference, marketing opt-in, UI settings	You, in-app
Exam & study activity	Upload metadata, PDF files, extracted questions, attempts, answers, scores, timers	You, through use
Source & publish data	Source attestation, source URLs, publication status, moderator notes	You; moderators
Consent & compliance	Consent type, grant/revoke timestamps, policy version, hashed IP, hashed user-agent	You; our systems
Communications	Support messages, OTP codes, transactional email logs	You; email provider
Technical & security	Session identifiers, authentication tokens, error logs, abuse signals	Cookies; server logs
Advertising (optional)	Ad cookie identifiers, coarse usage signals via AdSense	Google (with consent where required)

We do not intentionally collect government ID numbers, payment card data (unless we add paid features later), or precise geolocation from device GPS. Country and legal region are based on information you declare at registration.

Special categories: We do not ask you to provide sensitive personal data (such as health, biometric, or political data). PDF content may incidentally contain personal information if you upload such materials; you control what you upload.

Sources of Personal Data

We obtain personal data from:

1. You directly — registration forms, uploads, exam answers, consent choices, support inquiries, and privacy settings.
2. Automatic technologies — cookies, local storage, authentication sessions, and server logs (see Cookie Policy).
3. Moderators and administrators — review decisions, rejection reasons, and compliance actions related to published content.
4. Third-party processors — hosting, AI extraction, email delivery, and (where enabled) advertising partners acting on our instructions.

We do not purchase personal data lists from data brokers for marketing purposes.

Purposes and Lawful Bases for Processing

The table below describes why we process personal data and the lawful basis under GDPR-style frameworks. Local law may use different labels; where multiple bases apply, we rely on the most appropriate one.

#	Processing activity	Purpose	Lawful basis (GDPR)	Retention (summary)
1	Account creation & login	Provide registered access to the Service	Contract (Art. 6(1)(b))	While Account active + legal hold
2	Email verification & OTP	Secure authentication, prevent fraud	Contract; Legitimate interests (security)	Short-term transactional logs
3	Store country & legal region	Apply regional consent and privacy rules	Contract; Legal obligation	While Account active
4	PDF upload & private storage	Enable personal exam practice	Contract	Until you delete upload/Account
5	AI PDF extraction & scoring	Convert PDFs to practice questions and score attempts	Consent (Art. 6(1)(a)) — required before processing	Until deletion + backup cycle
6	Exam attempts & analytics	Show scores, history, progress	Contract	Until you delete attempts/Account
7	Source attestation & URL verification	Copyright compliance, attribution	Contract; Legitimate interests (IP protection)	Life of upload + moderation records
8	Public publish & moderator review	Optional sharing of approved practice exams	Consent	While published + audit logs
9	Consent logging (hashed IP/UA)	Demonstrate compliance, resolve disputes	Legal obligation; Legitimate interests	Per retention table
10	Marketing emails	Send optional product updates or tips	Consent (opt-in only)	Until unsubscribe or Account deletion
11	Transactional email	OTP, security alerts, moderation outcomes	Contract; Legitimate interests	Provider log retention
12	Essential cookies (Supabase auth)	Maintain signed-in session	Contract; Legitimate interests	Session / auth token lifetime
13	Analytics & AdSense cookies	Advertising revenue, aggregated usage	Consent (EU/TR); Notice + opt-out (US)	See Cookie Policy
14	Security monitoring & abuse prevention	Protect Service, users, and moderators	Legitimate interests (Art. 6(1)(f))	Rolling security log window
15	Legal claims & regulatory response	Respond to lawful requests, enforce Terms	Legal obligation; Legitimate interests	As required by law
16	Data export & erasure requests	Fulfill privacy rights	Legal obligation	Request logs only
17	Aggregated product analytics	Improve extraction quality and UX (de-identified)	Legitimate interests	Indefinite in aggregate form

Where we rely on consent, you may withdraw it at any time through Privacy settings or by contacting us. Withdrawal does not affect prior processing and may limit features (for example, AI analysis or publishing).

Where we rely on legitimate interests, you may object as described in "Your Rights" below.

