Privacy Policy

1. Information We Collect

Information You Provide Directly

• Account information: When you register, we collect your name, email address, and password (managed securely via Clerk authentication).
• Payment information: Purchase and billing details are processed by Stripe. We do not store your credit card number or full payment details on our servers.
• Communications: If you contact us for support, we collect the content of your messages.

Information Collected Automatically

• Usage data: Questions answered, scores, study session durations, domains studied, and exam results.
• Device and log data: IP address, browser type, operating system, referring URLs, and pages visited.
• Cookies and similar technologies: We use cookies to maintain your session, remember preferences (such as light/dark theme), and analyze platform usage.
• AI chat content: Messages you send to SlayBot and its responses. We also collect metadata including timestamp, token counts, and the page or question that was the subject of the chat.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account and purchased plans
• Deliver the exam preparation content and track your study progress
• Process payments and send billing-related communications
• Personalize your experience and provide analytics on your performance
• Send transactional emails (account confirmations, purchase receipts)
• Respond to support requests via our live chat and email
• Monitor and improve platform performance, security, and content quality
• Provide and improve the SlayBot AI study assistant
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your data for third-party advertising.

3. Third-Party Services

We use the following trusted third-party providers to operate the platform. Each has their own privacy policy governing how they handle data:

• Clerk — Authentication and user management. clerk.com/privacy
• Stripe — Payment processing. stripe.com/privacy
• Supabase — Database and backend infrastructure. Your data is stored on Supabase-managed servers. supabase.com/privacy
• Vercel — Hosting and content delivery. vercel.com/legal/privacy-policy
• Anthropic — AI model provider powering SlayBot. Chat messages you send to SlayBot are transmitted to Anthropic for processing. Anthropic does not train their models on our API traffic. anthropic.com/legal/privacy

4. AI Transparency

SlayBot is an artificial-intelligence feature powered by Anthropic's Claude model. AI responses may contain errors, omissions, or outdated information. SlayBot is a study tool and must not be used as a substitute for clinical judgment, a licensed healthcare provider, or your clinical preceptor. Always verify clinical content with trusted sources before acting on it.

5. Cookies

We use cookies and similar tracking technologies to enhance your experience:

• Essential cookies: Required for authentication and core platform functionality. These cannot be disabled.
• Preference cookies: Store your settings such as theme preference (light/dark mode).
• Analytics cookies: Help us understand how users interact with the platform so we can improve it.

You can control cookies through your browser settings. Disabling essential cookies will affect your ability to log in and use the platform.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specifically:

• Account data is retained while your account is open and for up to 90 days after deletion.
• Study progress and exam history are retained for the life of your account.
• Billing records are retained for 7 years as required by law.
• Support chat logs are retained for up to 2 years.
• SlayBot chat messages are retained for 7 days after the last activity in a conversation, after which they are automatically deleted. Aggregate usage metrics (message counts, token counts, cost totals) are retained longer for billing reconciliation and product analytics but are not tied to message contents.

You may request deletion of your account and associated data at any time by contacting us at privacy@npboardslay.com.

7. Lead Capture Forms and Email Sequences

NPBoardSlay offers free study tools (downloadable cheat sheets, the AANP Readiness Quiz, the 30-day study challenge) that may ask for your email address. When you submit your email through one of these forms, we store it in a secure database to:

• Deliver the resource you requested.
• Send you a short series of related study tips and product information (a “nurture sequence”) typically lasting 1-30 days depending on the source.
• Notify you if guidelines or content you downloaded are materially updated.

Every email we send includes a one-click unsubscribe link. Once unsubscribed, you will not receive further marketing emails from us, though we may still send transactional emails related to any account or purchase.

Retention: Email addresses captured through these forms are retained for up to 24 months, after which they are anonymized or deleted. If you create a paid account during that window, your email becomes part of your account profile and is retained for the life of your account plus 24 months for tax/audit purposes.

Your rights: You may request deletion of your data at any time by contacting privacy@npboardslay.com.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain types of processing, including marketing.
• Restriction: Request that we restrict processing of your data in certain circumstances.

To exercise any of these rights, please contact us at privacy@npboardslay.com. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures to protect your information, including:

• TLS/SSL encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Role-based access controls limiting who can access your data
• Regular security reviews of our infrastructure and third-party providers

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Children's Privacy

NPBoardSlay is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it immediately. If you believe a child has provided us with personal data, please contact us at privacy@npboardslay.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending an email notification. Your continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: