Privacy Policy & Data Protection
Our commitment to document confidentiality, zero-storage ephemeral in-memory processing, and strict global compliance.
1. Zero-Retention In-Memory Processing Architecture
BankMyBook is architected with a strict privacy-first principle: your raw source textbook PDF documents are never permanently uploaded, hosted, or retained on our web servers.
Text extraction is performed client-side directly within your web browser memory using isolated Web Workers. Only transient, anonymized conceptual excerpts required for the specific question batch are processed during generation. Once batch synthesis completes, all temporary buffer memory is purged immediately.
BankMyBook operates as a technical utility software. We do not maintain or build a public repository, mirror, or distribution library of uploaded textbooks.
2. Information We Collect
We collect only the minimum personal data strictly necessary to authenticate your account and manage your generation reserves:
- Account Identifiers: First name, surname, email address, and encrypted password hash (salted `bcrypt`).
- OAuth Data: If you choose Google Single Sign-On (SSO), we receive your verified Google account email and unique subject identifier token.
- Generation Activity Logs: Metadata regarding authored testbanks (textbook title, question count, difficulty distribution, and generation timestamp) saved to your private account history for download access.
- Financial Ledger: Transaction references, invoices, and credit purchase records. We never see or store full credit card numbers or banking secrets.
3. How We Use Your Information
Your information is used strictly for legitimate SaaS operating purposes:
- To provision, authenticate, and maintain your account access.
- To compile, format, and deliver your generated PDF examination testbank packages.
- To record credit top-ups, issue official tax invoices, and maintain an immutable balance ledger.
- To send transactional emails (e.g. password resets, support ticket replies, and top-up receipts).
- To protect the integrity of our platform against automated abuse, fraud, or unauthorized credential stuffing.
We do not sell, rent, or monetize your personal data or uploaded textbook excerpts with third-party advertisers or data brokers under any circumstances.
4. Document Confidentiality & Academic Integrity
Educational materials, syllabi, and unpublished manuscripts processed through your BankMyBook account remain strictly private:
- Your generated testbanks and question files are accessible only via authenticated sessions under your specific user ID.
- All compiled PDF archives are streamed via authenticated endpoints (`serve_pdf.php`) that enforce strict ownership validation.
- You can permanently delete any testbank generation record and its compiled PDF from your Generation History at any time with one click.
5. Payment Security & Financial Processors
Credit purchases and billing top-ups are processed through industry-certified payment gateways:
- Stripe: Card transactions are handled directly through Stripe's PCI-DSS Level 1 compliant vault. Credit card numbers never touch our servers.
- PayPal: Standard Web Checkout and REST API automated captures are executed over encrypted TLS 1.3 tunnels via PayPal's official enterprise infrastructure.
- Cryptocurrency & Bank Wires: Peer-to-peer blockchain transfers and direct wire transactions are verified through unique invoice references.
6. Cookies & Local Storage
We use technical cookies and browser local storage strictly for essential user preferences:
- Session Cookie (`PHPSESSID`): Secure, `HttpOnly`, and `SameSite=Lax` cookies to maintain authenticated login state.
- Theme Preference (`bmb_theme`): Remembers your Light / Dark mode visual preference across visits.
- Notification State (`bmb_notifs_viewed_state`): Tracks viewed alert timestamps so notification dots do not repeatedly distract you once acknowledged.
7. Compliance with FERPA, GDPR & CCPA
BankMyBook adheres to international data protection principles:
- FERPA Compliance (USA): Because source documents are parsed in local browser memory without persistent student record storage, our platform complies with Family Educational Rights and Privacy Act requirements.
- GDPR (European Union): Users have the right to access, rectify, export, or request the complete deletion of their account and associated ledger data (Right to be Forgotten).
- CCPA / CPRA (California): California residents have the right to request disclosure of personal data categories collected and guarantee non-discrimination for exercising privacy rights.
8. Infrastructure & Technical Safeguards
We implement comprehensive defense-in-depth security standards:
- End-to-End Encryption: All platform traffic is forced over HTTPS using modern TLS 1.3 cipher suites.
- SQL Injection Prevention: 100% of database transactions utilize parameterized prepared statements via PHP Data Objects (PDO).
- Password Cryptography: Passwords are protected using adaptive key-stretching cryptographic hashing (`PASSWORD_DEFAULT` with bcrypt).
- Cross-Site Scripting (XSS) Hardening: All user-supplied strings are escaped via `htmlspecialchars()` prior to rendering.
9. DMCA & Intellectual Property Inquiries
BankMyBook respects the intellectual property rights of textbook publishers, academic presses, and authors. Because our platform does not host, index, or distribute public files, user activity is restricted to private examination creation.
For legal inquiries or copyright compliance questions, please contact our designated agent directly at [email protected].
10. Privacy Officer & Contact Information
If you have questions regarding this Privacy Policy, wish to exercise your data rights, or require an institutional Data Processing Agreement (DPA), please contact:
[email protected] / [email protected]