Privacy Policy

This Policy applies to personal data processed through IBAC services, including the website; public, free-account, and Pro resources; question banks, lecture notes, past-paper tools, and study features; tutoring, revision courses, and exam-preparation services; IA support; account, progress, bookmarking, and subscription features; AI-assisted educational features; customer support and contact forms; and files or materials you choose to submit.

This Policy does not govern the independent privacy practices of third-party websites or services that you visit or use directly.

The information we collect depends on how you use IBAC.

Account and identity information

We may collect your name or display name, email address, username or account identifier, authentication-provider information, account creation and login information, account status and access tier, and information necessary to maintain and secure your account.

If you use Google Sign-In, we may receive information made available through the permissions used for authentication, such as your name, email address, profile identifier, and profile image. We do not receive your Google password.

Where email-and-password authentication is supported through our authentication provider, passwords are handled using the security mechanisms of that provider. IBAC does not need to know your plaintext password.

Educational and activity information

We may collect subject and course selections, questions viewed, bookmarks, completion status, learning progress, time-spent or similar progress information, resource-access history, preferences, filters, and other interactions with learning features.

Purchase and subscription information

We may receive or maintain Stripe customer identifiers, subscription identifiers, plan or product information, subscription status, billing interval, transaction and payment status, purchase dates, renewal and cancellation information, refund information, and limited payment metadata made available by Stripe.

IBAC does not normally receive or store your full payment-card number. Payment-card information is processed by Stripe.

Tutoring, support, and communications

We may collect your name and contact information, messages and support requests, tutoring inquiries, scheduling information, course or subject information, communications with tutors or staff, feedback and reviews, and information you voluntarily provide in connection with the service requested.

Files and user submissions

If you upload or send materials to us, we may process IA drafts, homework or practice work, images, PDFs or other documents, questions, screenshots, feedback requests, and files attached to tutoring or support communications.

Please do not submit highly sensitive personal information unless it is genuinely necessary for the service you are requesting.

AI interactions

If you use an AI-enabled feature, we may process the prompt or question you submit, files or context you choose to provide, AI-generated responses, feedback about AI responses, identifiers needed to operate the feature, and associated technical information.

AI-related information may be transmitted to third-party AI or infrastructure providers used to provide the feature.

Technical, device, and usage information

IBAC and its service providers may automatically collect technical information such as IP address, browser type, device type, operating system, date and time of access, referring and exit pages, pages or resources viewed, interactions with website features, approximate location inferred from IP address, cookie or similar identifiers, and error, performance, and security logs.

We may collect personal data directly from you; automatically through use of the website; from authentication, payment, hosting, communication, analytics, or infrastructure providers acting for us; from Google when you choose Google Sign-In; from Stripe in connection with payments and subscriptions; and from third-party communication platforms when you choose to contact us through them.

Where personal data is obtained from a source other than you, we will handle it in accordance with applicable law.

We may use personal data to create and authenticate accounts; provide public, free, and paid access; save progress, bookmarks, and preferences; process purchases, subscriptions, renewals, cancellations, and refunds; provide tutoring and academic support; respond to questions and support requests; provide AI-enabled educational features; communicate service notices, receipts, and account information; send marketing or promotional communications where permitted; protect accounts and prevent fraud; diagnose technical problems; improve educational resources and user experience; comply with legal, tax, accounting, consumer-protection, and regulatory obligations; establish or defend legal claims; and protect the rights, safety, security, and integrity of IBAC and its users.

We aim to collect and use only the personal data reasonably necessary for the relevant purpose.

Where Taiwan’s Personal Data Protection Act (“PDPA”) applies, IBAC collects and processes personal data for specified purposes and on applicable legal grounds, which may include consent, a contractual or quasi-contractual relationship, compliance with legal obligations, use of information lawfully made public, purposes that do not infringe the rights and interests of the data subject, and other grounds permitted by law.

When consent is used as the basis for a particular activity, you may withdraw that consent subject to applicable law and without affecting processing that was lawful before withdrawal.

We will not use personal data for an unrelated new purpose unless that use is permitted by law or we provide any additional notice or obtain any additional consent that is legally required.

Account and authentication data

Purpose: account creation, authentication, security, access control, and account administration. Typical recipients: IBAC, Supabase, Google where Google Sign-In is used, Squarespace where relevant, and technical service providers. Territory: Taiwan and other jurisdictions where our service providers operate or store data. Retention: generally while your account remains active and afterward for a reasonable period when necessary for security, legal compliance, dispute resolution, backup, or recordkeeping.

Learning and progress data

Purpose: bookmarks, completion, progress, personalization, resource access, troubleshooting, and service improvement. Typical recipients: IBAC, Supabase, Squarespace, and infrastructure providers. Territory: Taiwan and other jurisdictions where providers process or store data. Retention: generally while your account remains active and for a reasonable period afterward unless deletion is requested or longer retention is justified.