AI Processing and PDF Content

When you consent to AI processing, we may transmit portions of your uploaded PDFs and derived text to Google Gemini and/or Anthropic Claude to extract questions, analyze content, and score responses.

Important considerations:

• PDFs may contain copyrighted or third-party material; you are responsible for lawful uploads (see Terms of Service).
• AI providers process data under their own terms and may use infrastructure in multiple countries.
• We instruct processors to handle data for extraction/scoring purposes; we do not use your private uploads to train public foundation models unless we explicitly disclose otherwise and obtain consent.
• AI output may be inaccurate; it is for practice only.

You must provide per-session or per-action consent where our product requires it. Consent events are stored in our user_consents records with policy version, legal region, timestamp, and hashed IP/user-agent for audit.

Publishing, Moderation, and Public Visibility

By default, uploads are private. If you choose to publish an exam:

• You provide explicit public_publish consent;
• Submissions may be reviewed by moderators before appearing publicly;
• Approved exams display source attribution to other users;
• Moderator decisions, rejection reasons, and unpublish actions may be logged;
• Published content may be copied or viewed by other users within the Service for personal study.

If you delete your Account or unpublish content, we remove or de-index public displays in accordance with our retention practices, subject to backup lag and legal holds.

Consent Records

We maintain granular consent records for compliance and audit, including:

Consent type	When collected
terms	Signup
privacy	Signup
marketing	Signup (opt-in)
ai_processing	Before PDF AI analysis
public_publish	Before submitting for publication
copyright_attestation	Upload / source declaration flows
cookies_analytics	Cookie banner or Privacy settings

Each record may include: user email, consent type, granted/revoked status, policy version string, legal region, timestamp, hashed IP, hashed user-agent, and contextual metadata (e.g., upload ID).

Sub-Processors and Third Parties

We use the following categories of sub-processors to operate the Service:

Processor	Role	Data processed	Location notes
Supabase	Database, authentication, file storage	Account data, uploads, attempts, consents	Cloud regions per project config
Google Gemini	AI extraction & grading (SAT/AP)	PDF content, extracted text, prompts	Global Google infrastructure
Anthropic Claude	AI extraction (AP)	PDF content, extracted text, prompts	Global Anthropic infrastructure
Google AdSense	Advertising (if enabled)	Cookie IDs, ad interaction signals	Global; consent-gated in EU/TR
Email provider (Resend / SMTP / Gmail)	Transactional & marketing email	Email address, message content	Provider-dependent
Hosting / CDN (e.g., Vercel)	Application delivery, edge logs	IP addresses, request metadata	Global edge network

We enter into appropriate data processing terms with vendors where available. A living summary may also appear in internal processor documentation. We will update this Policy or provide notice when we add or materially change sub-processors where required by law.

We do not sell your personal data for money. Advertising partners may "share" data for cross-context behavioral advertising under some U.S. state definitions—see "United States (CCPA/CPRA)" below.

International Data Transfers

AP Practice Exam Online may process and store data in countries other than your own, including the United States and European Economic Area, depending on sub-processor locations.

When transferring personal data from the EEA, UK, or Türkiye to countries without an adequacy decision, we implement appropriate safeguards such as:

• Standard Contractual Clauses (SCCs) or equivalent contractual protections;
• Vendor Data Processing Agreements; and
• Technical measures (encryption in transit, access controls).

You may contact us for more information about transfer mechanisms relevant to your region.

Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy.

Data type	Retention period
Account profile	While Account is active
Password hash	While Account is active; deleted on Account deletion
Private PDF uploads & extracts	Until you delete the upload or your Account
Exam attempts & scores	Until you delete attempts or your Account
Published exams	While published; removed after unpublish/delete subject to backup lag
Consent records	Minimum period required for compliance (typically 3–7 years or as mandated locally)
Moderation logs	Duration needed for enforcement and audit (typically 1–3 years)
Transactional email logs	Per email provider defaults (often 30–90 days to 1 year)
Security / abuse logs	Rolling window (typically 30–180 days) unless incident hold
Marketing preferences	Until opt-out or Account deletion
Legal hold data	As required for litigation or regulatory inquiry

Backups may retain deleted data for a limited period before overwrite. De-identified aggregate statistics may be retained indefinitely.

Security Measures

We implement technical and organizational measures designed to protect personal data, including:

• Password hashing (we do not store plaintext passwords);
• HTTPS encryption in transit;
• Role-based access for administrators and moderators;
• Consent and audit logging with hashed IP/user-agent;
• Private-by-default upload visibility; and
• Vendor security reviews for core infrastructure providers.

No method of transmission or storage is 100% secure. You are responsible for safeguarding your Account credentials. Report suspected breaches to info@apracticexamonline.com.

Your Rights

Depending on your location, you may have some or all of the following rights:

Right	Description
Access	Obtain confirmation and a copy of personal data we hold about you
Rectification	Correct inaccurate or incomplete data
Erasure	Request deletion ("right to be forgotten") subject to exceptions
Restriction	Limit processing in certain circumstances
Portability	Receive data in a structured, machine-readable format
Objection	Object to processing based on legitimate interests or direct marketing
Withdraw consent	Where processing is consent-based, without affecting prior lawful processing
Opt out of sale/sharing	Under some U.S. state laws, for targeted advertising/sharing
Non-discrimination	Not receive discriminatory treatment for exercising privacy rights
Lodge a complaint	With a supervisory authority in your jurisdiction

Rights are subject to legal exceptions (e.g., compliance records, freedom of expression, ongoing legal claims).

How to Exercise Your Rights

You can exercise many controls directly:

• Delete uploads, attempts, or Account: Privacy settings
• Export data: Data export feature in Privacy settings (where available)
• Marketing opt-out: Unsubscribe link or Privacy settings
• Cookie / Ad preferences: Cookie banner or Cookie Policy

For other requests, email info@apracticexamonline.com with:

1. Your registered email address;
2. Your country / legal region;
3. The right you wish to exercise; and
4. Sufficient detail for us to locate your data.

We respond within timelines required by applicable law (e.g., 30 days under GDPR, extendable where permitted). We may verify identity before fulfilling requests.

European Union (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, the following additional information applies:

Controller: AP Practice Exam Online (contact details above).

Legal bases: See the purposes table above. Primary bases are contract, consent, legal obligation, and legitimate interests (security, fraud prevention, IP enforcement).

Recipients: Sub-processors listed above; moderators under confidentiality; authorities when legally required.

Transfers: SCCs or other approved mechanisms for transfers outside the EEA/UK.

Supervisory authority: You may lodge a complaint with your local data protection authority. We encourage you to contact us first so we can address your concern.

Automated decision-making: We do not make solely automated decisions with legal or similarly significant effects. AI scoring affects practice feedback only.

Data Protection Officer: We have not appointed a DPO where not strictly required; privacy inquiries may be sent to info@apracticexamonline.com.

Türkiye (KVKK)

Türkiye kullanıcıları için tam aydınlatma metni (KVKK md. 10):

Veri Sorumlusu

AP Practice Exam Online ("Veri Sorumlusu") tarafından işletilen AP ve SAT sınav pratiği platformuna ("Hizmet") ilişkin kişisel verileriniz, 6698 sayılı Kişisel Verilerin Korunması Kanunu ("KVKK") kapsamında aşağıda açıklanan çerçevede işlenmektedir.

Veri Sorumlusu	AP Practice Exam Online
E-posta	info@apracticexamonline.com
Adres	[Legal address — to be completed]

İşlenen Kişisel Veri Kategorileri

Kimlik ve iletişim (e-posta, kullanıcı adı); müşteri işlem (yüklenen PDF meta verileri, deneme sonuçları, cevaplar, puanlar); işlem güvenliği (oturum çerezleri, hashlenmiş IP ve tarayıcı bilgisi); pazarlama tercihi (açık rıza halinde); hukuki işlem (onay kayıtları, moderasyon notları); görsel/işitsel kayıtlar (PDF içeriği — yalnızca sizin yüklediğiniz materyaller).

