Privacy Policy
Last updated August 20, 2026
This Privacy Policy explains how FifthTerm ("we," "us," or "our") collects, uses, shares, and protects personal information when you use the FifthTerm website, applications, and services (the "Service").
1. Who is responsible for your data
Data controller:
FifthTerm — a sole proprietorship based in Toronto, Ontario, Canada Email: support@fifthterm.com
We will provide our full registered name and address on written request, and to any consumer or data protection authority entitled to it.
Canadian users: we are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). You may contact our privacy officer at support@fifthterm.com, and may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
2. Information we collect
2.1 Information you give us
| Category | Examples |
|---|---|
| Account | First and last name, email address, password (stored only as a salted hash — we never see or store it in readable form) |
| Profile and study settings | Target score, target test date, daily study capacity, section preferences |
| Your content | Notes, review-log entries, flagged questions, error annotations |
| Communications | Messages you send to support, including their contents and any attachments |
| AI tutor input | Questions you ask the AI tutor and the lesson or question context in which you ask them |
2.2 Information generated by your use
| Category | Examples |
|---|---|
| Study activity | Answers submitted, correctness, time spent per question, question difficulty, position within a test, attempts, retries |
| Progress and performance | Chapter and lesson completion, test and mock scores, accuracy by topic and difficulty, estimated score ranges, flashcard mastery state |
| Plan and billing status | Plan type, purchase date, renewal or expiry date, payment status, last four digits and brand of your card (received from our payment processor) |
2.3 Information collected automatically
| Category | Examples |
|---|---|
| Device and technical | IP address, browser type and version, operating system, device type, screen size, language |
| Usage | Pages viewed, features used, session timestamps, referring page, error and crash reports |
| Approximate location | City or region level, derived from IP address. We do not collect precise GPS location. |
2.4 Information we do not collect
We do not collect your full payment card number, government identification, biometric data, precise geolocation, or special-category data (such as health, race, religion, or political opinions). Please do not submit such information to us.
3. How and why we use your information
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and administer your account | Performance of a contract |
| Deliver lessons, questions, tests, and mocks | Performance of a contract |
| Generate your study plan, adaptive path, analytics, and estimated score | Performance of a contract |
| Provide AI-assisted explanations and tutoring | Performance of a contract |
| Process payments, manage renewals and expiry, issue receipts | Performance of a contract; legal obligation |
| Send service and transactional emails (confirmation, password reset, receipts, expiry notices) | Performance of a contract |
| Provide customer support | Performance of a contract; legitimate interests |
| Detect, prevent, and investigate fraud, abuse, and security incidents | Legitimate interests; legal obligation |
| Maintain and debug the Service | Legitimate interests |
| Improve the Service, including using aggregated or de-identified data | Legitimate interests |
| Send marketing or product-update emails | Consent (you may withdraw at any time) |
| Comply with tax, accounting, and other legal obligations | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object at any time (Section 9).
4. Automated decision-making and profiling
The Service uses automated processing to personalise your experience. Specifically, it:
- places you at a starting level based on a diagnostic assessment;
- selects and sequences chapters, lessons, and questions based on your performance;
- adjusts question difficulty within adaptive assessments;
- calculates estimated score ranges, accuracy breakdowns, and readiness indicators; and
- generates written insights about your strengths, weaknesses, and pacing.
These are study-support features. They do not produce legal effects or similarly significant effects on you within the meaning of Article 22 GDPR. Estimated scores are approximations for practice only and are not official predictions.
You may contact us at support@fifthterm.com to obtain an explanation of how a particular result was produced, or to express your point of view.
5. Who we share information with
We do not sell your personal information. We do not share it for cross-context behavioural advertising.
We share information with the following categories of recipients:
5.1 Service providers (processors)
| Provider | Role | Data involved | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account, study data, your content | See our subprocessor page |
| Vercel | Application hosting and delivery | Technical and usage data, request logs | Global edge network |
| Stripe | Payment processing | Name, email, billing details, transaction data | US / global |
| Anthropic | AI-generated explanations and tutoring | Your tutor queries and the related question or lesson context | US |
| Resend | Transactional email delivery | Name, email address, email content | US / EU |
Each processor is bound by a contract requiring it to protect your information and to process it only on our instructions.
AI provider note: Content sent to our AI provider through its business API is not used to train that provider's models.
5.2 Other disclosures
We may disclose information where we reasonably believe it is necessary to:
- comply with applicable law, regulation, legal process, or an enforceable governmental request;
- enforce our Terms of Service, including investigating potential breaches;
- detect, prevent, or address fraud, security, or technical issues;
- protect the rights, property, or safety of FifthTerm, our users, or the public; or
- effect a merger, acquisition, financing, reorganisation, or sale of assets — in which case we will require the recipient to honour this Policy, and will notify you before your information becomes subject to a materially different policy.
6. International transfers
We are established in Canada. Canada holds an adequacy decision from the European Commission for commercial organisations subject to PIPEDA, meaning personal data may be transferred from the EEA to us without additional safeguards.
Our service providers also process data in the United States and other countries. Where personal data is transferred to a country without an adequacy decision, we rely on:
- the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where applicable; and
- technical and organisational measures including encryption in transit and access controls.
You may request details of the relevant safeguards by emailing support@fifthterm.com.
7. How long we keep information
| Data | Retention period |
|---|---|
| Account and profile | While your account is active, then deleted or de-identified within 90 days of account deletion |
| Study and performance data | While your account is active, then deleted or de-identified within 90 days of account deletion |
| Your content (notes, review log) | Deleted with your account |
| Transaction and invoice records | 7 years from the transaction, to meet tax and accounting obligations |
| Support correspondence | 3 years from last contact |
| Security, access, and audit logs | 12 months |
| AI tutor queries | 30 days, then deleted or de-identified |
| Marketing consent records | Until consent is withdrawn, plus 3 years as proof of consent |
| Backups | Overwritten on a rolling 35-day cycle |
Where we de-identify data for analytics or product improvement, we do so irreversibly and do not attempt to re-identify it.
8. Security
We use administrative, technical, and organisational measures appropriate to the risk, including:
- encryption of data in transit (TLS) and at rest;
- passwords stored only as salted hashes, never in readable form;
- row-level access controls restricting each user's data to that user;
- least-privilege access to production systems;
- separation of development and production environments; and
- regular dependency and vulnerability patching.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Breach notification. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it where required, and will notify you without undue delay where the risk is high.
9. Your rights
Subject to your location and applicable law, you may have the right to:
- Access — obtain a copy of the personal information we hold about you
- Rectification — correct inaccurate or incomplete information
- Erasure — request deletion of your information
- Restriction — limit how we process your information
- Portability — receive your information in a structured, machine-readable format, or have it transmitted to another controller
- Object — object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent — where processing is based on consent, without affecting prior processing
- Not be discriminated against — for exercising any of these rights
How to exercise them. Email support@fifthterm.com. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice). We may need to verify your identity before acting.
Authorised agents. You may use an authorised agent to submit a request. We may require proof of authorisation and verification of your identity.
Right to complain. If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority. A list of EEA authorities is maintained by the European Data Protection Board; in the UK, the authority is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.
10. Additional disclosures for California residents
Under the CCPA/CPRA, in the preceding 12 months we have collected the following categories of personal information:
| CCPA category | Collected | Source | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers (name, email, IP) | Yes | You; automatic | Account, security, support | Hosting, email, payment providers |
| Customer records (billing details) | Yes | You, via processor | Payment | Payment processor |
| Commercial information (purchases) | Yes | You | Billing, plan management | Payment processor |
| Internet activity (usage, device) | Yes | Automatic | Operate and secure the Service | Hosting provider |
| Geolocation (approximate, city level) | Yes | Automatic | Security, localisation | Hosting provider |
| Inferences (performance profile, estimated score) | Yes | Derived | Personalise the Service | Hosting provider |
We have not sold or shared personal information for cross-context behavioural advertising in the preceding 12 months, and we do not do so. We do not knowingly sell or share the personal information of anyone under 16.
California residents have the rights to know, delete, correct, and opt out, and to limit use of sensitive personal information — though we do not collect sensitive personal information as defined by the CPRA. To exercise these rights, email support@fifthterm.com.
11. Cookies and similar technologies
We use the following categories:
| Category | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Keep you signed in, maintain your session, secure the Service, remember your cookie choices | No |
| Preferences | Remember settings such as language and display options | Yes |
| Analytics | Understand how the Service is used so we can improve it | Yes |
Where required by law, we request your consent before setting non-essential cookies, and you may change or withdraw your choices at any time via the cookie settings link in the footer. You can also control cookies through your browser, though disabling strictly necessary cookies will prevent the Service from working.
We do not use advertising or cross-site tracking cookies.
12. Children's privacy
The Service is intended for users aged 18 and over. Users aged 13 to 17 may use the Service only with the consent and supervision of a parent or legal guardian, who accepts our Terms of Service on their behalf.
We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with information, contact support@fifthterm.com and we will delete it promptly.
Parents and guardians of users aged 13 to 17 may contact us to review, correct, or delete their child's information.
13. Marketing communications
We send transactional emails necessary to operate your account — confirmation, password reset, receipts, and plan expiry notices. These are not marketing and cannot be opted out of while your account is active.
Marketing or product-update emails are sent only with your express consent. In compliance with Canada's Anti-Spam Legislation (CASL), every such message identifies us, provides our contact information, and includes a working unsubscribe link that we honour within 10 business days. You may withdraw consent at any time.
14. Changes to this Policy
We may update this Policy. For material changes, we will notify you through the Service or by email at least 14 days before they take effect, and update the "Last updated" date above. We will keep prior versions available on request.
15. Contact
FifthTerm Toronto, Ontario, Canada Email: support@fifthterm.com
For data protection inquiries, please use the subject line "Privacy Request."