Payment and subscription data

Purpose: purchases, recurring billing, cancellation, refunds, fraud prevention, accounting, and customer support. Typical recipients: IBAC, Stripe, and financial institutions involved in payment processing. Territory: may include jurisdictions outside Taiwan in which Stripe and related payment providers operate. Retention: as reasonably necessary for transaction administration and tax, accounting, chargeback, fraud-prevention, and legal obligations.

Tutoring, support, and submitted files

Purpose: respond to requests, provide tutoring or academic support, review submitted work, schedule services, resolve support issues, and maintain appropriate service records. Typical recipients: IBAC team members or tutors who need the information, Resend or other communication providers, Google Drive where used, and other providers necessary for the requested service. Territory: Taiwan and other jurisdictions where those providers process or store information. Retention: as long as reasonably needed to provide and document the requested service, resolve disputes, comply with law, or maintain appropriate records.

AI interaction data

Purpose: provide AI-assisted educational functions, maintain context, troubleshoot, prevent abuse, and maintain security. Typical recipients: IBAC, Supabase or other infrastructure providers, and the AI service provider(s) used to generate or process responses. Territory: Taiwan and jurisdictions in which the relevant AI or infrastructure provider processes data. Retention: depends on the feature and provider. We seek to avoid retaining identifiable AI interaction data longer than reasonably necessary.

Technical, cookie, and security data

Purpose: site operation, analytics, security, fraud prevention, performance monitoring, debugging, and service improvement. Typical recipients: IBAC, Squarespace, Supabase, and other hosting, analytics, security, or infrastructure providers. Territory: Taiwan and other jurisdictions where those providers operate. Retention: for a period appropriate to the relevant security, analytics, or operational purpose.

IBAC and the platforms supporting the website may use cookies, local storage, pixels, or similar technologies to keep users signed in, remember settings, operate security features, preserve sessions, measure site performance, understand how resources are used, and support website functionality.

Some cookies are necessary for website or account features to function. You can control cookies through your browser and, where available, through a website privacy-preference tool. Disabling certain cookies may cause parts of the website to function incorrectly.

IBAC may use analytics available through Squarespace and other technical providers to understand website performance and resource usage. Analytics information may include page views, referral information, device or browser information, approximate location derived from IP address, and interactions with website features.

Where applicable law requires consent for non-essential analytics technologies, IBAC will seek to implement an appropriate consent mechanism.

IBAC does not sell or rent users’ personal data.

We may provide data to service providers that perform functions for us, including:

• Squarespace — website hosting, site functionality, and related services;
• Supabase — authentication, database, account, subscription-status, and learning-progress infrastructure;
• Stripe — payments, subscriptions, refunds, fraud prevention, and transaction processing;
• Resend — transactional or service email delivery;
• Google — Google Sign-In, Google Drive, and related services;
• AI service providers — processing required to provide AI-enabled educational features;
• LINE and WhatsApp — when you choose to communicate with us through those services;
• Instagram and Facebook/Meta — when you interact with our social accounts or choose to communicate through those platforms; and
• other technical, security, communication, or professional providers reasonably necessary to operate IBAC.

We may also disclose information when reasonably necessary to comply with law, investigate fraud or security incidents, enforce our Terms, protect rights and safety, or establish or defend legal claims.

If IBAC is reorganized, registered as a new entity, merged, sold, transferred, or otherwise changes ownership or structure, personal data may be transferred as part of that change, subject to applicable law and appropriate notice where required.

Payments are processed through Stripe. When you enter payment-card information in Stripe’s payment interface, Stripe receives and processes that information. IBAC generally receives transaction status, customer and subscription identifiers, payment-method metadata, and information necessary to administer the purchase, but does not normally receive your complete card number.

Stripe’s own privacy practices apply to information it processes independently.

If you choose Google Sign-In, Google authenticates your account and provides IBAC with the information authorized for the sign-in process, such as your email address and account identifier. IBAC does not receive your Google account password.

If Google Drive is used to provide, receive, or share documents, Google may process information associated with that access according to Google’s own policies and the permissions applied to the relevant file or link.

AI features may require user prompts, files, or selected educational context to be sent to an AI service provider. You should not include unnecessary sensitive personal data in AI prompts.

AI interaction data may be used to return requested responses, maintain conversational or educational context, identify technical problems, prevent abuse, improve IBAC’s implementation of the feature, and comply with legal or security obligations.

We do not intend to use a student’s private uploaded work to train an IBAC-owned general-purpose AI model unless we first provide clear notice and obtain any consent required by law.

Third-party AI providers may have their own retention and processing practices. Where the provider used by IBAC changes in a material way, we may update this Policy or provide additional notice.

User Submissions may contain personal data about you or another person. Upload only information relevant to the educational or support service you are requesting and that you have the right to share.

If a document contains information about classmates, teachers, family members, research participants, or other individuals, you are responsible for ensuring that you are permitted to provide that information.

