Privacy Policy
Last updated: August 19, 2026
PREPEUR OÜ ("PREPEUR," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our test-taking environment at prepeur.com (the "Service"), in which the exam you sit is built from your own material.
By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
1.1 Information You Provide
- •Account Information: When you register, we collect your name, email address, and password (stored securely). If you sign in with Google, we receive your name, email, and Google account ID.
- •Student Status: If you claim the student discount, we record the institution you select, the email domain used to verify it, and the date on which verification succeeded. If your institution is not yet on our list you may ask us to add it, and we record who asked. We do not collect student ID documents, enrolment records, or proof of study.
- •User Content: Materials (PDF, DOCX, PPTX) you upload to be tested on, including textbooks, lecture slides, notes, and past exams. DOCX and PPTX files are converted to PDF within our own infrastructure; the original file is deleted immediately after conversion, and only the PDF is retained for processing and storage.
- •Assessment & Preparation Data: Your practice session results, mock exam results, AI grading results and feedback, readiness scores, gap analysis data, exam dates and scopes, and preparation progress.
- •Payment Information: If you subscribe to a paid plan, payment is processed by Stripe. We do not store your full credit card number; we only receive a customer ID and subscription status from Stripe.
- •Communications: If you contact us for support, we collect the information you provide.
1.2 Information Collected Automatically
- •Usage Data: We collect information about how you interact with the Service, including pages visited, features used, and general usage patterns.
- •Device Information: Browser type, operating system, and device identifiers.
- •Log Data: IP address, access times, and referring URLs.
- •Sitting Observations: When you choose to sit an exam under exam conditions, we record events that occur during that sitting: leaving and returning to full screen, the browser window losing and regaining focus, blocked paste, copy, print and right-click attempts, a page reload, and a connection that drops or is taken over by another device. Each event is stored with a timestamp set by our server. We do not record your screen, your camera, your microphone, your keystrokes, or anything outside the exam page, and we cannot see what you were doing while your window was not in focus. The record states what happened and never what it means: it draws no conclusion about you and produces no score, flag, or judgement.
2. How We Use Your Information
We use your information to:
- •Provide, maintain, and improve the Service
- •Process your uploaded materials and generate questions, grade your open-ended answers, and provide source-cited feedback
- •Track your exam readiness, compute gap analysis, and provide a personalized preparation experience
- •Provide readiness scores, mastery tracking, and performance analytics across your exams
- •Show you, and only you, the conditions record of an exam you chose to sit under exam conditions
- •Process payments and manage your subscription
- •Confirm student status where you claim the student discount, and confirm it again each year
- •Send transactional emails (account verification, password reset, subscription updates)
- •Respond to your support requests
- •Detect and prevent fraud, abuse, and security issues
- •Comply with legal obligations
3. AI Processing and Third-Party Services
3.1 AI-Generated Content
To build and grade the exams you sit, which covers question generation, answer grading, and source verification, we send limited portions of your uploaded material to third-party AI service providers for processing. These providers process the content only to return the requested output.
We may use one or more of the following AI service providers: OpenAI, Anthropic, Google (Gemini/Vertex AI), and Mistral AI. The specific provider(s) used may vary by feature and may change over time as we optimize for quality, cost, and reliability. Regardless of provider, the same data handling principles apply.
Important: We only share the minimum content necessary, typically excerpts and chunks of your materials rather than entire documents. We never share your personal information (name, email) with AI providers. Third-party providers may retain content for a limited period to operate and secure their services in accordance with their terms.
None of our AI providers use API customer data to train or improve their models. For details about each provider's handling of API data: OpenAI, Anthropic, Google Cloud, Mistral AI.
