Privacy Policy

1. Introduction

ABA Sprout ("we," "us," or "our") operates the website abasprout.com(the "Platform"). We provide educational tools for Applied Behavior Analysis (ABA) professionals, including Registered Behavior Technician (RBT®) and Board Certified Behavior Analyst (BCBA®) exam preparation materials, flashcards, study guides, practice exams, and related educational resources.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our Platform, create an account, use our study tools, make a purchase, or interact with us in any way. Please read this policy carefully. By using the Platform, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Platform.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account, make a purchase, or contact us, we may collect:

• Account Information: Your full name, email address, and password (encrypted) when you register for an account through our authentication system powered by Supabase.
• Profile Information: Optional profile details you choose to provide, such as a display name or study preferences.
• Payment Information: When you purchase a subscription (RBT Pro or ABA Pro) or physical products from our store, payment is processed securely by Stripe. We do not store your credit card number, CVV, or full payment card details on our servers. Stripe retains your payment information in accordance with PCI-DSS Level 1 compliance standards.
• Communications: Any information you include in emails, support requests, or messages sent to us at abasprout@gmail.com.
• Order Information: Shipping addresses and order details for physical product purchases from our ABA therapy materials store.

2.2 Information Collected Automatically

When you access the Platform, we automatically collect certain information, including:

• Usage Data: Pages you visit, features you use, exam scores, flashcard progress, study streaks, time spent on the Platform, and interaction patterns with our study tools. This data is stored in your account to personalize your learning experience and track your progress.
• Device Information: Your browser type, operating system, device type (mobile or desktop), screen resolution, and language preferences.
• Log Data: Your IP address, access times, referring URLs, and pages viewed. This data helps us maintain security, diagnose technical issues, and analyze aggregate usage trends.
• Cookies and Similar Technologies: We use cookies and local storage to maintain your session, remember your preferences, and analyze usage patterns. See Section 5 for details.

2.3 Information From Third Parties

We may receive limited information from third-party services you use to sign into the Platform (e.g., if you authenticate via Google through Supabase Auth), including your name, email address, and profile picture. We do not receive your password from these providers.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Maintain the Service: To operate the Platform, process your account registration, deliver your purchased products and subscriptions, and ensure the technical functionality of our study tools.
• Personalize Your Experience: To customize your study dashboard, recommend study materials based on your exam performance, track your mastery progress, and adapt content to your skill level through our adaptive quiz and AI tutor features.
• Process Transactions: To process payments for subscriptions and physical products, manage orders, and handle refund requests through our payment processor, Stripe.
• Communicate With You: To send transactional emails (order confirmations, password resets, subscription receipts), respond to support inquiries, and, with your consent, send educational tips or product updates.
• Improve the Platform: To analyze aggregate usage data and trends, identify popular features, fix bugs, and develop new study tools and educational content.
• Ensure Security: To detect and prevent fraud, unauthorized access, and other malicious activity. To enforce our Terms of Service.
• Comply With Legal Obligations: To fulfill any applicable legal, regulatory, or contractual requirements.

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share your information only in the following circumstances:

• Service Providers: We share data with trusted third-party providers who help us operate the Platform. These include:
  • Supabase — Authentication, database hosting, and data storage (hosted on AWS infrastructure in the United States).
  • Stripe — Payment processing for subscriptions and physical product purchases. Stripe is PCI-DSS Level 1 compliant.
  • Vercel — Application hosting and content delivery.
  • Google — Analytics (Google Analytics) and advertising services (Google AdSense). See Section 5 for cookie details.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or governmental regulation, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our Platform of any change in ownership or uses of your personal information.
• With Your Consent: We may share your information for any other purpose disclosed to you at the time we collect the information or with your explicit consent.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience on the Platform. A cookie is a small text file stored on your device by your web browser.

