Privacy Policy

Last updated: October 29, 2026

This policy explains how 1001085583 Ontario Inc., an Ontario corporation operating as ExamElephant ("ExamElephant," "we," "us"), handles personal information on examelephant.com and the ExamElephant study platform. We are responsible for that information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

The short version

We collect what's needed to run a study platform: your account details, your practice activity and, once paid passes open, your purchase records. If you join the paid-pass waitlist, we keep your email to tell you when they open.
We don't sell your data, and we don't run advertising trackers or third-party analytics on the site.
Once paid passes open, payments go through Stripe — your card number never touches our servers.
Question performance statistics are aggregated and de-identified before anyone else sees them.
Email support@examelephant.com to access or delete your data.

1. What we collect

Account information: email address, name, password (stored only as a bcrypt hash), and optionally a mailing address and avatar image if you add them to your profile.
Study activity: the tests you build and take, your answers, scores, timing, flags, notes to the ElephantGPT assistant, and the retest schedule the engine derives from your misses. This is the product — the elephant has to remember what you missed.
Purchase records (once paid passes open): which pass you bought or were granted, when, and the Stripe checkout session reference. Stripe processes the payment itself and shares only what we need to grant access.
Paid-pass waitlist: if you join, your email address, the exam and pass you were interested in, the page you joined from, the date, and the exact consent wording you agreed to. Canada's anti-spam law (CASL) requires us to keep that consent record.
How you found us: on your first visit we note the site that referred you, any campaign tags in the link you followed (such as utm_source), and the page you arrived on. This is kept in your browser and saved to your account if you sign up, so we can see which guides and channels bring people in.
Emails we send: account emails — password resets, receipts, and study digests if you enable them. If you join the waitlist (on our site, in the app, or by ticking the box when you sign up), we will send you a confirmation and then email you when paid passes open. Every such email includes a one-click unsubscribe, which removes your address from the list. We never sell or share our email list.
Server logs: standard technical logs (IP address, user agent, request paths) kept briefly for security and debugging.

2. Cookies and local storage

We use no advertising or cross-site tracking cookies. The site stores exactly five things in your browser:

ee_token (browser local storage): your sign-in token.
ee_source (browser local storage): the first-visit details described above (referring site, campaign tags, landing page).
ee_authed (cookie): a yes/no flag that tells our server whether to show you the public landing page or the app. It contains no personal data.
ee_landing_retry (browser session storage): a one-time marker that stops a redirect loop on the home page. It contains no personal data and clears when you close the tab.
ee_gate (cookie, pre-launch only): remembers that you entered the private-preview password.

3. How we use your information

To run the Service: schedule retests, score exams, compute your readiness analytics, and grant purchased access.
To improve question quality: answer data is aggregated into per-question statistics (difficulty, discrimination, timing) used to find and fix bad questions.
To communicate with you about your account (transactional email).
To email you when paid passes open, if you joined the waitlist. You can withdraw that consent at any time.
To understand which guides and channels bring people to ExamElephant, using the first-visit details above.
To keep the Service secure and debug problems.

4. Instructors and creators

If you join ExamElephant through an instructor or creator's referral link, or take question sets they published, that creator can see your name, your activity on their content, and roster-level progress — the same way a teacher sees their class. Your activity on the main ExamElephant bank is shown to creators only in aggregated, de-identified form.

5. Service providers

We share data only with the processors that run the Service, and only what each needs:

Stripe — payment processing, once paid passes open.
Amazon Web Services — hosting and database (United States, us-east-1).
Resend — delivery of transactional email.
Anthropic — only when our AI features are switched on: the question you're viewing and what you ask the ElephantGPT tutor, and questions that instructors upload for an automated quality check, are sent to the Claude API. Under Anthropic's API terms, this data is not used to train its models.

We may also disclose information if the law requires it, or as part of a business transfer (in which case this policy continues to apply).

We do not sell personal information, and we do not share it with advertisers.

Where your data is stored. Our servers and database are in the United States (AWS us-east-1), and our service providers may process data in the United States or other countries. Information stored outside Canada is subject to the laws of those countries and may be accessible to their courts and authorities.

6. Retention and deletion

Your account and study history are kept while your account exists — spaced retesting needs your history to work. Delete your account by emailing support@examelephant.com; we will remove your personal data within 30 days, keeping only what we must retain (for example, purchase records for tax and accounting) and de-identified question statistics, which no longer relate to you.

Waitlist entries are kept until you unsubscribe or ask us to remove you.

7. Your rights

Depending on where you live (including under GDPR and CCPA), you may have rights to access, correct, export, delete, or restrict the use of your personal data. Email support@examelephant.com and we'll honor these requests for everyone, regardless of jurisdiction. You also have the right to complain to your local data-protection authority.

Under PIPEDA you can ask to see the personal information we hold about you and to correct it, and you can withdraw your consent (for example, by leaving the waitlist) at any time. If you are not satisfied with how we handle a request, you can complain to the Office of the Privacy Commissioner of Canada.

8. Security

Passwords are stored only as bcrypt hashes; traffic is encrypted with TLS; access tokens are signed and expire; payment details are handled entirely by Stripe. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you as the law requires.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

10. Changes and contact

If we change this policy materially we'll give notice (email or in-app) before the change takes effect. Questions or requests go to our privacy officer at support@examelephant.com. 1001085583 Ontario Inc. (operating as ExamElephant), Ontario, Canada.