Privacy Policy — Prepso

1. Who we are

Prepso (“we”, “us”, “our”) operates the exam preparation platform at prepso.eu. We are the data controller under the General Data Protection Regulation (GDPR).

Contact: hello@prepso.eu

2. What data we collect

Account data: email address, name (if provided), subscription tier.
Practice data: questions answered, answers selected, time taken, accuracy per module, session timestamps.
Written test data: essay text submitted for AI feedback. Essays are sent to the Anthropic API for grading and are not stored beyond your session.
Payment data: payments are processed by Lemon Squeezy. We receive confirmation of payment and your email address. We do not store card details.
Usage data: pages visited, features used, browser type — collected via Supabase and standard server logs.

3. Why we collect it (legal basis)

Contract performance (Art. 6(1)(b) GDPR): to provide the service you purchased — tracking your progress, adaptive difficulty, score prediction.
Legitimate interests (Art. 6(1)(f) GDPR): to send product emails (weekly progress summaries, competition alerts) and to improve the platform.
Legal obligation (Art. 6(1)(c) GDPR): to comply with tax and accounting requirements related to purchases.

4. Who we share data with

Supabase — database and authentication (EU region). Data is stored in the EU.
Lemon Squeezy — payment processing. Covered by their privacy policy.
Resend — transactional and product emails.
Anthropic — AI grading of written test essays (Premium only). Essay content is sent to Anthropic’s API and is subject to Anthropic’s privacy policy. No essay data is retained by us after the grading response is returned.
Vercel — hosting and edge functions (servers in EU and US).

We do not sell your data to third parties.

5. How long we keep data

Account and practice data: for the lifetime of your account, plus 30 days after deletion.
Payment records: 7 years, as required by EU tax law.
Email marketing: until you unsubscribe.

6. Your rights

Under GDPR, you have the right to:

Access a copy of your personal data.
Rectification of inaccurate data.
Erasure (“right to be forgotten”) — you can delete your account from the Account settings page.
Portability — export of your practice history in a machine-readable format.
Objection to processing based on legitimate interests (e.g. marketing emails).
Lodge a complaint with your national data protection authority.

To exercise any right, email us at hello@prepso.eu. We respond within 30 days.

7. Cookies

We use strictly necessary cookies (session authentication) and optional analytics cookies. You can manage your cookie preferences via the banner shown on first visit.

8. Changes to this policy

We will notify you by email of any material changes to this Privacy Policy. The “last updated” date at the top of this page reflects the most recent revision.