Who we are

Pinnacle Prep ("Pinnacle", "we", "us") is an AI-powered adaptive learning platform for CFA, FRM, ACCA, and CPA candidates, trading as Pinnacle Prep, from Johannesburg, South Africa.

Contact: support@pinnacle-prep.org

What we collect

Why we collect it

Study data powers your adaptive coaching and spaced repetition schedule — we can't personalise your prep without it. Analytics help us improve the product. Error tracking helps us fix bugs faster.

Who we share data with

Supabase — database & auth (Data Processor, DPA in place) Anthropic — AI question generation (Data Processor, DPA in place) Dodo Payments — payments (Data Processor, DPA in place) PostHog — analytics, consent-gated (Data Processor, DPA in place) Sentry — error monitoring (Data Processor, DPA in place) Resend — transactional email (Data Processor, DPA in place) OpenAI — live voice tutoring (Data Processor) Deepgram — speech-to-text (Data Processor) ElevenLabs — speech synthesis (Data Processor) Netlify — website hosting (Data Processor)

We send Anthropic only the topic and difficulty parameters needed to generate questions — no user PII is transmitted. We do not sell your data. We do not share your data with advertisers.

Voice tutoring. If you use a live voice session with Amber, audio of your speech is sent to OpenAI to run the conversation, and may be processed by Deepgram to convert speech to text and by ElevenLabs to generate spoken replies. This only happens during a voice session that you start. Typed tutoring never sends audio anywhere. You can use every other part of Pinnacle without voice.

All third-party vendors are contractually bound as Data Processors under Data Processing Agreements (DPAs) compliant with GDPR Article 28 and POPIA. For details on sub-processors used by our vendors, contact support@pinnacle-prep.org.

International data transfers (GDPR)

For users in the EU, we transfer your personal data to the United States under the Standard Contractual Clauses (SCCs) adopted by the European Commission as permitted under GDPR Article 46. By using Pinnacle, you consent to the transfer of your data to the US and other countries as described in this policy. We rely on adequacy determinations and appropriate safeguards maintained by our service providers.

Legal basis for processing (GDPR)

Your rights

Under POPIA and GDPR you have the right to: access your data; correct inaccurate data; request deletion; restrict processing; and data portability. Email support@pinnacle-prep.org — we respond within 30 days.

Information Officer (POPIA)

Pinnacle is the responsible party for the personal information described in this policy. Our designated Information Officer for the purposes of the Protection of Personal Information Act is Simthande Soke, reachable at simthandesoke@outlook.com. Requests to access, correct or delete your personal information can be sent there, and we will respond within the periods POPIA requires.

If you are not satisfied with how we have handled your personal information, you have the right to complain to the Information Regulator of South Africa at inforegulator.org.za. You do not need to raise it with us first, though we would rather you did so we can put it right.

Data breach notification

In the event of a data breach involving your personal data, we will notify affected users and relevant authorities within 72 hours (GDPR) or as required by law. Notifications will be sent to the email address associated with your account. We will provide details of the breach, the data affected, and steps you should take. Breach notification may be delayed if required by law enforcement.

Automated decision-making and profiling

Pinnacle uses machine learning algorithms to personalise your study schedule and question selection based on your performance data. These decisions are automated but are not legally binding and do not produce significant effects on your rights. The algorithms determine question difficulty, topic sequencing, and review timing using your accuracy, response time, hesitation patterns, and retry behavior. You have the right to request explanation of any algorithmic decision by contacting support@pinnacle-prep.org. You can opt out of personalization, though this may reduce the platform's effectiveness.

Research data use

By default, none of your data is used for research beyond running the product itself. In Settings, you can separately opt in to letting aggregated, anonymised usage data — accuracy, timing, question responses — be included in research, including collaborations with academic researchers studying adaptive learning. This is a specific, standalone consent: turning it on does not change the tutoring-analytics or session-recording settings, and turning either of those on does not turn this on.

If you opt in, you may also choose to provide optional demographic information (country, prior education level, current student status, and institution) — every field is voluntary, and the form is only ever shown once this consent is on. This is intended for candidate use in structured pilots run with named academic partners, not general data sale or advertising use of any kind — we do not sell data, and we do not use this information for advertising.

You can turn research data use off at any time in Settings, which stops any new data from being included. Aggregated figures already produced or published as part of a study cannot be un-aggregated, the same way a stated survey result can't be recalled after publication — but no new data from your account is added once you withdraw. Your demographic information (if any) can be deleted independently of your account at any time from Settings.

Data retention

Data is retained while your account is active. Delete your account via Settings and all personal data is permanently removed within 30 days. Anonymised aggregate statistics may be retained.

Security

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Passwords are hashed using bcrypt. Row-Level Security is enforced at the database layer — users can only access their own data.

Cookies

Essential cookies only (authentication). Analytics cookies (PostHog) are set only after you consent via the cookie banner on first visit.

Children and minors

Pinnacle is for adults. It is professional certification study (CFA, FRM, ACCA, CPA) and is not a product aimed at minors. We do not intend to collect data of any kind from minors, and we do not knowingly do so.

Before an account can be created you must accept these terms and confirm that you are not a minor in the country or region you are accessing Pinnacle from. We ask it that way, rather than asking for a single age, because the age of majority and the age at which a person counts as a child for data-protection purposes are not the same everywhere — and because we would rather not hold your date of birth at all.

If we become aware that we have collected data from a minor, we will delete it within 30 days. Report a suspected underage account, or email support@pinnacle-prep.org. A report through the form is recorded with its deadline, so the 30 days above are ours to prove.

Changes to this policy

Material changes will be communicated via email or in-app notification at least 14 days before they take effect.

Contact

Pinnacle Prep · Johannesburg, South Africa
support@pinnacle-prep.org

Pinnacle is not affiliated with, endorsed by, or connected to CFA Institute, GARP, the Association of Chartered Certified Accountants, or any US state board of accountancy.