Privacy Policy

Account information. When you register, we collect your name, email address, and password (stored as a secure hash).

Usage data. We collect information about how you interact with our platform — pages visited, practice tests taken, answers submitted, time spent, and score history — to power your analytics dashboard.

Payment information. Payments are processed by Stripe. We do not store your full card number. We receive only a tokenized reference and basic billing details (name, country).

Device and log data. We automatically collect IP address, browser type, device type, operating system, referring URLs, and timestamps when you access our service.

Cookies and local storage. We use first-party cookies and browser local storage to keep you signed in, remember your preferences, and record your consent choices. See Section 6 for details.

We use your data to:

• Create and manage your account
• Deliver practice tests, track your scores, and display subject analytics
• Process payments and manage your subscription
• Send transactional emails (account confirmation, password reset, receipts)
• Send product updates and study tips — only if you opt in
• Detect and prevent fraud, abuse, and security incidents
• Improve our question bank, materials, and platform based on aggregate usage patterns
• Comply with legal obligations

We do not sell your personal data to third parties.

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract performance — to provide the service you signed up for
• Legitimate interests — analytics, fraud prevention, platform improvement
• Consent — marketing emails, non-essential cookies
• Legal obligation — complying with applicable laws

We share your data only with trusted service providers who help us operate Prepify:

• Supabase — database and authentication hosting
• Stripe — payment processing
• Vercel — hosting and edge delivery
• Resend / email provider — transactional email delivery

All providers are contractually bound to process data only on our behalf and in accordance with applicable data protection law.

We may disclose data if required by law, court order, or to protect the rights and safety of Prepify or others.

We retain your account data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within 30 days, except where we are required by law to retain it longer (e.g., billing records for up to 7 years).

Anonymized, aggregated analytics data may be retained indefinitely as it cannot be used to identify you.

We use the following types of cookies and storage:

• Essential cookies — required for authentication and security. Cannot be disabled.
• Preference storage — stores your consent choice (via localStorage) so we don't show the banner repeatedly.
• Analytics cookies — used to understand how users interact with our platform. Only set if you accept cookies.

You can withdraw cookie consent at any time by clearing your browser storage or contacting us. Withdrawing consent does not affect the lawfulness of prior processing.

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time for consent-based processing

To exercise any of these rights, email us at privacy@prepify.com. We will respond within 30 days.

Prepify is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it promptly.

Your data may be processed in countries outside your own, including the United States. Where we transfer data out of the EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms approved by the European Commission.

We implement industry-standard measures to protect your data, including TLS encryption in transit, hashed passwords, row-level security in our database, and access controls limiting who can view personal data internally.

No system is completely secure. If you believe your account has been compromised, contact us immediately.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top and, where appropriate, notify you by email or in-app notice. Continued use of Prepify after changes take effect constitutes acceptance of the revised policy.

For any questions, requests, or concerns about this Privacy Policy or your personal data:

Prepify
Email: privacy@prepify.com