Where practical, remove unnecessary names, student numbers, addresses, medical details, or other sensitive information before uploading academic work.

IBAC does not ask users to provide medical records, healthcare data, genetic data, information about sex life, criminal records, or other specially protected categories of personal data as a normal condition of using the website.

Please do not submit such information unless it is genuinely necessary and you have been specifically asked to provide it for a lawful purpose. If specially protected data is received, we will handle it only as permitted by applicable law.

The services used to operate IBAC are provided by companies that may store or process data outside Taiwan.

Accordingly, personal data may be processed in Taiwan, the United States, or other countries or territories in which our service providers maintain infrastructure or personnel. Data-protection laws in those jurisdictions may differ from Taiwan law.

IBAC will handle cross-border transfers in accordance with applicable law and will not use an overseas transfer to circumvent Taiwan’s PDPA.

We do not use one retention period for every type of information. We consider whether your account is active, whether information is necessary to provide a service, whether a transaction or subscription remains open, legal and accounting requirements, security and fraud-prevention needs, dispute-resolution needs, backup cycles, and deletion requests.

When the purpose for collecting personal data no longer exists and continued retention is not otherwise permitted or required, we will delete, de-identify, or cease using the data as appropriate.

Some information may remain temporarily in backups or logs until those systems cycle.

Subject to applicable law, you may have rights concerning personal data held by IBAC.

Under Taiwan’s Personal Data Protection Act, these rights include:

• the right to inquire about and review your personal data;
• the right to request a copy;
• the right to supplement or correct inaccurate personal data;
• the right to request cessation of collection, processing, or use; and
• the right to request erasure.

To exercise a privacy right, contact contact@ib-academic-center.com or use www.ib-academic-center.com/support.

We may need to verify your identity before acting on a request. We will respond within the periods required by applicable law and may refuse or limit a request only where permitted by law.

Depending on where you live, additional privacy rights may apply.

We may send service-related messages reasonably necessary for your account, purchase, subscription, tutoring service, security, or legal notices.

Where permitted, we may also send newsletters, course announcements, resource updates, or promotional messages. You may opt out of marketing email through the unsubscribe link in the message or by contacting us.

Opting out of marketing does not prevent essential transactional or service communications.

IBAC’s educational services are primarily designed for secondary-school students, and some users may be minors.

We do not impose a general minimum age for browsing educational resources. However, where applicable law requires parent or guardian authorization for the collection of a minor’s personal data or for a particular service, we will require that authorization.

For users in the United States, IBAC does not knowingly collect personal information online from a child under 13 in circumstances where the Children’s Online Privacy Protection Act (“COPPA”) requires verifiable parental consent, without obtaining the required consent.

If we learn that personal information was collected from a child in violation of applicable child-privacy law, we will take appropriate steps to delete or restrict that information.

A parent or guardian who believes a child has provided personal data improperly may contact contact@ib-academic-center.com.

IBAC uses reasonable administrative, technical, and organizational measures intended to protect personal data against unauthorized access, alteration, loss, disclosure, or misuse.

Measures may include authentication and access controls, managed hosting and database services, encryption in transit where supported, payment processing through Stripe rather than direct storage of full card data, access restrictions based on operational need, logs and monitoring for security or abuse, and account restrictions where suspicious activity is detected.

No online system can be guaranteed to be completely secure. You are responsible for using a strong password, protecting your login credentials, and avoiding reuse of the same password across unrelated services.

If IBAC becomes aware that personal data has been stolen, altered, damaged, lost, leaked, or otherwise compromised, we will investigate and take reasonable steps to contain and address the incident.

We will notify affected individuals and make legally required reports to competent authorities when required by applicable law.

The website may link to Google Drive, LINE, WhatsApp, Instagram, Facebook, payment pages, or other external services.

When you leave IBAC or choose an independent third-party platform, that provider’s privacy policy and terms govern its own processing activities.

IBAC is not responsible for the independent privacy practices or security of third-party services outside our control.

IBAC does not sell personal data as part of its ordinary business model.

Based on IBAC’s current service configuration, this Policy does not describe a Google Ads or remarketing program.

If IBAC later introduces targeted advertising, remarketing, sale or sharing of personal information for advertising, or similar practices, we will update this Policy and implement any notice, consent, opt-out, or preference mechanism required by applicable law before using those practices.

We may update this Privacy Policy to reflect changes in our services, the personal data we collect, service providers, AI functionality, payment or authentication methods, security practices, business structure, or applicable law.

The current version will be posted on this page with an updated “Last updated” date.

If a change materially affects how we use personal data, we will provide additional notice or obtain consent where required by law.

For privacy questions, requests, complaints, or legal notices relating to personal data:

IB Academic Center Operated by the IB Academic Center team in Taiwan Email: contact@ib-academic-center.com Customer Support: www.ib-academic-center.com/support Website: www.ib-academic-center.com