Privacy Policy

1. Information We Collect

We collect information you provide directly (name, email, profile data) and usage data (pages visited, lessons completed, feature usage) to improve your learning experience. When you visit our public website we also collect the website data described in section 5.

2. How We Use Your Information

Your information is used to personalize your learning experience, track progress, provide AI tutoring through JAX, process payments, and improve platform features.

3. Data Storage & Security

Your data is stored securely using Supabase with row-level security policies. We use encryption in transit and at rest. We never sell or share your account, learning, assessment or JAX conversation data. Data from visits to our public website can be sold or shared with advertising partners as section 6 explains, and you can opt out at any time.

4. AI & JAX Conversations

Conversations with JAX AI are stored to provide continuity and improve tutoring quality. You can delete your conversation history at any time from your account settings.

5. Cookies and Website Measurement

When you visit our public website (drivialearn.com's marketing pages, not the signed-in product) we collect:

• a random visitor id and a random session id, stored in first-party cookies (see the table below);
• the pages you view and the page that referred you;
• campaign parameters in the link you followed (for example utm_source) and the click id an ad network adds to an ad link;
• an approximate location (country and region) derived from your IP address, a one-way hash of your IP address, and your device and browser type;
• when you sign up or buy: a one-way hash of your email address, never the address itself, linked to your visitor id.

We use it to measure which of our pages and ads bring people who sign up, and, only where advertising is allowed, to tell an advertising partner that a visit from one of its ads led to a sign-up or purchase so it can measure and show our ads.

No cookie holds your name or email. The dmk_ cookies are set by our server on our public marketing pages only. Where the law requires your agreement first (the European Economic Area, the United Kingdom and Switzerland), we set only the strictly necessary cookies until you choose.

We never use advertising or measurement tools inside signed-in learning areas, on accounts of anyone under 18, or on any area a school or family provides for younger learners.

6. Sale and Sharing of Personal Information

Drivia may sell or share personal information from visits to our public website (online identifiers such as the visitor id and ad click ids, device and browsing data, and a hashed email address) with advertising partners for cross-context behavioral advertising. It happens in two ways: an advertising partner's tag (a small script) that runs in your browser on our public pages, and a server-to-server upload of a conversion (a sign-up or purchase) with the identifiers above. Under California law this can be a “sale” as well as “sharing”, so we say both.

We send nothing to any advertising partner:

• before you have agreed, where the law requires agreement first;
• after you opt out, or while your browser sends a Global Privacy Control signal;
• about anyone signed in, anyone we know to be under 18, or from any page for children or families.

Our advertising partners: None at present. We name each partner here before we send it anything, together with a link to its own privacy controls.

We never sell or share your account, learning, assessment or JAX conversation data.

7. Your Rights

You have the right to access, correct, or delete your personal data. You can export your learning progress and account data from your account settings. Erasing your account also deletes the hashed emails, visitor links and queued advertising uploads tied to your email, and removes you from everything we send to advertising partners from then on. It does not delete data an advertising partner already received from us: that data is deleted through the partner's own privacy controls, linked from its entry in section 6.

8. Adaptive Learning & H2E Intelligence

Drivia uses an adaptive learning layer (H2E — Human-to-Expert Intelligence) that analyzes your learning patterns, intent, and performance to personalize AI tutoring. This includes tracking mastery levels per concept, session velocity, and interaction quality. All H2E data is private to your account and never shared with other users, instructors, or third parties. Enterprise administrators can view aggregate learning analytics but not individual AI conversation data.

9. Enterprise Data Handling

Enterprise organizations receive data isolation via V-RIM (Virtual Resource Integrity Model) partitioning. Organization data, student data, and assessment data are stored in separate logical partitions with strict access controls. Assessment records are retained for 5 years for compliance purposes. Student conversation history is never accessible to organization administrators.

10. Education Records (FERPA)

Drivia handles education records for educational institutions under contract-scoped data processing terms. When Drivia is used by an educational institution, the institution controls whether Drivia is designated as a school official with legitimate educational interest under its policies and DPA. We do not disclose student education records without authorization. Students and parents/guardians may request access to education records, request amendment of inaccurate records, and opt out of directory information sharing through the institution's process. Educational institutions may request a Data Processing Agreement (DPA) at support@drivia.consulting.

11. COPPA and Under-13 Use

Drivia is designed for users aged 13 and older. We do not knowingly collect personal information from children under the age of 13. If you believe a child under 13 has provided personal information to Drivia, please contact us at support@drivia.consultingand we will promptly delete the information. Educational institutions using Drivia for students under 13 must obtain verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA).

12. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, disclose, sell and share; the right to delete it; the right to correct inaccurate personal information; the right to opt out of the sale and the sharing of your personal information; and the right not to be discriminated against for using any of these rights. We do not use or disclose sensitive personal information to infer characteristics about you or for any purpose that gives rise to a right to limit it; if that ever changes, we will offer that choice here first.

We treat a Global Privacy Control signal from your browser as a valid request to opt out of the sale and sharing of your personal information. You can make any request in two ways: from Settings, under Privacy, when you are signed in, or by email to support@drivia.consulting. You can use an authorized agent to make a request for you. We will respond to verifiable consumer requests within 45 days.

13. Your Rights in Other US States

Wherever you live in the United States, including in states with their own privacy laws such as Connecticut, Colorado, Virginia, Oregon and Texas, you can: opt out of the sale of your personal information, of targeted advertising and of profiling that produces legal or similarly significant effects; ask to know, get a copy of, correct or delete your personal information; use an authorized agent; and not be treated differently for using any of these rights. We honor a Global Privacy Control signal as a valid opt-out of sale, sharing and targeted advertising for residents of every state alike.

We do not process the personal data of anyone we know to be under 18 for targeted advertising, and we do not sell it.

Appeals. If we decline a request, we tell you why and how to appeal. Reply to our decision or write to support@drivia.consulting with “Appeal” in the subject line. We answer an appeal within the time your state's law sets and tell you what we decided and why. If we deny your appeal, you can contact your state's attorney general; we include the contact details in our answer.

14. Your Privacy Choices

You can opt out of the sale and sharing of your personal information at any time:

• turn on Global Privacy Control in your browser or a browser extension: we honor it as an opt-out on every page of this website, with nothing else to do;
• email support@drivia.consulting with “Do not sell or share” in the subject line, or, when signed in, use Settings, under Privacy;
• use each advertising partner's own privacy settings, linked from section 6;
• delete our cookies in your browser.

The “Your privacy choices” link at the foot of every public page brings you here.

15. How Long We Keep Website Data

Raw website records are kept for 13 months. Daily totals with no identifiers are kept. An account under a legal hold is kept until the hold ends.

16. Contact

For privacy-related inquiries, contact support@drivia.consulting.