Privacy
What we collect, why, and what we delete.
Draft. This describes how the product is designed to handle data. It must be reviewed against Mongolia's Law on Personal Data Protection before launch, and the sections marked TO DRAFT still need text.
The short version
Student card images are deleted
A student card is a minor's identity document. We check it, set your discount, and delete the image. We keep only school name, grade and expiry date.
Voice recordings are deleted after transcription
Your speaking answers are transcribed, marked, and then the audio is deleted. We keep the transcript and the feedback, which is what your readiness score is built from.
Your work is not used to train AI models
We use paid AI services with training opted out, specifically because our users are substantially minors submitting essays and voice recordings. We do not run on free API tiers that permit training on submitted data.
We don't sell anything to anyone
No selling of personal data, no advertising networks, no sharing your results with a school unless you asked us to.
On this page
1. What we collect
- Account details
- Your email address, your name if you give it, and your chosen language.
- Study data
- Your practice answers, daily-plan completion, readiness scores and mock results.
- Submitted work
- Essays you write and voice recordings you make for marking, plus the feedback produced from them.
- Prior test scores
- If you tell us, the test type, score and date — used only to advise which band to buy. Nothing is locked or unlocked by it.
- Student verification
- A photo of your student card, temporarily; then only school name, grade and expiry date.
- Payment
- Which bundle you bought, when, and any code used. Card details are handled by the payment processor, not by us.
- Test results you send us
- Your Test Report Form, if you choose to send us one.
2. Why we collect it
- To place you at the right band and build your daily plan.
- To mark your work and produce feedback you can act on.
- To calculate your readiness score and show you where you stand.
- To apply your student discount or promo code correctly.
- To improve how well our readiness score predicts real results — using aggregated, anonymised data.
- TO DRAFT — the lawful basis for each purpose under Mongolian data protection law, and where consent is required versus contract performance.
3. How long we keep it
| Data | Kept for |
|---|---|
| Student card image | Deleted as soon as verification is decided |
| Voice recordings | Deleted after transcription and marking |
| Essays, transcripts and feedback | While your account is open |
| Study and readiness data | While your account is open |
| Purchase records | As long as tax and accounting law requires |
| Test Report Form you send us | Deleted once we have recorded the result |
When you close your account we delete your personal data, keeping only what tax and accounting law requires us to keep, and anonymised aggregates that cannot identify you.
4. Students under 18
A large share of our users are school students, so we treat this as the default rather than the exception. Student card images — identity documents belonging to minors — are stored in a private location readable only by the reviewing administrator, and are deleted as soon as verification is decided. Nothing valuable is gated on an unverified claim about age.
TO DRAFT — minimum age to hold an account, how parental consent is captured for paid bundles, and how a parent can request access or deletion.
5. Who else touches your data
We use a small number of service providers to run StudyPass: a database and file host, an AI provider for marking, a speech-to-text provider, a content delivery network, and a payment processor. They process data on our instructions only.
Our AI and transcription providers are paid services with training on submitted data turned off. We do not use free API tiers, because their terms generally permit training on what is submitted.
TO DRAFT — the named list of providers, which country each stores data in, and the data-processing agreement in place with each.
6. Your rights
- Ask for a copy of the data we hold about you.
- Ask us to correct anything that is wrong.
- Ask us to delete your account and your data.
- Withdraw consent where we relied on it.
- Complain to us first — and to the relevant authority if we don't put it right.
Write to privacy@studypass.mn and we will respond within 30 days.
7. Security
- Data is encrypted in transit and at rest.
- Access to your records is restricted at the database level to you and to authorised administrators.
- Uploaded identity documents sit in a private location, not on a public URL.
- TO DRAFT — breach notification process and timeline.
8. Contact
Privacy questions and data requests: privacy@studypass.mn. Anything else: hello@studypass.mn.
TO DRAFT — registered company name and address, and a named data protection contact.