Privacy Policy

1. Introduction

BC Holdings LLC, a District of Columbia limited liability company, doing business as Meridian CPA Review ("Company," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, store, and safeguard your information when you visit our website at www.meridiancpareview.com and use our services, applications, and features (collectively, the "Service").

Please read this Privacy Policy carefully. By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use the Service.

This Privacy Policy applies to information we collect through the Service, in email, text, and other electronic messages between you and the Service, and when you interact with our advertising and applications on third-party websites and services if those applications or advertising include links to this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide when you use the Service, including:

• Account Information: Email address, password (stored in encrypted form), full name, and display name
• Profile Information: Study preferences, target exam sections, exam dates, and NTS (Notice to Schedule) information
• Payment Information: When you make a purchase, our payment processor (Stripe) collects billing information including credit card details; we do not store complete payment card information on our servers
• Communication Data: Information you provide when you contact customer support, submit feedback, respond to surveys, or communicate with us via email
• User-Generated Content: Notes you create on questions, feedback you submit about questions, and feature ideas you share
• AI Interaction Data: Questions you ask the Meridian Navigator AI tutor, study guide requests, and flashcard generation requests

2.2 Information Collected Automatically

When you access or use the Service, we automatically collect certain information, including:

• Device Information: Device type, operating system, unique device identifiers, browser type, browser version, and screen resolution
• Log Data: IP address, access times, pages viewed, links clicked, and the page you visited before navigating to the Service
• Usage Data: Information about how you use the Service, including features accessed, time spent on pages, and interaction patterns
• Study Performance Data: Practice question attempts, scores, accuracy rates, time spent per question, topic performance, mastery levels, study session duration, and streak information
• Exam Simulation Data: Exam simulation attempts, scores, section performance, and debrief results
• Location Data: General geographic location based on your IP address (we do not collect precise GPS location)

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Google OAuth: If you sign in using Google, we receive your email address, name, and profile picture from Google
• Payment Processors: Transaction confirmation and payment status from Stripe
• Analytics Providers: Aggregated and anonymized usage statistics from Google Analytics

2.4 AI Interaction Data

When you use our AI-powered features, we collect:

• Text of questions you submit to the Meridian Navigator AI tutor
• AI-generated responses provided to you
• Study guide generation requests and outputs
• Flashcard generation requests and outputs
• Pre-exam assessment requests and results
• Exam debrief analysis requests and results
• Timestamps and usage frequency of AI features

Note on AI Data: AI interactions are processed by our third-party AI provider, Anthropic. Your data is not used to train their AI models. Conversation logs may be retained for up to 90 days for quality improvement and safety monitoring purposes.

3. How We Use Your Information

We use the information we collect for various purposes, including:

3.1 Providing and Improving the Service

• Creating and managing your account
• Providing access to practice questions, simulations, and study materials
• Personalizing your learning experience through our Prime Meridian adaptive algorithm
• Generating personalized study guides and recommendations
• Tracking your progress and providing performance analytics
• Operating AI features including the Navigator tutor, flashcard generator, and exam debrief
• Sending NTS expiration reminders and score release notifications
• Improving and optimizing the Service

3.2 Communications

• Sending transactional emails (account confirmation, password reset, purchase receipts)
• Sending weekly progress reports (if opted in)
• Responding to your inquiries and support requests
• Sending promotional communications about new features, updates, and offers (with your consent)
• Conducting surveys and collecting feedback

3.3 Business Operations

• Processing payments and preventing fraud
• Analyzing usage patterns and trends to improve the Service
• Conducting research and analytics (using aggregated, anonymized data)
• Enforcing our Terms of Service and other policies
• Complying with legal obligations

3.4 Safety and Security

• Protecting against unauthorized access, fraud, and abuse
• Monitoring for security incidents and responding to threats
• Maintaining the integrity of the Service

4. How We Share Your Information

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Supabase: Database hosting, user authentication, and data storage
• Vercel: Website hosting and content delivery
• Stripe: Payment processing
• Resend: Email delivery services
• Anthropic: AI model provider for Navigator, study guides, and other AI features
• Google Analytics: Website analytics and usage tracking

These service providers are contractually obligated to protect your information and may only use it to provide services to us. They are not permitted to use your personal information for their own purposes.

4.2 Legal Compliance and Protection

We may disclose your information if required to do so by law or in response to valid requests by public authorities, including:

• To comply with a legal obligation, court order, or legal process
• To protect and defend our rights or property
• To prevent or investigate possible wrongdoing in connection with the Service
• To protect the personal safety of users of the Service or the public
• To protect against legal liability

4.3 Business Transfers

If BC Holdings LLC is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

4.4 Aggregated and De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you. This data may be used for industry analysis, research, or other purposes.

5. Data Retention

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specific retention periods include:

• Account Data: Retained while your account is active and for a reasonable period thereafter to allow for account reactivation or to comply with legal obligations
• Practice and Performance Data: Retained while your account is active to provide personalized learning experiences
• AI Conversation Logs: Retained for up to ninety (90) days for quality improvement and safety monitoring
• Payment Records: Retained as required by applicable tax and accounting laws (typically seven years)
• Communication Records: Retained for as long as necessary to resolve support issues and comply with legal requirements
• Analytics Data: Aggregated analytics may be retained indefinitely

When we no longer need your personal information, we will securely delete or anonymize it in accordance with applicable laws.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption: Data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption
• Password Security: Passwords are hashed using secure cryptographic algorithms and are never stored in plain text
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis
• Security Monitoring: We monitor our systems for security incidents and unauthorized access attempts
• Regular Updates: We regularly update our software and systems to address security vulnerabilities
• Incident Response: We have procedures in place to respond to data breaches and security incidents

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, and you provide information at your own risk.

7. Your Rights and Choices

7.1 All Users

Regardless of your location, you have the following rights:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your account and personal information, subject to certain exceptions
• Data Export: Request a copy of your data in a portable format
• Marketing Opt-Out: Unsubscribe from marketing communications at any time via the unsubscribe link in emails or by contacting us
• Cookie Preferences: Manage cookie preferences through your browser settings

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale: We do not sell personal information, but you have the right to opt-out if we ever do
• Right to Limit Use of Sensitive Personal Information: Limit the use and disclosure of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise these rights, contact us at support@meridiancpareview.com. We will respond to verifiable requests within forty-five (45) days. You may designate an authorized agent to make requests on your behalf.

7.3 European Economic Area, United Kingdom, and Switzerland Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or equivalent laws:

• Right of Access: Request access to your personal data
• Right to Rectification: Request correction of inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request restriction of processing of your personal data
• Right to Data Portability: Receive your personal data in a structured, machine-readable format
• Right to Object: Object to processing of your personal data for direct marketing or based on legitimate interests
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects
• Right to Withdraw Consent: Withdraw consent at any time where we rely on consent for processing
• Right to Lodge a Complaint: Lodge a complaint with a supervisory authority

To exercise these rights, contact us at support@meridiancpareview.com. We will respond within thirty (30) days. Our legal bases for processing include: consent, performance of a contract, legitimate interests, and compliance with legal obligations.

7.4 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at:

• Email: support@meridiancpareview.com
• Subject Line: "Privacy Rights Request"

We may need to verify your identity before processing your request. We will respond within the timeframes required by applicable law.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your use of the Service.

8.1 Types of Cookies We Use

• Essential Cookies: Required for the Service to function properly, including authentication and security cookies
• Functional Cookies: Remember your preferences and settings to enhance your experience
• Analytics Cookies: Help us understand how visitors interact with the Service (e.g., Google Analytics)

8.2 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all or some cookies, or to alert you when cookies are being sent. Note that disabling certain cookies may affect the functionality of the Service.

8.3 Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature. At this time, we do not respond to DNT signals. However, you can manage your privacy preferences through browser settings and the choices described in this policy.

8.4 Google Analytics

We use Google Analytics to analyze usage patterns. Google Analytics uses cookies to collect information about your use of the Service. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout

9. Children's Privacy

The Service is not intended for individuals under eighteen (18) years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at support@meridiancpareview.com, and we will take steps to delete such information.

If we learn that we have collected personal information from a child under 18, we will delete that information as quickly as possible.

10. International Data Transfers

Your information may be transferred to, and processed in, countries other than the country in which you reside. Our servers and service providers are primarily located in the United States.

If you are located outside the United States, please be aware that information we collect will be transferred to and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards including Standard Contractual Clauses approved by the European Commission, and our service providers' certifications under applicable data protection frameworks.

11. Third-Party Links and Services

The Service may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to third-party services, and we are not responsible for the privacy practices of any third party.

We encourage you to review the privacy policies of any third-party services before providing any personal information or using such services.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" and "Effective Date" at the top of this policy
• Post the updated policy on the Service
• Where feasible, send email notification to the address associated with your account

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

13. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

We will make every reasonable effort to respond to your inquiry within thirty (30) days.

Summary: Data We Collect and Why