Privacy policy
LSAT Lawyers (lsatlawyers.com) is an independent LSAT diagnostic and tutoring service run by Daniel. This page explains what personal data we collect, why, how long we keep it, who else handles it, and the rights you have, including under the EU General Data Protection Regulation (GDPR).
Last updated 16 October 2026
Who is responsible
Daniel, who runs LSAT Lawyers, is the controller of your personal data. For anything in this policy, write to daniel@lsatlawyers.com.
What we collect and why
Score-report diagnostic
- Data
- The score-report PDF you upload.
- Purpose
- To produce your diagnostic.
- Kept for
- The PDF stays on our server only until the analysis finishes, usually a few seconds, and is then deleted. If the analysis fails, the PDF is deleted within 24 hours.
- What remains
- The analysis result: test number, section and question results, scores and the patterns we found. It does not include your name or your LSAC account number. We keep it so your report can be shown and unlocked, until you ask us to delete it.
- Legal basis
- Providing the service you ask for (GDPR Art. 6(1)(b)).
Unlocking the full report
- Data
- Your email address, the page where you started on our site, the domain of the website that sent you to us (for example google.com), and any campaign tag in the link you followed (for example utm_source=reddit).
- Purpose
- To unlock your full report, and so Daniel can email you about your report and about tutoring.
- Kept for
- Until you ask us to delete it or to stop contacting you.
- Legal basis
- Your consent, given when you submit your email (GDPR Art. 6(1)(a)). You can withdraw it at any time by replying to any email or writing to us.
Booking a phone consultation
- Data
- Your name, email, phone number and timezone, the time you choose, anything you write in the optional note, and the page, referring domain and link campaign tag that brought you. If you attach a score-report PDF, or ran the free diagnostic first, its analysis result is linked to your booking.
- Purpose
- To schedule and hold the call and to follow up about tutoring. Daniel receives each booking as a text message and in his calendar, with a short summary of your score report if one is attached, so he can review it before the call.
- Kept for
- While we may work together and for our business records. We delete it on request unless the law requires us to keep it. An attached PDF is deleted as soon as it has been analyzed, exactly as for the diagnostic.
- Legal basis
- Steps you ask for before a contract, and the contract itself (GDPR Art. 6(1)(b)).
Asking for a call back
- Data
- Your name, phone number and timezone, the best time you pick, anything you write in the optional note, and the page, referring domain and link campaign tag that brought you. If you tick the optional assistant box, we also keep the exact text you agreed to and when you ticked it.
- Purpose
- So Daniel can call you back; he receives each request as a text message. Only if you ticked the box and Daniel cannot call in time, his automated (AI) assistant may call you instead about LSAT tutoring. Those calls may be recorded and transcribed so Daniel gets a summary.
- Kept for
- While we may work together and for our business records. We delete it on request unless the law requires us to keep it.
- Legal basis
- Steps you ask for before a contract (GDPR Art. 6(1)(b)); for assistant calls, your consent (Art. 6(1)(a)), which you can withdraw at any time by saying stop on a call or writing to us.
Paying for tutoring
- Data
- Payments are made on Stripe’s own pages (a payment link or an invoice Daniel sends). Your card or bank details go to Stripe, never to us. Stripe tells us the amount, the date, your name, email and phone number, and whether the payment went through or was refunded.
- Purpose
- To record what you paid for, keep our accounts, and let Daniel know (he receives each payment as a text message).
- Kept for
- As long as tax and accounting law requires us to keep payment records.
- Legal basis
- The contract with you (GDPR Art. 6(1)(b)) and our legal obligations for business records (Art. 6(1)(c)). Stripe processes the payment under its own privacy policy.
Security and abuse prevention
- Data
- Your IP address and technical details about your browser.
- Purpose
- To stop spam and abuse. The site limits how often one connection can upload a report, unlock it, book a call or ask for a call back; for this our server holds IP addresses in memory only and never writes them to disk. Cloudflare, which delivers and protects the site, processes connection data for every request, and its human check (Cloudflare Turnstile) on the upload, booking and call-back forms tells people apart from bots.
- Legal basis
- Our legitimate interest in keeping the service secure (GDPR Art. 6(1)(f)).
Site statistics
- Data
- Steps such as “arrived on the site”, “viewed the diagnostic page” or “unlocked a report”, with the page, the referring domain, any campaign tag in the link you followed and the time. These records contain no cookie, no IP address and no other identifier.
- Purpose
- To see which pages help students and improve the site.
- Legal basis
- Our legitimate interest in improving the site (GDPR Art. 6(1)(f)).
Research. We publish aggregate, anonymized statistics computed from many analyzed reports, for example accuracy by question type (see the dataset). These statistics cannot identify anyone.
Who else handles your data
- Cloudflare, Inc. (United States): website delivery, security and the human check. Cloudflare is certified under the EU-U.S. Data Privacy Framework. See the Cloudflare privacy policy.
- Stripe, Inc. (United States): payments for tutoring. Stripe is certified under the EU-U.S. Data Privacy Framework. See the Stripe privacy policy.
- Apple: its iMessage service carries the booking and payment notifications Daniel receives.
- Our own server, located in the United States, stores the data described above.
We do not sell personal data, and we do not use advertising or third-party analytics services.
Transfers outside the EU
Our server is in the United States and Cloudflare operates worldwide, so data from visitors in the EU is processed in the United States. Cloudflare relies on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to its use (including objecting to marketing emails at any time), receive it in a portable format, and withdraw any consent you gave; withdrawing does not affect what we did before. Write to daniel@lsatlawyers.com and we will answer within one month. You can also complain to a data protection supervisory authority, in particular the one in the EU country where you live or work.
Automated analysis
The diagnostic is generated automatically from your score report to give you study recommendations. It is not used to make decisions about you that have legal or similarly significant effects.
Children
The service is meant for adults preparing for law school admission and is not directed to children under 16.
Cookies
This site sets no cookies of its own; only Cloudflare's security check may use any. Details are in our cookie policy.
Changes
We update this page when our practices change and change the date at the top.