3.2 Third-Party Service Providers
We use the following third-party services to operate the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| AI Service Providers (OpenAI, Anthropic, Google Gemini/Vertex AI, Mistral AI) | Question generation, answer grading, source verification, document classification, conversational assistance | Excerpts of your materials (text chunks) |
| Search/Indexing Provider | Content retrieval and search functionality | Content representations and identifiers necessary to enable search |
| Cloud Storage Provider | Secure storage of uploaded files | Uploaded files and related metadata |
| Stripe | Payment processing | Payment details, email |
| Google OAuth | Authentication (optional) | Name, email (if you choose Google sign-in) |
4. Content Storage and Isolation
We store your uploaded materials, generated questions, assessment results, readiness data, and AI grading feedback in a way that is designed to keep your content private. Your account data, your exams, and your preparation progress are logically separated from other users. Other users cannot access your documents, your exams, your assessment results, or your readiness data.
The conditions record of a sitting is yours. You are the only person who sees it. We do not send it, sell it, or make it available to your university, your employer, an examining body, or anyone else, and we do not offer a product that would let us. If you ever want to show it to someone, that is your decision to make and yours to act on.
5. Data Retention
- •Active Accounts: We retain your data, including uploaded materials, generated questions, assessment results, readiness scores, and preparation history, for as long as your account is active.
- •Inactive Accounts: If your account has been inactive for an extended period (for example, no login activity for approximately two years), we may send reminder emails and, if it remains inactive, delete the account and associated data. Anonymized, aggregated analytics data may be retained for up to 60 days for service improvement purposes.
- •Sitting Observations: The conditions record of a sitting is kept with the attempt it belongs to, for as long as that attempt is kept. It is written once and never edited afterwards, which is what makes it a record rather than an opinion.
6. Data Security
We implement appropriate technical and organizational measures to protect your data, including:
- •Encryption of data in transit and, where appropriate, at rest
- •Access controls and authentication safeguards
- •Logical separation of user data
- •Monitoring and abuse prevention measures
- •Regular security reviews and updates
While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
7. Your Rights
Depending on your location, you may have the following rights:
- •Access: Request a copy of your personal data.
- •Correction: Update inaccurate or incomplete data.
- •Deletion: Request deletion of your account and associated data.
- •Export: Export your generated exam preparation data in supported formats.
- •Restriction: Request we limit processing of your data.
- •Objection: Object to certain types of processing.
To exercise these rights, contact us at team@prepeur.com or use the account settings in the Service.
8. Children's Privacy
The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at team@prepeur.com, and we will delete such information.
For users in the European Union, the minimum age may be higher (up to 16) depending on your country of residence.
9. International Data Transfers
PREPEUR OÜ is based in Estonia (European Union). Your data may be transferred to and processed in countries outside your country of residence, including the United States (where some of our service providers are located).
For transfers outside the EEA, we rely on Standard Contractual Clauses or other legally approved transfer mechanisms to ensure adequate protection of your data.
10. Cookies and Local Storage
We use the following technologies:
- •Authentication Tokens: We use first-party cookies or similar technologies to keep you logged in and to secure your session. These are essential for the Service to function.
- •Preferences: We store your display preferences (e.g., dark mode) in local storage.
We do not use third-party advertising cookies, and we limit analytics to what is necessary to operate the Service.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we may also send you an email notification.
Your continued use of the Service after any changes indicates your acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
13. Additional Information for EEA/UK Residents
13.1 Legal Basis for Processing
Under GDPR, we process your personal data based on the following legal grounds:
- •Contract: Processing necessary to provide the Service you requested (account management, question generation, answer grading, readiness tracking, and exam preparation features).
- •Legitimate Interest: Processing for analytics, security, and service improvement, where our interests do not override your rights.
- •Consent: Where you have given explicit consent (e.g., marketing communications, if applicable).
- •Legal Obligation: Processing required by law (e.g., tax records for payments).
13.2 Data Controller
PREPEUR OÜ is the data controller for the personal data processed through the Service.
13.3 Supervisory Authority
If you are in the EEA or UK and believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection authority.
This Privacy Policy is effective as of August 19, 2026.