Kişisel Verilerin Toplanma Yöntemi

Kayıt formları, Hizmet kullanımı, çerezler ve yerel depolama, açık rıza ekranları, destek yazışmaları ve yetkili alt işleyiciler aracılığıyla otomatik veya kısmen otomatik yollarla toplanır.

Kişisel Verilerin İşlenme Amaçları

• Hesap oluşturma, kimlik doğrulama ve Hizmet sunumu;
• PDF yükleme, yapay zekâ ile soru çıkarma ve puanlama (yalnızca açık rızanız ile);
• Kişisel sınav pratiği ve ilerleme takibi;
• Kaynak beyanı ve telif uyumu;
• Açık rızanız halinde sınavları kamuya açık yayınlama ve moderasyon;
• Açık rızanız halinde pazarlama iletişimi;
• Açık rıza veya meşru menfaat kapsamında analitik/reklam çerezleri;
• Bilgi güvenliği, dolandırıcılık önleme ve kötüye kullanım tespiti;
• Yasal yükümlülüklerin yerine getirilmesi ve hak taleplerinin savunulması.

İşlemenin Hukuki Sebepleri (KVKK md. 5 ve 6)

Amaç	Hukuki sebep
Hesap ve sınav hizmetleri	Sözleşmenin kurulması veya ifası (md. 5/2-c)
Güvenlik ve kötüye kullanım önleme	Veri sorumlusunun meşru menfaati (md. 5/2-f)
Yasal yükümlülükler	Kanunlarda açıkça öngörülmesi (md. 5/2-ç)
Yapay zekâ ile PDF işleme	Açık rıza (md. 5/1)
Kamuya yayınlama	Açık rıza (md. 5/1)
Pazarlama e-postası	Açık rıza (md. 5/1)
Reklam/analitik çerezleri (AB/Türkiye akışı)	Açık rıza (md. 5/1)

Kişisel Verilerin Aktarılması

Verileriniz; barındırma ve veritabanı (Supabase), yapay zekâ işleme (Google Gemini, Anthropic Claude), e-posta hizmeti, reklam (Google AdSense — rıza ile) gibi yurt içi ve yurt dışı alt işleyicilere, yalnızca Hizmetin sunulması amacıyla ve sözleşmesel güvenceler eşliğinde aktarılabilir. Yurt dışına aktarımda KVKK md. 9 hükümlerine uygun teknik ve idari tedbirler uygulanır.

Kişisel Verilerin Saklanma Süresi

Hesap verileri hesabınız aktif olduğu sürece; yüklemeler ve denemeler silinene veya hesap kapatılana kadar; onay kayıtları mevzuatın öngördüğü süreler boyunca (genellikle 3–7 yıl); güvenlik günlükleri sınırlı sürelerle saklanır. Ayrıntılar yukarıdaki "Data Retention" bölümünde yer almaktadır.

KVKK md. 11 Kapsamındaki Haklarınız

Kişisel verilerinizin;

• işlenip işlenmediğini öğrenme,
• işlenmişse buna ilişkin bilgi talep etme,
• işlenme amacını ve amacına uygun kullanılıp kullanılmadığını öğrenme,
• yurt içinde veya yurt dışında aktarıldığı üçüncü kişileri bilme,
• eksik veya yanlış işlenmişse düzeltilmesini isteme,
• KVKK md. 7 kapsamında silinmesini veya yok edilmesini isteme,
• düzeltme/silme işlemlerinin aktarıldığı üçüncü kişilere bildirilmesini isteme,
• münhasıran otomatik sistemler ile analiz edilmesi suretiyle aleyhinize bir sonucun ortaya çıkmasına itiraz etme,
• kanuna aykırı işleme sebebiyle zarara uğramanız hâlinde zararın giderilmesini talep etme

haklarına sahipsiniz.

Başvuru Yöntemi

Haklarınızı info@apracticexamonline.com adresine "KVKK Başvurusu" konu satırı ile iletebilir veya Privacy settings üzerinden hesap/veri silme işlemlerini gerçekleştirebilirsiniz. Başvurularınız en geç 30 gün içinde sonuçlandırılır; gerekçeli ret halinde Kişisel Verileri Koruma Kurulu'na şikâyet hakkınız saklıdır.

