Privacy Policy

1. Introduction

Format Partners LLC ("we," "us," or "Company") operates AccountingIQ, an AI-powered accounting tutoring platform available at accountingaitutor.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. By using the Service, you consent to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Display name (from your Google account, if applicable)
• Profile photo URL (from your Google account, if applicable)
• Firebase authentication user ID

2.2 User-Generated Content

When you use the Service, we store:

• Chat messages and AI responses in your tutoring conversations
• Documents you upload for analysis (PDFs, images)
• Flashcard decks and individual cards you create
• Practice problems you save
• Study schedules and completion progress
• Exam prep session history and scores
• Screenshots you submit for AI analysis
• AI-generated learning observations about your study patterns (up to 15 per account, used to personalize your tutoring experience)
• Course configuration settings (textbook, professor, syllabus topics)

2.3 Subscription and Billing Information

When you subscribe to a paid plan, payment processing is handled entirely by Stripe. We do not store your credit card number, bank account details, or other payment instrument data on our servers. We do store:

• Your Stripe customer ID (to link your account to your subscription)
• Subscription status (free, active, trialing, past_due, canceled)
• Plan type (monthly, semester, annual)

2.4 Usage Data

We automatically collect:

• Feature usage counts (for rate limiting and free tier enforcement)
• Login timestamps
• A browser-derived device identifier (a one-way hash of your browser version, language, screen and display settings, and timezone) used solely to detect multi-account abuse. It contains no personal information, is never shared, and cannot be used to track you across other websites.
• Anonymous analytics data through Vercel Analytics, Vercel Speed Insights, and Google Analytics (page views, feature usage, performance metrics)
• If you accept advertising cookies, advertising measurement data through the Meta pixel (page views, account creation, trial starts, and subscription purchases), used to measure whether our ads work. See section 2.5.

2.5 Cookies

We use a session cookie (__session) to maintain your authenticated session. This cookie is HttpOnly, Secure, and expires after 1 hour (automatically refreshed). This cookie is strictly necessary and is always set.

The banner shown on your first visit lets you accept or decline all other cookies. If you accept, we set:

• Google Analytics cookies for product analytics (page views, feature usage).
• Meta advertising cookies (_fbp and, if you arrived from one of our ads, _fbc). These let us measure which of our ads led to sign-ups and subscriptions.

If you decline, neither is set, and we do not send any advertising measurement data about you to Meta. You can change your mind at any time by clearing your browser cookies and site data for this site, which makes the banner appear again.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Process your documents and queries through AI services to generate educational content
• Store your study materials (flashcards, notes, schedules, chat history) so you can access them across sessions
• Process subscription payments and manage billing through Stripe
• Enforce usage limits and rate limiting to prevent abuse
• Monitor and improve the Service's performance and reliability
• Respond to support inquiries
• Measure the effectiveness of our advertising, but only if you accept advertising cookies (see section 2.5)
• Comply with legal obligations

We never use your User Content, meaning your chats, documents, flashcards, notes, or uploads, for advertising or to train AI models. Advertising measurement uses only your email address, an account identifier, and the fact that a sign-up, trial, or purchase occurred.

4. Third-Party Services and Data Sharing

To provide the Service, your data is processed by the following third-party providers. We only share the minimum data necessary for each service to function:

We do not sell, rent, or trade your personal information for money. Some state privacy laws define "sale" or "sharing" broadly enough to include advertising measurement, so the Meta sharing described above may fall under those definitions. You can opt out at any time by declining cookies on the consent banner, and we honor that choice for both the browser pixel and our server-side measurement. We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Storage and Security

Your data is stored on Google Firebase infrastructure in the United States. We implement the following security measures:

• All data transmitted between your browser and our servers is encrypted via HTTPS/TLS
• Authentication tokens are stored in HttpOnly, Secure cookies (not accessible to client-side JavaScript)
• Firebase Authentication tokens are verified server-side before any data access
• Firestore security rules restrict each user to accessing only their own data
• Firebase Storage rules restrict file access to the uploading user
• API keys and secrets are stored as server-side environment variables, never exposed to the browser
• Content Security Policy (CSP) headers restrict resource loading to trusted origins
• All server-side operations verify authentication before processing

While we take reasonable measures to protect your data, no method of electronic storage or internet transmission is 100% secure. We cannot guarantee absolute security.

6. Data Retention

• Account data: Retained as long as your account is active. Upon account deletion, your data will be deleted within 30 days.
• User-generated content (chats, flashcards, notes, documents, lectures): Retained as long as your account is active. You can delete individual items at any time through the Service. Files in Firebase Storage are deleted when you delete the associated item.
• Subscription data: Billing records may be retained as required by tax and accounting regulations, even after account deletion.
• Rate limiting data: Daily rate limit counters reset automatically every 24 hours.
• Analytics data: Anonymous analytics data is retained according to Vercel's data retention policies.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Deletion: Delete your account directly from Settings, or by contacting hello[at]format[dot]partners. Deletion takes effect after a 30-day grace period, during which you can cancel by signing back in.
• Correction: Request correction of inaccurate personal data
• Portability: Request your data in a machine-readable format
• Objection: Object to certain processing of your personal data
• Opt out of advertising measurement: Decline cookies on the consent banner, or clear this site's cookies and site data to make the banner appear again. We honor that choice for both the browser pixel and our server-side measurement.
• Withdraw consent: You may stop using the Service at any time

To exercise any of these rights, contact us at hello[at]format[dot]partners. We will respond within 30 days.

8. Children's Privacy

The Service is designed for college-level students and professionals studying accounting. We do not knowingly collect personal information from children under 13 years of age. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at hello[at]format[dot]partners, and we will delete such information promptly.

9. International Data Transfers

The Service is operated in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We rely on the data processing agreements of our third-party providers (Google, Anthropic, Stripe, Vercel) for compliance with international data transfer requirements.

10. California Privacy Rights (CCPA)

If you are a California resident, you have the right to: (a) know what personal information we collect about you; (b) request deletion of your personal information; (c) opt out of the sale of your personal information (we do not sell personal information); and (d) not be discriminated against for exercising your privacy rights. To exercise these rights, contact hello[at]format[dot]partners.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation, including the right to access, rectify, erase, restrict processing, data portability, and object to processing. Our legal basis for processing your data is: (a) your consent when you create an account; (b) performance of a contract (providing the Service); and (c) our legitimate interests in operating and improving the Service. You have the right to lodge a complaint with your local data protection authority.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on the Service. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Format Partners LLC
Email: hello[at]format[dot]partners