Privacy Policy

1. Definitions

“Personal Data” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identifiable individual. This includes information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws.

“Services” means the ScoreGap website at scoregap.com, the ScoreGap web application, the ScoreGap Chrome browser extension, and any related services, tools, or features we provide.

This Privacy Policy does not cover the practices of third parties we do not own or control, or individuals we do not manage.

2. Personal Data We Collect

The following describes the categories of Personal Data we collect and have collected over the past twelve (12) months.

Sources of Personal Data

We collect Personal Data from the following sources:

• Directly from you: when you create an account, enter test data, write journal entries, post on the forum, or contact us.
• From the Chrome extension: when you use the ScoreGap extension to import practice test results from LawHub, 7Sage, or PowerScore (see Section 6).
• Automatically: through cookies, server logs, and analytics tools when you use the Services (see Section 7).
• From third-party authentication providers: if you sign in via Google, we receive your email address and basic profile information from Google.

3. Uses of Your Personal Data

We use your Personal Data for the following business and commercial purposes:

• Providing and operating the Services
  Creating and managing your account; processing and displaying your practice test data; generating score predictions, analytics, and admissions probability estimates; operating the wrong-answer journal and discussion forum.
• Processing payments
  Processing subscription transactions via our payment processor; managing billing, invoices, and subscription status.
• Communicating with you
  Sending transactional emails (account confirmation, payment receipts, subscription changes); sending product-related emails (onboarding, feature updates, trial reminders); responding to support inquiries.
• Improving the Services
  Analyzing usage patterns to improve features; monitoring for errors and performance issues; conducting internal research and product development.
• Measuring advertising performance
  Using conversion pixels and analytics to measure the effectiveness of advertising campaigns. These tools do not access your LSAT data or identity.
• Protecting the Services
  Detecting and preventing fraud, abuse, and security incidents; enforcing our Terms of Service.
• Meeting legal obligations
  Complying with applicable laws, regulations, legal processes, or governmental requests; protecting our rights or the rights of third parties.

We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated, or incompatible purposes without providing you notice.

4. Sharing of Your Personal Data

We do not sell your Personal Data. We do not rent, trade, or otherwise make your Personal Data available to third parties for their own marketing purposes.

We may disclose your Personal Data to the following categories of recipients:

• Service Providers
  Third parties that perform services on our behalf, including hosting, payment processing, analytics, and email delivery (see Section 5 for a complete list).
• Parties You Authorize
  Third parties you explicitly authorize to access your data, such as when you generate a shareable analytics report link.
• Affiliate Partners
  Our Services may contain links to third-party products and services (admissions consulting, productivity tools, books, etc.) for which we receive a referral commission if you click and subsequently make a purchase. We do not transmit your account email, LSAT® data, or any other Personal Data to these partners. Clicking an affiliate link transfers your browser to the partner's site, where the partner may set cookies on your device under its own privacy policy. We record the click event against your account identifier for our own measurement and deduplication purposes. See our Affiliate Disclosures page for the current list of partners and the nature of our compensation arrangement with each.
• Legal Obligations
  We may disclose Personal Data if required by law, regulation, court order, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers
  In the event of a merger, acquisition, bankruptcy, or sale of all or a portion of our assets, your Personal Data may be transferred to the acquiring entity. We will make reasonable efforts to notify you before your information becomes subject to a different privacy policy and will provide an opportunity to export or delete your data before any transfer occurs.

Aggregated and De-Identified Data

We may create aggregated, de-identified, or anonymized data from the Personal Data we collect by removing information that makes the data personally identifiable to you. We may use such aggregated data for our lawful business purposes, including to analyze, build, and improve the Services. We will not attempt to re-identify such data.

5. Third-Party Service Providers

We rely on third-party service providers to operate the Services. Each provider receives only the data necessary to perform its function. The categories of providers we use include:

• Hosting and Infrastructure Providers
  Cloud hosting, content delivery, and database infrastructure on which the Services run.
• Payment Processors
  Our payment processor receives your payment card information directly from you to process subscription transactions. We do not receive or store your full card number. See Stripe's Privacy Policy for details on how Stripe handles your payment data.
• Analytics Providers
  Web and product analytics services that collect anonymized usage data including pages visited, session duration, feature interactions, and traffic sources. On public marketing pages, our analytics provider may also record anonymized session replays with all text inputs masked; session replay is disabled inside the signed-in application. These services do not access your LSAT® data beyond what is necessary to measure product usage.
• Advertising and Conversion Measurement Providers
  Measure the effectiveness of advertising campaigns. Conversion pixels track whether users who view or click our ads subsequently create accounts. Do not access your LSAT® data or identity.
• Authentication Providers
  If you choose to sign in using a third-party account, the authentication provider shares your email address and basic profile with us to create or authenticate your ScoreGap account.
• Embedded Video Content
  Some lesson pages display curated educational videos hosted on YouTube. A video player loads only after you click to play it, and we use YouTube's privacy-enhanced domain (youtube-nocookie.com), which does not set viewing cookies until you interact with the player. Before you click, no request is made to Google other than loading the video thumbnail image, which is requested without a referrer. When you play a video, YouTube may collect data under Google's Privacy Policy.
• Affiliate Partners (variable)
  Specific affiliate partners are listed in our Affiliate Disclosures section with a link to each partner's own privacy policy. We have a referral relationship with these partners but do not share your Personal Data with them.

6. Chrome Browser Extension

The ScoreGap Chrome extension imports practice test results from LSAC LawHub, 7Sage, and PowerScore (hosted at lms.barbri.com). By installing and using the extension, you authorize it to read score data from those platforms and transmit it to your ScoreGap account. 7Sage and PowerScore access are optional permissions you grant separately in the extension and can revoke at any time.

What the extension accesses

• Score report pages on LawHub (app.lawhub.org and lawhub.lsac.org), 7Sage (7sage.com), and PowerScore (lms.barbri.com)
• Score data displayed on those pages: overall score, section scores, per-question results, question metadata, and time data

What the extension does NOT access

• Your LSAC, 7Sage, or PowerScore login credentials
• Your personal profile, payment information, or registration data on those platforms
• Any content on websites other than LawHub, 7Sage, and PowerScore score report pages

The extension only activates on specific score report pages. It does not run on other websites. Data captured while you are not signed in to ScoreGap is stored locally on your device and is synced to your account only after you authenticate.

7. Cookies and Tracking Technologies

We use cookies and similar technologies (collectively, “Cookies”) to operate the Services, remember your preferences, and understand how the Services are used. Cookies are small data files placed on your device when you access the Services.

Types of Cookies we use

You can control Cookies through your browser settings. Most browsers allow you to refuse new Cookies, delete existing Cookies, and decide on a per-Cookie basis. If you disable essential Cookies, some features of the Services may not function properly.

8. Email Communications

We send the following types of email communications:

You may opt out of non-essential emails at any time by clicking the “Unsubscribe” link in any email, or by updating your preferences in your account settings. We respect the email_optout preference on your account and de-duplicate sends to prevent repeated emails.

9. Data Security

We implement appropriate technical, organizational, and administrative security measures designed to protect your Personal Data from unauthorized access, use, alteration, and disclosure. These measures include:

• All data is transmitted over HTTPS (TLS encryption in transit)
• Data is stored on our hosting provider's secure infrastructure
• Account data is isolated: you can only access your own data
• Passwords are hashed using industry-standard algorithms; we do not store plaintext passwords
• Payment data is handled entirely by a PCI DSS Level 1 certified payment processor

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your Personal Data, we cannot guarantee its absolute security. In the unlikely event of a data breach affecting your Personal Data, we will notify affected users by email within 72 hours of becoming aware of the breach.

10. Data Retention and Deletion

We retain your Personal Data for as long as your account is active or as necessary to provide you with the Services. Specifically:

• Account and test data is retained for the lifetime of your account
• Payment transaction records are retained for the duration required by applicable tax and financial reporting obligations
• Server logs and analytics data are retained for up to 12 months
• Product event records are pruned after 90 days, except a small set of operational markers (one-time entitlement records and email-deduplication markers that prevent repeat sends) kept for the life of the account
• Forum posts remain visible unless you delete them; deleted posts are permanently removed

Your deletion rights

• You can delete individual practice tests from your dashboard at any time
• You can delete your own forum posts and comments at any time
• Pro subscribers can export their data as CSV at any time; any user, regardless of tier, can request a complete copy of their data by emailing support@scoregap.com
• To request complete account deletion and erasure of all associated Personal Data, email support@scoregap.com. We will process deletion requests within 7 days and confirm completion by email.

In some cases, we may retain Personal Data for longer if required to comply with legal obligations, resolve disputes, or enforce our agreements. Where we retain data for these purposes, we limit our use to those purposes.

