1. Who this covers
This policy explains how PrepMeX ("we", "us") handles personal data when you use prepmex.com and the PrepMeX platform. PrepMeX is the data controller for the data described here. You can reach us about anything privacy-related at support@prepmex.com.
2. Data we collect
- Account data — your name, email address, study goal, and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name and email from Google.
- Study activity — the attempts you start, your answers, essays you write, speaking responses you record (audio), scores, AI-generated feedback and its translations, vocabulary progress, and study statistics.
- Preferences — interface language, theme, chosen exam, test date, and target score. Most of these live in your browser's local storage rather than on our servers.
- Purchase data — your plan, subscription status, and credit balance. Payments are processed by Lemon Squeezy, our merchant of record: they collect your payment details and billing address, and we never receive your full card number.
- Support messages — emails you send to support@prepmex.com.
- Technical basics — logs such as IP address, browser type, and timestamps, kept for security and debugging by our hosting providers.
We do not collect data for advertising, we use no advertising cookies or third-party trackers, and we never sell personal data.
3. How we use your data
- To run the product: draw your exams, save your answers, grade them, and show you your results and progress.
- To score speaking and writing: transcribe your recordings and grade your responses with AI (see section 4).
- To translate AI feedback into your interface language when you ask for it.
- To process purchases, manage subscriptions and credits, and prevent abuse of free credits and refunds.
- To answer your support requests.
- To keep the Service secure and diagnose failures.
We process this data because it is necessary to provide the Service you signed up for (performance of a contract), because of our legitimate interest in securing and improving the Service, or with your consent where required.
4. AI processing
When you complete a speaking or writing task, your recording or essay is sent to our AI provider, OpenRouter, Inc. (United States), which routes it to speech-recognition and language models for transcription, scoring, and feedback — and, on request, feedback translation. The data shared is what the task requires: your response, the task prompt, and the scoring rubric. It is processed to deliver your results, not to build advertising profiles.
Practical tip: your essays and recordings should contain only what the exam task asks for — there is never a reason to include real personal details like ID numbers or addresses in a practice answer.
5. Who processes data for us
We share personal data only with the service providers that run PrepMeX:
- Supabase — database, authentication, and file storage (your account, attempts, and recordings).
- Vercel — web hosting and delivery.
- OpenRouter — AI transcription, scoring, feedback, and translation (section 4).
- Lemon Squeezy — merchant of record: checkout, payment processing, taxes, invoices, and subscription billing.
Each provider processes data under its own contractual safeguards and only to provide its service to us. We may also disclose data if the law requires it, or as part of a merger or acquisition (in which case this policy continues to apply to data collected before the change).
These providers may store data in the United States or the European Union. Where data leaves your jurisdiction, it is protected by the providers' standard contractual safeguards.
7. How long we keep data
Account and study data are kept while your account exists, so your history and analytics keep working. If you delete your account, we delete or anonymize your personal data within 30 days, except records we must keep for legal, security, or accounting reasons. Payment records are retained by Lemon Squeezy under its own legal obligations.
8. Your rights
Depending on where you live (including under the GDPR and similar laws), you can ask us to:
- Access the personal data we hold about you, or receive an export of it.
- Correct inaccurate data.
- Delete your data ("right to be forgotten").
- Restrict or object to certain processing.
Email support@prepmex.com from your account email and we will respond within 30 days. If you are unsatisfied, you can complain to your local data-protection authority.
9. Security
All traffic is encrypted in transit (TLS). Database access is governed by row-level security so learners can only read their own records; answer keys and grading data are never exposed to the browser. Service credentials are restricted to server-side use. No system is perfectly secure, but if a breach affects your data we will notify you as the law requires.
10. Children
PrepMeX is not directed at children under 13, and we do not knowingly collect their data. Learners aged 13–18 may use PrepMeX with a parent or guardian's consent. If you believe a child under 13 has created an account, contact us and we will delete it.
11. Changes to this policy
We will update this policy as the product evolves and note the new date at the top. For material changes we will give notice in the product or by email before they take effect.
Questions or requests: support@prepmex.com.