Privacy & data handling
Built privacy-first. The default is on-device processing; uploads are opt-in with short retention. Rule pack v2026.1.
What we process
The free preflight runs entirely in your browser. Course data you type or paste is processed on-device by a deterministic rule engine and is never uploaded. We do not see your transcript.
What we store
Only an email address you voluntarily provide (for the free summary or a report offer) and the minimum payment records handled by Paddle, our Merchant of Record. No transcript content is stored by us at any point in the validation phase.
Retention
Email addresses are retained only as long as needed to deliver your summary and a follow-up offer, then removed. Paste-input data never leaves your device and is cleared when you close the page.
Your rights: export & deletion
You can export your preflight report at any time (JSON / print). To request deletion of your email from our records, contact us and we will remove it within 30 days. No user impersonation is ever performed (PRD #28).
Subprocessors
Lemon Squeezy (payments & tax, Merchant of Record), PostHog (privacy-safe funnel analytics — no transcript or email content), and your hosting/CDN provider. Analytics payloads never include PII (PRD #32).
Breach response
If a data incident affecting stored emails occurs, affected users are notified without undue delay and the incident is documented. Because transcript content is never stored, its exposure is not a risk vector.
Important limitation
CPAPath is not an official determination. The Texas State Board of Public Accountancy (TSBPA) makes all final decisions, including whether specific course content counts.