11. Children's Privacy

The Services are not directed to individuals under the age of 13. We do not knowingly collect or solicit Personal Data from anyone under the age of 13. If you are under 13, please do not attempt to register for the Services or send any Personal Data about yourself to us.

If we learn that we have collected Personal Data from a child under age 13, we will delete that information as quickly as possible. If you believe that a child under 13 may have provided us with Personal Data, please contact us at support@scoregap.com.

12. Your Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”) provide you with specific rights regarding your Personal Data. This section describes your rights and how to exercise them.

Right to Know and Access

You have the right to request that we disclose certain information to you about our collection and use of your Personal Data over the past 12 months, including: the categories of Personal Data collected; the categories of sources from which it was collected; our business or commercial purpose for collecting it; the categories of third parties with whom we share it; and the specific pieces of Personal Data we collected about you.

Right to Delete

You have the right to request that we delete any of your Personal Data that we collected from you and retained, subject to certain exceptions. We may deny your deletion request if retaining the information is necessary for us or our service providers to complete a transaction, detect security incidents, comply with a legal obligation, or make other internal and lawful uses compatible with the context in which you provided the information.

Right to Correct

You have the right to request correction of inaccurate Personal Data that we maintain about you.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. Unless permitted by law, we will not deny you goods or services; charge you different prices or rates; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate or different level or quality of goods or services.

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us by emailing support@scoregap.com with the subject line “CCPA Request.” Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Data. We will respond to verifiable consumer requests within 45 days of receipt. If we require more time (up to 90 days), we will inform you in writing of the reason and extension period.

13. Do Not Sell or Share My Personal Information

We do not sell your Personal Data. We have not sold any Personal Data in the preceding twelve (12) months. We do not share your Personal Data with third parties for cross-context behavioral advertising as defined by the CPRA.

Our affiliate referral relationships do not constitute a sale or share of Personal Data under the CCPA or CPRA. When you click an affiliate link, we record the click event against your account identifier for our own deduplication and measurement, but we do not transmit your email address, LSAT® data, account identifier, or any other Personal Data to the partner. The partner sees only your IP address and browser headers, the same as any other visit. Any cookies set by the partner after click-through are set by the partner under its own privacy policy and do not constitute a sale or share by us. See our Affiliate Disclosures for the current list of partners.

14. Affiliate Disclosures

What is an affiliate link?

Some links on our Services send you to third-party products or services. If you click one of these links and subsequently make a purchase from the third party, we may receive a referral commission. These are called “affiliate links.”

Every affiliate placement on our Services is marked with a “Sponsored” label. We make these disclosures because the Federal Trade Commission's Endorsement Guides (16 CFR Part 255) require clear disclosure of material connections between us and the products we link to. Receiving a commission does not change the price you pay.

Why we use affiliate links

Affiliate revenue supports ongoing development of the free tier of our Services. It is one of several revenue streams (alongside Pro subscriptions and direct sponsorships) that funds the work needed to keep ScoreGap available without charging every user. We are selective about which partners we work with. The goal is to surface tools, services, and resources that our users would benefit from regardless of any commission we receive.

How we choose partners

We apply the following rules to every affiliate partner we work with:

• Manual approval. We review every potential partner by hand. We do not participate in programmatic affiliate networks, ad exchanges, or display-advertising marketplaces.
• No direct competitors. We do not enter affiliate relationships with services that compete with ScoreGap's Pro tier (LSAT® preparation courses, LSAT® tutoring services, LSAT® analytics platforms).
• Per-category exclusivity. We work with at most one partner per category at a time (e.g., one admissions consulting partner, one productivity tool partner). This prevents the Services from becoming an advertising aggregator and lets us recommend a partner without hedging.
• Quality of the underlying product. We will not affiliate with a service we would not recommend to a friend.
• Right to end any relationship. We retain the right to end any affiliate relationship at any time, with or without cause. Past commission earned is not reversed; future commission stops on the day we end the relationship.

Current affiliate partners

We do not currently have any active affiliate partners. When we do, each partner will be listed here with its name, category, link to its privacy policy, and the nature of our compensation arrangement.

15. Changes to This Policy

If we make any changes to this Privacy Policy, we will post the updated Policy here and update the “Effective Date” at the top of the page. Your continued use of the Services after we post an updated Policy constitutes your acceptance of the updated Policy.

In the event of an acquisition or merger, we will provide notice and an opportunity to export or delete your data before your Personal Data becomes subject to a materially different privacy policy.

16. Contact Information

If you have any questions about this Privacy Policy, your Personal Data, or wish to exercise your privacy rights, please contact us: