Privacy Policy

This Privacy Policy explains how Uri Rozen ("I", "me", "the seller") collects, uses, and protects your information when you use BoardsBridge ABA Applied Exam Pass (the "Service") at boardbridge.live.

Payments for the Service are processed by Paddle.com (Merchant of Record). Paddle is the Merchant of Record for all transactions and is the data controller for the payment and checkout information you submit. This policy covers the information I collect and control as the seller.

Information I collect

• Account information: the email address and authentication identifier you provide when you sign up (via email/password or Google sign-in through Supabase Auth).
• Practice and session data: your oral-board practice transcripts, AI examiner turns, debriefs, and progress markers you generate while using the Service.
• Usage and analytics: page views, acquisition attribution, and product analytics events used to measure and improve the Service.
• Technical data: device type, browser, and approximate location derived from your IP address for security and analytics.

I do not collect or store your full payment card number, CVV, or billing address. Those are submitted directly to Paddle at checkout and never touch my servers.

How I use your information

• To create and maintain your account and grant access to the Service.
• To deliver, personalize, and improve the oral-board practice experience.
• To send transactional messages about your account, access, and the Service.
• To detect, prevent, and respond to fraud, abuse, and security issues.
• To measure product performance and develop new features.

Legal bases (EU/UK/Israel)

If you are in the EU, UK, or Israel, I process your personal data on the following bases: performance of a contract (to deliver the Service you purchased), my legitimate interests (security, fraud prevention, and product improvement), your consent (for optional analytics), and legal obligations (tax and record-keeping). You may withdraw consent for optional analytics at any time by emailing the address below.

Service providers

I rely on the following categories of processors to operate the Service:

• Paddle — Merchant of Record for payments; processes checkout, billing, and refund information under its own privacy policy.
• Supabase — authentication and the application database hosting account and session data.
• Neon — the canonical durable database for account, access, and session records.
• LLM and AI providers — generate examiner turns and debriefs from your session transcripts. Transcripts are sent to these providers solely to produce your practice output.
• Analytics and observability providers — receive pseudonymous usage events.

Each processor is bound by obligations to protect your data and to process it only on my instructions for the purposes described here.

Data retention

I keep your account and session data for as long as your account is active and for a reasonable period afterward to fulfill the purposes above, comply with legal obligations, and resolve disputes. You may request deletion of your account and associated data at any time by emailing the address below.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data; object to or restrict certain processing; and withdraw consent. To exercise any of these rights, email the address below. I will respond within 30 days.

International transfers

Your data may be processed in the United States, the European Union, or Israel depending on the provider. Where required, I rely on appropriate safeguards (such as standard contractual clauses) for transfers outside your jurisdiction.

Security

I use reasonable technical and organizational measures to protect your data, including encrypted transport (TLS), access controls, and separation of payment data (handled by Paddle) from application data. No method of transmission or storage is fully secure, but I work to protect your information consistent with industry practice.

Children's privacy

The Service is intended for licensed physicians and physicians in training preparing for professional board exams. I do not knowingly collect personal data from children under 16. If you believe a child has provided me with personal data, email the address below and I will delete it.

Changes to this policy

I may update this Privacy Policy from time to time. I will post the updated version here with a revised "Last updated" date and, for material changes, notify you in the Service or by email.

Contact

If you have questions about this Privacy Policy or your personal data, email support@boardbridge.live.