1. Privacy at a Glance
BDALab collects the account, practice, payment-status, support, and limited technical information needed to operate the service. Practice responses may be processed by an AI provider or a human reviewer when you request those services. Stripe handles payment-card details, Google may handle sign-in, and Resend may deliver transactional email. Internal recent-visit records are deleted after 48 hours. BDALab does not sell personal information.
2. Information You Provide
We may collect your name, email address, password credential, Google authentication identifier, account settings, membership status, support messages, communications, human-review requests, DAT question error reports, BDALab Guarantee claims, official score reports, test dates, and other information you choose to submit. Passwords are stored as salted password hashes rather than readable passwords.
3. Practice and Progress Data
We may process CASPer scenarios and answers, written responses, spoken-response analysis text, timing information, saved attempts, score and quartile estimates, AI feedback, human-review feedback, DAT answers, complete-exam and drill history, questions marked for review, category performance, and related records. Signed-in CASPer attempts and completed DAT attempts may be saved to your account so we can provide history and progress features.
4. Browser and Device Storage
Some information is stored only in your browser or on your device, including in-progress CASPer and DAT exam resumes, local DAT history for signed-out users, language preferences, and local video recordings. Browser storage may include cookies, localStorage, and IndexedDB. This information may not appear on another device and may be lost when browser data is cleared.
5. Video, Audio, and Transcripts
For instant video practice, the recording is designed to remain in your browser for preview and self-review and is not intentionally uploaded to BDALab for AI grading. Spoken-response analysis text may be generated in the browser and sent for grading. If you confirm a video submission for human review, the selected videos are uploaded and stored so an authorized reviewer can assess them. Anyone with access to your device or browser profile may be able to access locally stored recordings.
6. Accounts and Google Sign-In
You may create an account with an email address and password or use Google sign-in where available. When you use Google sign-in, Google provides BDALab with a verified email address, name, and Google account identifier. Google handles the sign-in interaction under its own privacy terms. Session cookies are used to keep you signed in and protect account access.
7. Payments, Memberships, and Credits
Stripe processes checkout and payment-card information. BDALab does not intentionally store full card numbers. We may store Stripe customer and checkout identifiers, plan and price identifiers, payment status, membership dates, and transaction metadata. If a DAT error report is confirmed, we also store the resulting $5 USD store-credit record and its checkout or redemption status.
8. DAT Error Reports and Support
A DAT question error report may include your account identity, the question identifier and prompt, section and category, issue type, your description, review status, administrator notes, and timestamps. This information is used to investigate the report, communicate the result, correct content, prevent duplicate reports, and administer any store credit.
9. Recent Visit Information
For security and a recent-visits view in the admin dashboard, BDALab may record the visited path, visit time, browser user-agent, signed-in account association, an approximate city, region, and country derived from network information, and a keyed one-way hash of the IP address. BDALab does not retain the raw IP address in this internal visit record. These recent-visit records are automatically deleted once they are more than 48 hours old.
10. AI and Human Review
When you request AI feedback, the relevant scenario, questions, answers, language, timing details, and spoken-response analysis text may be sent to Cerebras for processing. When you request human review, the relevant account contact information, scenario, questions, answers, timing details, and any confirmed video uploads may be made available to authorized BDALab reviewers, contractors, or the founder. Do not submit confidential third-party information or sensitive information you do not have the right to share.
11. How We Use Information
We use information to create and secure accounts, authenticate users, provide practice, scoring estimates and feedback, save progress, operate memberships, store credits, and guarantee extensions, process human review, investigate DAT reports and guarantee claims, verify eligibility and official score documentation, send transactional messages, provide support, maintain and improve the service, prevent fraud and abuse, enforce our terms, and comply with legal obligations.
12. Providers and Disclosures
We may disclose information to providers that support hosting, databases, authentication, payments, email delivery, analytics, AI processing, security, error monitoring, and human-review operations. Current examples include Google for optional authentication, Stripe for payments, Cerebras for AI feedback, and Resend for email when configured. We may also disclose information to professional advisers, authorities, or a business successor when reasonably necessary or required by law.
13. Analytics and Similar Technologies
BDALab may use Google Analytics when configured, with IP anonymization enabled, to measure page views and product usage. Analytics providers may use cookies or similar identifiers under their own terms. You can use browser controls to block or delete cookies and site storage, although account sessions, exam resume, video preview, language preferences, or other features may then stop working correctly.
14. Consent and Legal Grounds
Depending on applicable law, we process information with your consent, to provide the service you request, to comply with legal obligations, and for legitimate purposes such as account security, fraud prevention, service reliability, and product improvement. You may withdraw consent where consent is the legal basis, but doing so may prevent us from providing the related feature.
15. Retention
Recent-visit records are deleted after 48 hours. Browser-only information remains until the browser, device, or application removes it. Other account, attempt, purchase, review, report, guarantee-claim, official-score, support, security, and credit records are kept only as long as reasonably needed for the purposes described here, including providing the service, administering guarantee extensions, maintaining accurate records, resolving disputes, preventing abuse, satisfying tax or legal requirements, and maintaining limited backups.
16. Security
We use reasonable administrative, technical, and organizational safeguards, including access controls, signed and protected session cookies, password hashing, request validation, rate limiting, security headers, and third-party payment handling. No online system is perfectly secure. You are responsible for using a strong, unique password and protecting access to your account and device.
17. International Processing
BDALab and its providers may process or store information in Canada, the United States, or other countries. Information processed outside your province, state, or country may be subject to the laws and lawful access rules of the place where it is processed.
18. Your Choices and Rights
Subject to applicable law and appropriate identity verification, you may ask to access, correct, or delete personal information, or ask about its use and disclosure. You may also request portability, restriction, objection, or withdrawal of consent where those rights apply. Legal, security, fraud-prevention, accounting, backup, or operational requirements may limit a request. You may challenge our compliance by contacting the Privacy Lead.
19. Children
BDALab is intended for students preparing for admissions assessments and is not directed to children under 13. If you believe a child under 13 has provided personal information without appropriate authorization, contact us so we can investigate and delete it where appropriate.
20. Changes and Contact
We may update this policy as the service, providers, or legal requirements change. The date above shows the latest revision. BDALab's Privacy Lead is accountable for privacy questions and requests and can currently be reached by direct message to @bdalab.ai on Instagram.