Legal · Privacy Policy
But For · Privacy Policy
Effective date: July 31, 2026
1. The short version
We collect the minimum needed to run a study platform: your email, your purchase record, and your practice data. We don't sell your data, we don't run ads, and we never share your performance data with bar examiners, law schools, or employers. Payment card details go to Stripe, not to us.
2. What we collect
- Account: your email address (used for sign-in links and receipts) and optional name.
- Purchases: what you bought, when, and its status, via Stripe. We receive confirmation and a customer reference, never your full card number.
- Practice data: your answers, confidence tags, error tags, timing, and scores: the product's core function.
- Email list: if you request the free report or updates, your email and subscription status.
- Technical: standard server logs (IP, browser type, timestamps) for security and debugging; session cookies required for sign-in. For measurement we use Vercel Web Analytics, which is cookieless: it records page views and a few named events (for example, submitting the email form), sets no cookies, and builds no cross-site profile of you. We run no advertising trackers.
3. How we use it
To operate the Service (sign-in, entitlements, scoring, review queues); to send transactional email (sign-in links, receipts, purchase-related notices); to send the content you asked for (reports, updates) with unsubscribe honored in every message; to fix bugs and secure the Service; and to improve the product using aggregated, de-identified performance statistics (e.g., item difficulty calibration). De-identified aggregates never identify you.
4. What we don't do
No sale of personal data. No third-party advertising or ad trackers. No sharing of individual performance data with anyone (schools, employers, examiners) absent your explicit request or legal compulsion.
5. Who touches your data (processors)
Service providers acting on our instructions: Stripe (payments), Supabase (database and authentication), Resend (transactional email), Vercel (hosting). Each receives only what its function requires. We may disclose information if the law genuinely requires it, or to protect the Service from fraud or abuse.
6. Retention
Account and practice data: kept while your account is active and for 24 months after, then deleted or de-identified. Purchase records: kept as required for tax and accounting. Email list: until you unsubscribe. You can request deletion sooner; see §7.
7. Your rights
Email support@butfor.ai to access, correct, export, or delete your personal data. We honor requests within 30 days, verified against your account email. Depending on where you live, you may have additional statutory rights (e.g., under state consumer-privacy laws); we honor the substance of access/deletion/portability requests for everyone, regardless of jurisdiction.
8. Security
Access controls, encryption in transit, row-level security on user data, and payment handling delegated entirely to Stripe. No system is perfect; if a breach affects your data, we will notify you as the law requires.
9. Children
The Service is for adults preparing for the bar exam and is not directed to anyone under 18; we do not knowingly collect children's data.
10. Changes
Material changes will be posted here with a new effective date; continued use after notice constitutes acceptance.
Contact: But For · support@butfor.ai