Açık Rıza

Yapay zekâ ile PDF işleme, kamuya yayınlama, pazarlama iletişimi ve (EU/TR bölgesinde) reklam çerezleri için ayrı açık rıza alınır. Rızanızı dilediğiniz zaman geri çekebilirsiniz; bu, geri çekme öncesindeki meşru işlemeyi etkilemez.

---

United States (CCPA/CPRA)

If you are a California resident or covered by similar U.S. state privacy laws, the following applies:

Categories collected (12-month lookback): Identifiers (email, username); internet activity (exam usage, logs); education-related study data you provide; inferences from usage for product improvement; optional advertising identifiers if you consent or do not opt out.

Sources: You; our Service; advertising partners (if enabled).

Business/commercial purposes: Provide the Service; security; compliance; optional advertising.

Sale / sharing: We do not sell personal information for monetary consideration. Google AdSense may constitute "sharing" for cross-context behavioral advertising under CPRA. You may opt out via Privacy settings or the Global Privacy Control (GPC) signal where supported (bbo-gpc handling).

Sensitive personal information: We do not use or disclose sensitive personal information for purposes requiring opt-out under CPRA beyond permitted service delivery.

Your California rights: Know/access, delete, correct, opt out of sale/sharing, limit use of sensitive PI (where applicable), and non-discrimination. Authorized agents may submit verified requests.

Response time: We aim to respond within 45 days, extendable as permitted.

Shine the Light: We do not share personal information with third parties for their direct marketing without consent.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws may have analogous rights; contact us to exercise them.

MENA

Users in the Middle East and North Africa (including UAE, Saudi Arabia, Qatar, Bahrain, Kuwait, Oman, Egypt, Morocco, and similar jurisdictions) receive privacy notices and consent flows aligned with regional Personal Data Protection Laws (PDPL) and regulations where applicable.

Key points for MENA users:

• Explicit consent is requested for optional processing such as AI PDF analysis, public publishing, marketing, and cross-border transfers where required;
• Legal region selection at signup determines applicable consent UI and policy version;
• Cross-border transfers to U.S./EU cloud and AI providers are disclosed; safeguards include contractual protections;
• You may contact info@apracticexamonline.com to exercise access, correction, deletion, or objection rights under local law;
• If local law requires Arabic language support for notices, we may provide translations on request; this English Policy remains the primary version unless otherwise mandated.

Rest of World

If your country is not specifically addressed above, we still apply this Policy globally with fair and transparent processing practices:

• We collect only data necessary for the Service;
• We rely on consent where local law or our product design requires it (AI, publishing, marketing, ads);
• You may access, correct, or delete data via Privacy settings or by emailing us;
• Mandatory local consumer or data laws apply where they conflict with less protective terms in this Policy.

We monitor evolving privacy legislation and update practices as needed.

Children

The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. Users must confirm they are at least 13 at registration.

If you believe a child under 13 has provided personal data, contact info@apracticexamonline.com. We will take steps to delete such data promptly.

Teen users (13–17) should use the Service with parental or guardian permission where required by local law.

Automated Decision-Making

We use automated systems—including AI models—to extract exam content and score practice responses. These outputs affect your practice experience only (scores, feedback, extracted questions) and do not produce legal or similarly significant effects.

Moderators make human decisions on publication approval. We do not use fully automated profiling for employment, credit, or legal decisions.

Changes to This Policy

We may update this Privacy Policy to reflect product changes, legal requirements, or new sub-processors. We will post the updated Policy with a new "Last updated" date and version. Material changes may require renewed consent where mandated.

Continued use after the effective date constitutes acknowledgment, except where explicit consent is required. Prior versions may be available on request.

Contact

Purpose	Contact
Privacy requests & questions	info@apracticexamonline.com
Copyright / takedown	copyright@apracticexamonline.com
Postal mail	[Legal address — to be completed]

Related documents: Terms of Service · Cookie Policy · Privacy settings