Types of Cookies We Use

• Essential Cookies: Required for the Platform to function properly. These include authentication session cookies (managed by Supabase) that keep you logged in and remember your preferences. You cannot opt out of these cookies without losing Platform functionality.
• Analytics Cookies: We use Google Analytics to collect anonymized data about how visitors use the Platform, including pages visited, time on site, and navigation patterns. This helps us understand which features are most popular and where we can improve. Google Analytics uses its own cookies. You can opt out by installing the Google Analytics Opt-out Browser Add-on.
• Advertising Cookies: We use Google AdSense to display relevant advertisements to free-tier users. AdSense may use cookies to serve ads based on your prior visits to our Platform or other websites. You can manage your ad personalization settings at Google Ads Settings.
• Local Storage: We use your browser's local storage to save study progress (such as flashcard mastery status and exam attempt history) for a faster, more seamless experience. This data stays on your device and is synced with your account when you are logged in.

Managing Cookies

Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all cookies, accept only certain cookies, or delete cookies when you close your browser. Please note that disabling essential cookies may impair Platform functionality, such as the ability to stay logged in.

6. Data Security

We take the security of your personal information seriously and implement industry-standard technical and organizational measures to protect it, including:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS/SSL (Transport Layer Security / Secure Sockets Layer) protocols.
• Encryption at Rest: Your data is stored in Supabase databases hosted on Amazon Web Services (AWS) infrastructure, which provides encryption at rest for all stored data.
• Row-Level Security: We implement row-level security (RLS) policies in our database to ensure that users can only access their own data. This means that even in the event of a data breach, individual user records are isolated.
• Password Security: User passwords are hashed using industry-standard bcrypt algorithms and are never stored in plaintext.
• No Card Storage: Credit card and payment information is processed and stored exclusively by Stripe, which maintains PCI-DSS Level 1 compliance — the highest level of security certification available in the payments industry.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Account Data: Retained for the duration of your account. When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.
• Study Progress Data: Exam scores, flashcard mastery, and study streaks are retained as long as your account is active to provide a continuous learning experience.
• Transaction Records: Purchase history and subscription records may be retained for up to 7 years to comply with tax and accounting regulations.
• Log Data: Server logs and analytics data are automatically purged after 26 months.

8. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information. We are committed to honoring these rights regardless of where you reside.

8.1 Rights for All Users

• Access: You have the right to request a copy of the personal data we hold about you.
• Correction: You have the right to request that we correct any inaccurate or incomplete personal data.
• Deletion: You have the right to request deletion of your account and all associated personal data. You can initiate this from your Account Settings or by emailing us.
• Data Portability: You have the right to request a copy of your data in a structured, commonly used, machine-readable format (JSON or CSV).
• Opt-Out of Communications: You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any email or by contacting us directly.

8.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
• Do Not Sell or Share: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.

8.3 European Union Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), including the rights listed above plus:

• Right to Restrict Processing: You may request that we limit the processing of your personal data in certain circumstances.
• Right to Object: You may object to the processing of your personal data for direct marketing or when processing is based on legitimate interests.
• Right to Lodge a Complaint: You have the right to file a complaint with your local data protection authority.

To exercise any of these rights, please contact us at abasprout@gmail.com. We will respond to your request within 30 days.

9. Children's Privacy

ABA Sprout is designed for use by adults — specifically behavior analysts, behavior technicians, therapy professionals, and students preparing for professional certification exams. Our Platform is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13.

Some of our educational tools (such as ABA therapy games and visual aids) may be used by children during therapy sessions under the direct supervision of a parent, guardian, or qualified behavior analyst. In such cases, we do not require children to create accounts or provide any personal information. All data collection occurs through the supervising adult's account.

If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us immediately at abasprout@gmail.com.

10. Third-Party Links and Services

The Platform may contain links to third-party websites, products, or services that are not owned or controlled by ABA Sprout. These include links to educational resources, the Behavior Analyst Certification Board (BACB®) website, research articles, and external study materials. We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. International Data Transfers

Your personal information is stored and processed in the United States through our infrastructure providers (Supabase/AWS, Vercel, Stripe). If you access the Platform from outside the United States, please be aware that your information may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your country. By using the Platform, you consent to the transfer of your information to the United States.

For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, as well as the data processing agreements of our service providers, to ensure adequate protection of your data.

12. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activity tracked. Because there is no uniform standard for how DNT signals should be interpreted, the Platform does not currently respond to DNT signals. However, you can manage your cookie preferences as described in Section 5 above.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify registered users via email for significant changes.
• Post a prominent notice on the Platform for changes that materially affect how we use your data.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes indicates your acceptance of the updated Privacy Policy.