Privacy policy
How PrepKit processes account, practice, billing and consent data.
Effective and updated: · Version: 2026-10-01.1
Human review required: operator details and binding legal translations are not yet confirmed.
Data and purposes
We process your name and email for account access; favorites and roadmap progress to save your work; practice transcripts and rubric reports to provide feedback; submissions and reports for editorial review; purchase identifiers, amounts and subscription status for access; and security, moderation and consent records for accountability. Polar handles payment details. Resend delivers service emails. Provider keys are never received by PrepKit. Session and security records may include IP address, browser user agent and request timestamps. Hosting-log and backup handling needs operator confirmation.
GDPR and UK GDPR
The proposed lawful bases are contract for requested account, practice and purchase services; consent for optional newsletters and analytics; legitimate interests in security and moderation; and legal obligation where applicable to retained transaction records. The operator must confirm the controller identity, obligations and legitimate-interest assessment. You may request access, correction, erasure, portability, restriction or objection, withdraw consent, and complain to your competent supervisory authority.
CCPA and CPRA
Categories include identifiers and contact details, commercial records, internet activity when analytics is enabled, user-submitted content and practice feedback. Sources are you, your browser and service providers. Recipients are the providers described in Sub-processors and authorized staff. PrepKit does not sell personal information or share it for cross-context behavioral advertising. You may request knowledge/access, correction or deletion, use an authorized agent subject to verification, and exercise rights without discrimination. We do not use sensitive personal information to infer characteristics. Avoid submitting sensitive data.
Retention schedule
Account data and saved work remain until deletion. You can delete individual practice sessions and their reports. Account deletion removes linked member data but retains purchase and audit evidence and anonymized submissions. No automatic expiry is implemented for those retained records, newsletter suppression hashes or consent evidence; the operator must approve a justified schedule. The retention job removes unconfirmed newsletter records after 7 days and analytics events after 180 days. Unsubscribing clears the newsletter address while retaining its hash. Backups and hosting log retention await operator confirmation.
Transfers, children and requests
Providers may process data outside your country. Deployment regions, transfer safeguards and any EU or UK representatives require operator confirmation; no adequacy decision or contractual safeguard is claimed. PrepKit is designed for job preparation, not services directed to children, and does not knowingly seek children’s data. Report suspected collection through Contact. Use the account privacy controls to export or delete your data, or contact the privacy contact for other rights. Identity verification must be proportionate. We do not use practice scores for automated hiring decisions.