At Prepia, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains:
What information we collect and why
How we use, store, and protect your data
Your rights and choices regarding your information
By using Prepia, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with these terms, please do not use our services.
2. Information We Collect
We collect data to provide, personalize, and improve our services. The types of data we collect include:
2.1 Personal Information (Provided by You)
Name (if provided)
Email Address (used for account creation, communication, and login purposes)
2.2 Automatically Collected Information
When you use Prepia, we may automatically collect:
Device Information: Device model, operating system, browser type
App Usage Data: Features used, time spent on quizzes, interactions
IP Address: Used for security, fraud prevention, and analytics
Cookies and Similar Technologies: For analytics and advertising measurement, with your consent where the law requires it (see Section 9)
2.3 Payment Information
Payments are securely processed via Stripe. We do not collect or store your credit card details. For Stripe’s privacy practices, please refer to Stripe’s Privacy Policy.
2.4 Data from Third-Party Services
If you connect a third-party service to your Prepia account, we may receive limited profile data from it, as that service permits.
3. How We Use Your Information
We collect and use your data for the following purposes:
To Provide and Improve Our Services: Deliver personalized learning experiences and quiz recommendations, and enhance app performance.
To Communicate with You: Send important updates, security alerts, and promotional messages (you can opt out at any time).
To Measure Our Advertising: See whether our ads lead to sign-ups and purchases, with your consent where the law requires it (see Section 9).
To Ensure Security & Prevent Fraud: Detect, prevent, and respond to security threats and fraudulent activities.
To Comply with Legal Requirements: Enforce our terms of service and fulfill legal obligations.
4. How We Share Your Information
We do not sell, rent, or trade your personal information for money. We share data only in the circumstances below, including with Google for advertising measurement as described in Section 9, which some US state privacy laws may treat as “selling” or “sharing”.
4.1 Service Providers & Third-Party Tools
We use trusted third-party services to operate Prepia, including:
Google Analytics & Firebase – For analytics and app performance monitoring
Google Tag Manager and Google Ads – For loading our website’s analytics and advertising tools and measuring our ads (see Section 9)
Microsoft Clarity – For session recordings and heatmaps of how our website is used (see Section 9)
Stripe – For payment processing
Mailchimp Transactional (Mandrill) – For sending account and support emails
Cloud Storage Providers – For secure data hosting
4.2 Legal & Compliance Obligations
We may disclose information if required by law, legal process, or to protect our rights, users, and the public.
4.3 Business Transfers
If Prepia undergoes a business transition (e.g., merger, acquisition), user data may be transferred as part of the process.
5. Data Security
We implement industry-standard security measures to protect your information, including:
Encryption: Secure transmission of data
Access Controls: Restricted access to authorized personnel only
Data Anonymization: Where possible, data is anonymized or pseudonymized
While we take reasonable security measures, no system is completely secure. If you suspect a data breach, please contact [email protected] immediately.
6. Data Retention & Deletion Policy
6.1 How Long We Retain Data
We retain personal information only as long as necessary for service delivery and to meet legal obligations.
Inactive accounts may be automatically deleted after 24 months of inactivity.
6.2 How to Request Data Deletion
You have the right to request data deletion at any time. To do so, please email us at [email protected].
If you are signed in, you can also request deletion with the Delete account option on your account page. Our support team deletes the account and confirms by email within 7 days.
Account deletion is permanent and cannot be reversed.
7. Your Rights & Choices
You have the following rights regarding your personal data:
Access Your Data: Request a copy of the information we store about you
Correct Your Data: Update incorrect or outdated details
Request Deletion: Ask us to delete your data, subject to legal requirements
Withdraw Consent: Opt out of non-essential data collection (e.g., marketing emails), and change your cookie choices at any time (see Section 9)
Prepia is not intended for children under 13 years old. We do not knowingly collect personal information from children. If you believe a child has provided personal data, please contact us immediately, and we will delete it.
Our exam prep for admissions and equivalency tests, such as the SAT, ACT, ASVAB, GED and HiSET, is also used by younger students. On those exam pages, and for purchases of those exams, we do not send email addresses to Google Ads.
9. Cookies and Similar Technologies
We use cookies and similar technologies, such as tags and browser storage, to:
Keep you signed in and remember your cart and your choices
Understand how our website is used, so we can improve it
Measure whether our advertising works
9.1 What We Use
Each entry below says who provides the technology, why we use it, what it collects, how long it lasts, and which category of your cookie choices it belongs to. Necessary technologies are always on; Analytics and Advertising follow your choices (Sections 9.2 and 9.3).
Google Tag Manager
Provider: Google LLC
Purpose: Loads the analytics and advertising tools below on our website and applies your cookie choices to them.
Data: Your IP address and browser details, as with any request to Google’s servers.
Retention: Sets no cookies of its own.
Category: Loaded for every visitor; the tools it loads follow your choices
Google Analytics 4, with User-ID
Provider: Google LLC
Purpose: Shows us how our website is used: pages viewed, the exams and plans looked at, and the steps to checkout and purchase. When you are signed in, your Prepia account ID (never your email address) connects your visits across devices.
