Privacy Policy

1. Who we are

EyeTech Prep is operated by Cor Stellaris LLC, 15300 Dismuke Ave Unit 4D, Biloxi, MS 39532, USA. In this policy, “we,” “us,” and “our” refer to Cor Stellaris LLC, and “the Service” refers to the EyeTech Prep website and installable web app.

We are the controller of the personal information described in this policy. If you have questions about it, or want to exercise any of the rights described in Section 9, contact us:

• contact@cor-stellaris.com — Privacy questions, data access requests, and deletion requests.

2. Information you give us

Account information

When you create an account we collect your name and email address. Accounts are handled by our authentication provider, Clerk. If you sign up using Google or another social login, we receive your name and email address from that provider, but never your password.

Payment information

Subscriptions are processed by Stripe. Your card number is entered directly into Stripe and is never transmitted to or stored on our servers. We store only the identifiers Stripe gives us for your customer and subscription records, your plan tier, whether you have used a free trial, and the date any cancellation took effect.

Things you choose to tell us

• ●Your answer to our one-question survey asking how you found us.
• ●The reason you select if you cancel a subscription, and any comment you add.
• ●Any message you send us by email or through support.

3. Information created as you use the Service

The Service is a study tool, so most of what we store is a record of your studying. This is what makes progress tracking, the spaced-repetition review queue, and weak-area analysis work:

• ●Practice tests and exam simulations you take, including your score, the question set, and your per-category results.
• ●Your answer history for individual questions, and the review schedule derived from it.
• ●Gamification data: experience points, daily streaks, achievements, game scores, and daily challenge leaderboard entries.
• ●AI explanation requests and daily usage counts, used to enforce plan limits and to cache repeated explanations.
• ●Referral codes, who referred you, and any referral credits earned.
• ●Email delivery events, such as whether a message we sent you was delivered or opened, and whether you have unsubscribed from marketing email.

Technical information collected automatically

• ●Standard server and hosting logs, including IP address, browser type, and pages requested.
• ●Usage analytics through Google Analytics 4, such as which pages you visit and which features you use.
• ●Advertising click identifiers (for example a Google Ads gclid) stored in a first-party cookie for up to 90 days so we can tell which ads lead to signups.
• ●Data stored locally in your own browser, including your recent test history when you are signed out. This stays on your device and can be cleared by clearing your browser data.

4. How we use this information

• ●To provide the Service: your account, your study history, your progress analytics, and your study plan.
• ●To process payments, manage subscriptions and free trials, and prevent trial abuse.
• ●To send you transactional email such as receipts, trial reminders, and billing notices. You cannot opt out of these while you hold an account, because they concern your subscription.
• ●To send you study tips, product updates, and offers, if you have not unsubscribed. Every marketing message includes an unsubscribe link, and unsubscribing takes effect immediately.
• ●To understand which features are used and where people get stuck, so we can improve the product.
• ●To measure the effectiveness of our advertising and decide where to spend.
• ●To detect, investigate, and prevent fraud, abuse, and security incidents, and to comply with the law.

5. We do not sell your personal information

We do not sell your personal information, and we do not rent, trade, or otherwise disclose it to data brokers, list brokers, lead generators, recruiters, or advertisers. We have never done this and we are not registered as a data broker in any state.

If we ever change this, we will update this policy, notify registered users by email before the change takes effect, and provide the opt-out mechanisms required by law. We will not apply any such change retroactively to information collected beforehand without your consent.

We may publish aggregate, de-identified statistics about how the Service is used — for example, average scores by exam topic, or the share of users who pass on their first attempt. These figures never identify any individual, are not derived from any single user, and cannot reasonably be linked back to you. We do not attempt to re-identify de-identified data and we require anyone we share it with to do the same.

6. Service providers we share information with

We share personal information with the companies below only so they can perform services for us, and only to the extent each one needs. They are bound by contract to protect it and may not use it for their own purposes.

• Clerk — Account creation and sign-in. Receives your name and email address.
• Stripe — Payment processing and subscription billing. Receives your name, email address, and payment details.
• Supabase — Database hosting for your account record and study history.
• Vercel — Website hosting. Processes request logs including IP addresses.
• Resend — Email delivery. Receives your name and email address.
• Google (Analytics and Ads) — Usage analytics and advertising measurement. See Section 7 for what is sent and how to opt out.
• Anthropic — Powers the AI answer explanations. Receives only the exam question and its answer choices — no name, email, account identifier, or score is ever sent.

We may also disclose information when we are legally required to — in response to a valid subpoena, court order, or lawful government request — or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of our users or the public.

If we are ever involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction. We will notify registered users by email before any such transfer takes effect, and the acquirer will remain bound by this policy until you are given notice of, and a chance to object to, any change.

7. Cookies, analytics, and advertising

We use a small number of cookies and similar technologies. Strictly necessary cookies keep you signed in and are required for the Service to function. Beyond those, we use Google Analytics 4 to understand usage, and Google Ads to measure which advertisements lead to signups.

Enhanced conversions

When you subscribe, we report the conversion to Google Ads. Where enhanced conversion measurement is enabled, your email address is converted into an irreversible SHA-256 hash on our server before transmission. Google uses that hash to match the conversion to an ad click. Your plain email address is never sent to Google.

Your choices

• ●You can opt out of Google Analytics entirely using Google's browser add-on at tools.google.com/dlpage/gaoptout.
• ●You can manage or turn off personalized advertising in your Google account at myadcenter.google.com.
• ●We honor the Global Privacy Control (GPC) browser signal. If your browser sends one, we treat it as a request to opt out of any sharing of your information for cross-context behavioral advertising.
• ●You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will sign you out and prevent the Service from working.

8. How long we keep information

• ●Account and study data is kept for as long as your account exists, so your progress is still there if you return after a break.
• ●If you delete your account, we delete your account record and study history within 30 days, except where we must keep something longer.
• ●Payment and transaction records are retained by us and by Stripe for at least seven years, because tax and accounting law requires it. Deleting your account does not remove these.
• ●Server logs are retained for a short period, typically 30 days.
• ●Aggregate, de-identified statistics may be kept indefinitely, because they no longer identify anyone.

9. Your rights and how to use them

Wherever you live, we extend the following rights to every user of the Service rather than only to residents of states that mandate them:

• ●Access — ask for a copy of the personal information we hold about you.
• ●Correction — ask us to fix information that is inaccurate.
• ●Deletion — ask us to delete your account and the personal information associated with it.
• ●Portability — ask for your study data in a portable, machine-readable format.
• ●Opt out of marketing — use the unsubscribe link in any marketing email, or change the setting in your account.
• ●Opt out of sale or sharing — we do not sell personal information, and honoring the Global Privacy Control covers sharing for advertising purposes.
• ●Non-discrimination — we will not degrade the Service, change your price, or deny you anything for exercising these rights.

To exercise any of these, email contact@cor-stellaris.com from the address on your account, or use the account settings page. We respond within 45 days and will tell you if we need longer. We may ask you to verify your identity before acting on a request, which for most requests simply means confirming control of your account email. An authorized agent may submit a request on your behalf with written proof of authorization.

State privacy laws

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights listed above under those laws, including the right to appeal a refusal. If we decline a request, our response explains why and how to appeal; if an appeal is denied you may complain to your state attorney general. Under the California Consumer Privacy Act, the categories of information we collect are identifiers, commercial information, internet activity, and inferences drawn from your study performance. We collect these for the business purposes described in Section 4, and we do not sell them.

10. Security

All traffic to the Service is encrypted in transit using TLS, and data is encrypted at rest by our hosting and database providers. Access to production systems is limited to people who need it. Card data never touches our servers.

No online service can promise perfect security, and we do not. If we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

11. Children

The Service is intended for adults pursuing professional certification as an ophthalmic or paraoptometric assistant, and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, email us and we will delete it promptly.

12. Where your information is processed

We operate in the United States and our service providers process information there. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

13. Changes to this policy

We may update this policy as the Service changes. The date at the top always reflects the current version. If we make a material change — particularly one that broadens how we use or disclose your information — we will email registered users before it takes effect. Continuing to use the Service after that point means you accept the updated policy.