Privacy Policy

1. Information We Collect

We collect information in the following ways:

Information You Provide Directly

• Email address — collected when you sign up for our community list or create an account;
• Payment information — when you purchase a subscription, payment is processed by Stripe. We receive only a tokenized reference and partial card digits; we never store your full card number;
• Feedback and questions — any content you submit through our feedback or question forms.

Information Collected Automatically

• Usage data — pages visited, time spent, exam attempts, and feature interactions;
• Device and browser data — browser type, operating system, and screen resolution;
• IP address — used for geo-restriction enforcement, security, and analytics;
• Session data — stored locally in your browser (localStorage/sessionStorage) to manage exam state and preferences;
• Session recordings — we use third-party analytics and session recording tools to capture your on-screen interactions, including pages and sections you visit, clicks, scrolls, navigation patterns, screen activity visible during your session, device and browser identifiers, and form interactions (with sensitive fields masked or excluded).

1a. Session Recording and User Interaction Data

We use third-party analytics and session recording tools to better understand how visitors use our website and to improve functionality, usability, and overall user experience. These tools may capture information such as:

• Pages and sections you visit;
• Clicks, scrolls, and navigation patterns;
• Screen activity visible during your session;
• Device, browser, and technical identifiers;
• Form interactions (with sensitive fields masked or excluded).

These recordings are used solely for analytics, troubleshooting, and service improvement. Our service providers process this information on our behalf and are contractually restricted from using it for any other purpose. By using our website, you acknowledge that your interactions may be recorded for these purposes.

2. How We Use Your Information

We use the information we collect to:

• Deliver and improve our practice exam, flashcard, and study tools;
• Process and confirm subscription payments through Stripe;
• Send account-related communications such as receipts and support responses;
• Enforce geographic access restrictions (U.S. only);
• Analyze usage patterns to identify issues and improve the user experience;
• Respond to support inquiries and feedback submissions;
• Comply with legal obligations.

We do not use your information for unsolicited marketing without your consent.

3. Sharing of Information

ThriveRBT does not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. We may share limited data with:

• Stripe — to securely process subscription payments;
• Hosting and infrastructure providers — to operate the platform;
• Analytics services — to understand aggregate site usage (in anonymized or aggregated form where possible);
• Legal authorities — when required to comply with applicable laws, court orders, or regulatory requests;
• Business successors — in the event of a merger, acquisition, or transfer of assets, with prior notice to users.

4. Cookies & Local Storage

We use cookies and browser local/session storage to support site functionality, remember your preferences, and track usage analytics. For a full breakdown, please see our Cookie Policy.

5. Data Retention

We retain your information only for as long as necessary for the purposes described in this policy:

• Purchase and subscription records: retained for 5 years to meet tax and accounting requirements;
• Support and feedback communications: retained for 2 years after the matter is resolved;
• Analytics and usage logs: retained for up to 12 months, after which they are anonymized or deleted;
• Session recordings: retained for up to 12 months, after which they are deleted from our service provider's systems.

When data is no longer needed, we securely delete or anonymize it.

6. Data Security

We implement industry-standard security measures to protect your data, including HTTPS encryption for all data in transit and access controls to limit who can view stored information. Payment data is handled exclusively by Stripe and is never stored on our servers. While we take security seriously, no system is completely immune to risk, and we cannot guarantee absolute security.

If a data breach occurs that poses a risk to your rights or information, we will notify affected users in a timely manner as required by applicable law.

7. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you;
• Correction: Request that inaccurate information be corrected;
• Deletion: Request that your data be deleted, subject to any legal retention obligations;
• Opt-out of session recording: You may discontinue use of the Services if you do not wish your interactions to be recorded. We do not currently offer a separate in-site opt-out toggle for session replay;
• Opt-out of email communications: Unsubscribe from any marketing or community emails at any time via the unsubscribe link in the email.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to non-discrimination for exercising these rights. We do not sell or share your personal information with third parties for their own marketing purposes. Session recording data is shared only with service providers acting under contract on our behalf, which does not constitute a "sale" under CCPA.

Virginia, Colorado, Connecticut, and Other U.S. State Residents

Residents of states with applicable consumer privacy laws (including Virginia VCDPA, Colorado CPA, and Connecticut CTDPA) have similar rights to access, correct, delete, and opt out of certain processing. To exercise any of these rights, please contact us through the support options available on our website. We will respond within 45 days as required by applicable law.

8. Children's Privacy

ThriveRBT is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has submitted information through our platform, please contact us and we will delete it promptly.

9. Geographic Scope

ThriveRBT is intended for users in the United States only. We use IP-based geolocation to restrict access from outside the U.S. By using our Services, you acknowledge that your approximate location may be checked as part of this process.

10. Updates to This Policy

We may revise this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. Continued use of ThriveRBT after any changes take effect constitutes your acceptance of the updated policy.

11. Contact

If you have questions, concerns, or requests relating to this Privacy Policy, please contact us through the support options available on our website.