Data: Pages and events, device and browser details, approximate location derived from your IP address, a random cookie ID, and your Prepia account ID when you are signed in.
Retention: Cookies _ga and _ga_* last up to 2 years. Google keeps the event data for up to 14 months.
Category: Analytics. In the EEA, the UK and Switzerland, until you accept, it sets no cookies and sends Google only cookieless measurement pings, which Google uses to estimate traffic.
Google Ads conversion tracking and enhanced conversions
Provider: Google LLC
Purpose: Tells us whether our Google ads lead to sign-ups and purchases. The Conversion Linker keeps the ad click ID from the link you arrived by, and when you buy, a hashed (SHA-256) copy of your email address is sent to Google to match the purchase to an ad click.
Data: Ad click ID, purchase value and order ID, the hashed email address at purchase, device and browser details, and IP address.
Retention: Cookies _gcl_au and _gcl_aw last 90 days. Google’s own advertising cookies on Google domains follow Google’s policies.
Category: Advertising. In the EEA, the UK and Switzerland, until you accept, no advertising cookies are set, no email address is sent, and ad click IDs are removed from requests to Google; the click ID can stay in the page address as you move between pages, so an ad can still be credited if you accept later.
Microsoft Clarity
Provider: Microsoft Corporation
Purpose: Session recordings and heatmaps of how our pages are used, so we can see what helps and where people get stuck.
Data: Clicks, scrolling, mouse movement and the pages you view, device and browser details, and approximate location. It also receives the Google Analytics client and session IDs, so a recording can be matched with analytics.
Retention: Cookies _clck (up to 1 year) and _clsk (1 day). Microsoft keeps recordings for 30 days and heatmap data for 9 months.
Category: Analytics. In the EEA, the UK and Switzerland it sets no cookies until you accept.
Stripe
Provider: Stripe, Inc.
Purpose: Processes card payments on our checkout and payment-method pages, and helps prevent fraud.
Data: The payment details you enter, which go straight to Stripe and never to us, and device and browser signals Stripe uses to detect fraud.
Retention: Cookies such as __stripe_mid (1 year) and __stripe_sid (30 minutes). Stripe keeps payment data as its own privacy policy describes.
Category: Necessary, and only on checkout and payment pages
Device identifier (device_uuid cookie)
Provider: Prepia
Purpose: Tells our servers one browser from another once you sign in, so your account lists each browser once and your sign-in can be renewed safely.
Data: A random ID with no other information in it.
Retention: 400 days. Set only when you sign in or create an account.
Category: Necessary
Sign-in session (authjs.session-token cookie)
Provider: Prepia
Purpose: Keeps you signed in across Prepia’s websites.
Data: An encrypted session token.
Retention: Until you sign out, and at most 30 days without a visit.
Category: Necessary
Cookie choice (prepia_consent cookie)
Provider: Prepia
Purpose: Remembers your cookie choice on prepia.com and all its subdomains.
Data: Which categories you allowed, when, and the version of this notice, with a copy in your browser’s local storage. For the current browser tab, we also keep which country’s rules apply to you.
Retention: 12 months, or 6 months after “Reject all”.
Category: Necessary
Cart and checkout (browser storage)
Provider: Prepia
Purpose: Remembers the exams in your cart and where you are in checkout.
Data: The exams and plans you picked.
Retention: The cart stays until you empty it or clear your browser storage; checkout progress ends with the browser tab.
Category: Necessary
Analytics identity (browser storage)
Provider: Prepia
Purpose: Remembers your Prepia account ID and the email address you signed in or checked out with, so the analytics and ad measurement above can connect your visits.
Data: Account ID and email address.
Retention: Until you sign out or clear your browser storage. In the EEA, the UK and Switzerland, the account ID is kept only with analytics consent and the email address only with advertising consent.
Category: Analytics (account ID) and Advertising (email address)
9.2 Your Choices in the EEA, the UK and Switzerland
If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask before using analytics or advertising cookies. Until you choose, only necessary technologies store anything on your device, and Google’s tags send only the cookieless measurement pings described above.
You can accept all, reject all, or choose by category, and change your mind at any time with Cookie Settings at the bottom of every page. We keep your choice for 12 months, or for 6 months if you reject all, and then ask again. When you withdraw consent, we stop using those tools and delete their cookies on our website.
9.3 Your Privacy Choices in the United States
Everywhere else, including the United States, analytics and advertising cookies are on by default. Some US state privacy laws may treat the advertising measurement described above as “selling” or “sharing” personal information. You can opt out at any time with Your Privacy Choices at the bottom of every page, which turns off advertising cookies in that browser and stops your hashed email address from being sent to Google Ads.
We treat a Global Privacy Control (GPC) signal from your browser as the same opt-out, automatically, for that browser, in every region.
Our website does not respond to Do Not Track signals, because there is no common standard for them. We honor Global Privacy Control instead, as described above.
9.4 Browser Controls
You can delete cookies or disable them via your browser settings, but some features, such as signing in and checkout, may not work properly afterward.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If significant changes occur:
We will notify you via email or in-app message.
Updates will be posted on this page with a revised “Last Updated” date.
Please review this policy regularly to stay informed.
11. Contact Us
If you have any questions, concerns, or data requests, please reach out:
