Privacy Policy

Last updated: August 31, 2026

1. Who we are

This Privacy Policy explains how GMAT Ninja LLC (“GMAT Ninja,” “we,” “us,” or “our”) collects, uses, and protects your personal data when you visit gmatninja.com and any related sites/subdomains, create an account, purchase or use our courses, tutoring, or admissions consulting, subscribe to our newsletter, take our quizzes or assessments, or otherwise interact with us (together, the “Services”).

GMAT Ninja is the controller of the personal data described in this policy.

• Contact: [email protected]
• Postal address: GMAT Ninja LLC, PO Box 11584, Denver, Colorado 80211, United States

2. What this policy covers

This policy applies to personal data we process about prospective and current customers, website visitors, newsletter subscribers, quiz and assessment takers, tutoring and admissions-consulting clients, and anyone who contacts us. It does not cover third-party websites or services we link to, which have their own policies.

3. The personal data we collect

Information you give us directly

• Account and contact details: name, email address, username, password (stored in hashed form), and any phone number, country/region you provide.
• Purchase and billing information: the products or services you buy, order history, and billing details. Card payments are processed by our payment provider; we do not store full payment card numbers. Payments are processed by Stripe and Stax, each of which collect and hold card data under its own terms.
• Educational and admissions information: information relevant to the Services you use — for example target scores, study progress and practice results, and, for admissions consulting, information you choose to share such as academic history, work experience, program preferences, and the content of essays and application materials.
• Content and communications: messages you send us, support requests, survey and quiz responses, and any content you submit through the Services.

Information we collect automatically

• Usage and device data: IP address, browser and device type, pages viewed, referring pages, approximate location derived from IP, and interactions with the Services.
• Cookies and similar technologies: see Section 6.

Information from third parties

• Our payment provider (confirmation of payment, not card numbers) and analytics providers.

4. How we use your data, and our lawful bases

We use personal data only where the law allows. The table below maps each purpose to its lawful basis.

Where we rely on legitimate interests, we have balanced those interests against your rights; you can object at any time (see Section 11).

5. Marketing communications

If you subscribe to our newsletter or opt in to marketing, we will send you communications about the Services on the basis of your consent. You can unsubscribe at any time using the link in any marketing email or by contacting us, and we will stop. Withdrawing consent does not affect service-related messages (for example, purchase confirmations or account notices), which are not marketing.

6. Cookies and similar technologies

We use cookies and similar technologies to run the Services, remember your preferences, measure usage, and, where you consent, for analytics and marketing. Non-essential cookies (functional, analytics, and advertising) are set only with your consent, which you can give or withdraw at any time through our cookie banner. For the full list of cookies, the categories they fall into, and how to manage them, see our Cookie Policy. Where cookies involve cross-context behavioral advertising, U.S. state residents can also exercise the choices described in Section 17 below.

7. Sensitive (“special category”) data

We do not ask for special-category data (such as data revealing health, race or ethnicity, religion, or political opinions). Please do not include unnecessary sensitive information in essays, messages, or other content you submit.

8. Who we share your data with

We do not sell your personal data. We share it only with:

• Service providers (processors) who act on our instructions — for example hosting, payment processing (e.g., Stripe, Stax), email and CRM, analytics, and scheduling/video tools used for tutoring. Each is bound by a data processing agreement.
• Professional advisers (such as lawyers and accountants) where necessary.
• Authorities or third parties where we are legally required to disclose, or to establish, exercise, or defend legal claims.
• A successor entity in the event of a merger, acquisition, or sale of assets, subject to this policy.

9. International data transfers

GMAT Ninja is based in the United States, and your personal data will be processed in the United States and other locations where our providers operate.

10. How long we keep your data

We keep personal data only as long as necessary for the purposes described here, and to meet legal, tax, and accounting requirements. In general: 

• Account and service data — for the life of your account and 12 months after; 
• Billing records — 7 years to meet tax obligations; 
• Marketing data — until you unsubscribe; 
• Support and inquiry records — 12 months. 

When data is no longer needed, we delete or anonymize it.

11. Your rights

You have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”) in certain circumstances;
• restrict processing in certain circumstances;
• data portability — receive your data in a portable format;
• object to processing based on legitimate interests, and to object to direct marketing at any time;
• withdraw consent at any time where we rely on it (without affecting prior processing); and
• not be subject to solely automated decisions that produce legal or similarly significant effects. We do not currently make such decisions.

To exercise any right, contact us at [email protected]. We will respond within one month (extendable by two further months for complex requests, with notice). There is normally no fee. We may need to verify your identity before acting.

You also have the right to lodge a complaint with a supervisory authority. We would appreciate the chance to address your concerns first.

If you are a resident of California or another U.S. state with a comprehensive privacy law, additional rights and the ways to exercise them are set out in Section 16.

12. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including access controls, encryption in transit, and vendor due diligence. No system is perfectly secure, and we cannot guarantee absolute security.

13. Children

The Services are intended for adults and are not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

14. Third-party links

The Services may link to third-party sites and services we do not control. This policy does not apply to them, and we are not responsible for their practices. Review their policies before providing personal data.

15. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new “Last updated” date and, where changes are significant, notify you through the Services.

16. U.S. state privacy rights

This section provides the disclosures and rights required by U.S. state privacy laws, which the general description above does not, on its own, satisfy — most importantly California’s opt-out mechanics. It applies to residents of U.S. states that have comprehensive consumer privacy laws in effect (20 states as of 2026). Rather than name each one, this section extends the core rights below to residents of any such state and adds California-specific detail where California requires it. Where this section and the general terms of this Privacy Policy differ, this section controls for the specific U.S. state right in question.

Terms like “personal information,” “sell,” “share,” and “sensitive personal information” have the meanings given in the applicable state law (for California, the CCPA as amended by the CPRA).

California (CCPA/CPRA)

This part is GMAT Ninja’s notice to California residents under the California Consumer Privacy Act, as amended.

Categories of personal information we collect

In the past 12 months we have collected the following statutory categories of personal information.

We collect this information from the sources described in Section 3 above (you directly, automatically through the Services, and from providers such as our payment processor and analytics tools), and we use it for the purposes and on the lawful bases set out in Section 4 above.

Sensitive personal information

We do not collect the following categories of sensitive personal information: e.g., account log-in credentials (username in combination with password), which are treated as sensitive PI under the CPRA. We do not collect precise geolocation, and payment card data is handled by our payment provider rather than stored by us. We use sensitive personal information only to provide the Services and for other purposes permitted without a right to limit under the CPRA. 

Disclosure, “selling,” and “sharing”

• We disclose personal information to service providers and contractors for business purposes (for example, hosting, payment processing, email/CRM, and analytics), under contracts that restrict their use of it.
• “Selling”: We do not sell personal information for monetary or other valuable consideration.
• “Sharing”: Under the CPRA, “sharing” includes disclosing personal information for cross-context behavioral advertising, even with no money changing hands. GMAT Ninja uses third-party advertising cookies or pixels (for example Google Ads/remarketing tags) which constitutes “sharing.” Under California rights, you can opt-out of this sharing – please read on below.

We do not knowingly sell or share the personal information of consumers under 18. Our Services are intended for adults 18+.

Your California rights

Subject to verification and legal exceptions, you have the right to:

• Know / access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it;
• Delete personal information we collected from you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of your personal information;
• Non-discrimination — we will not deny you services, charge different prices, or provide a different level of service for exercising your rights (we may offer financial incentives only as permitted and with notice); and
• Rights regarding automated decision-making / profiling to the extent required by California regulations. Please note we do not use automated decision-making in providing our services or products at this time.

How to exercise your California rights

Submit a request by email to [email protected] to let us know how you’d like us to handle your data.

Authorized agents. You may use an authorized agent to submit requests; we may require proof of authorization and verification of your identity.

Verification. We will take reasonable steps to verify your identity before acting on a request to know, delete, or correct, and may ask for information to match against what we hold.

Timing. We will confirm receipt within 10 business days and respond within 45 days, extendable by another 45 days with notice.

Opt-out preference signals (Global Privacy Control)

We honor browser-based opt-out preference signals, including the Global Privacy Control (GPC), and treat a signal from a consumer’s browser or device as a valid request to opt out of sale/sharing for that browser or device.

Shine the Light (Cal. Civ. Code §1798.83)

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. To make a request, contact [email protected].

Retention

We retain personal information as described in Section 10 above.

Other U.S. states

If you are a resident of another state with a comprehensive privacy law in effect (for example Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others), you have a comparable core set of rights, subject to that state’s specifics and to legal exceptions:

• Access / confirm whether we process your personal data and obtain a copy;
• Correct inaccuracies;
• Delete personal data;
• Data portability; and
• Opt out of (i) targeted advertising, (ii) the sale of personal data, and (iii) certain profiling in furtherance of decisions that produce legal or similarly significant effects.

Sensitive data. Unlike California, most of these states require opt-in consent before we process sensitive data. We do not process sensitive data, as described in this Privacy Policy.

Opt-out preference signals. Several of these states require honoring a universal opt-out mechanism such as GPC; we honor it as described under “Opt-out preference signals,” above.

How to exercise. Submit a request through the methods described under “How to exercise your California rights,” above. We will respond within the timeframe required by your state (generally 45 days, extendable once).

Appeals. If we decline to act on your request, you may appeal by contacting [email protected], attn: Charles Bibilos. We will respond to the appeal within the period your state requires (commonly 45–60 days). If your appeal is denied, many states allow you to contact your state Attorney General.

17. How to contact us

Questions or requests: [email protected] / GMAT Ninja LLC, PO Box 11584, Denver, Colorado 80211, United States