Privacy Policy
Draft for review — not yet in force. Effective [[EFFECTIVE DATE]].
This policy explains what personal information [[LEGAL NAME]], trading as GetU Prep ("we"), collects through getuprep.com, why we collect it, and your choices. We are the "controller" of this information. For privacy questions, email support@getuprep.com.
1. What we collect
| Information | Where it comes from | Why |
|---|---|---|
| Email address | You, at sign-in | To create your account, send sign-in codes, receipts and service notices, and occasional product news (§5) |
| Study progress: answers, scores, attempts, flagged questions, settings and exam date | Your use of the site | To run the Service: your results, readiness and review lists, synced across your devices |
| Purchase records: amount, date, currency, Stripe customer and payment references, and the access period | Stripe, when you pay | To grant access, keep accounts and tax records, and handle disputes |
| Technical data: IP address, browser type, and request logs | Your browser, automatically | To keep the Service secure (sign-in and rate limits) and to fix faults |
| Messages you send us | You, by email | To answer you |
| Exam alerts and requests: your email address and the exam you chose, or the name of an exam you'd like us to add (email optional) | You, on an exam page or the exam list | To email you once when that exam opens, and to decide which exams to build next |
- What we never receive: your full card number. Stripe collects payment details on its own page, under its own privacy policy.
- What we don't collect: sensitive categories of data. We don't use advertising trackers.
2. Our legal bases (EU and UK)
- Contract: to provide the account, the study features and the access you bought.
- Legal obligation: keeping purchase and tax records.
- Consent: exam alerts you ask for. You can withdraw it at any time, through the link in the alert or by emailing us.
- Legitimate interests:
- security and fraud prevention;
- improving the Service;
- telling customers about similar products (§5), which you can opt out of at any time.
3. AI and your data
- No AI training: we don't use your progress, answers or messages to train AI models.
- No automated decisions: we make no decisions with legal or similarly significant effects about you by automated means. Your readiness score is a study estimate, not such a decision.
4. Who processes it for us
We share personal information only with service providers that run parts of the Service for us, under contracts that require them to protect it:
| Provider | What they do | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database and file storage, security, and email forwarding for support@ | United States and global network |
| Stripe, Inc. and Link | Payments. Link is the reseller (merchant of record) for purchases: it collects your payment and billing details, calculates tax, and sends receipts and invoices under its own privacy policy | United States and others |
| Resend | Sending our emails (sign-in codes, receipts, notices, product news) | United States |
- No selling or ad sharing: we don't sell personal information, and we don't share it for cross-context behavioral advertising.
- When we may disclose it: if the law requires it, or to protect our rights or users' safety.
5. Email
- Service emails: sign-in codes, receipts and important notices about your account or these policies. You can't opt out of these while you have an account.
- Product news: occasional emails about new certification packs, updates and offers.
- We send them to account holders unless you opt out.
- Every one has an unsubscribe link, and you can also email support@getuprep.com.
- Unsubscribing takes effect within 10 days and doesn't affect your access.
6. Cookies and browser storage
- One cookie: we use a single, strictly necessary cookie to keep you signed in.
- Browser storage: your progress is cached in your browser's local storage, so the site works quickly and offline.
- No tracking: there are no analytics or advertising cookies. See the Cookie Notice.
7. How long we keep it
| Information | How long |
|---|---|
| Account and study progress | While your account exists. Read-only results stay after your access ends, so you can see your history |
| Purchase records | 7 years, for tax and accounting |
| Sign-in codes | Minutes (they expire after 10 minutes and are stored only as a one-way hash) |
| Sign-in sessions | Up to 30 days of inactivity |
| Technical logs | Short periods kept by our providers, usually days to weeks |
| Support emails | Up to 2 years after the conversation ends |
| Exam alerts and requests | Until we've sent the alert, you withdraw, or 12 months pass, whichever comes first |
Deleting your account: if you ask, we delete your account and progress within 30 days. We keep purchase records for the period above.
8. Your rights
Depending on where you live, you may have the right to:
- access your information, and get a copy in a portable format;
- correct it;
- delete it;
- object to or restrict some processing, including product news;
- withdraw consent where we rely on it.
How rights work where you live:
- EU and UK: you can also complain to your data protection authority.
- California and other US states: you have rights to know, delete and correct, and not to be discriminated against for using them. We don't sell or "share" personal information.
- Australia: you can complain to the OAIC if we don't resolve your concern.
To use a right, email support@getuprep.com from your account email. We reply within 30 days (45 where US state law allows). We may ask you to confirm a sign-in code to verify that it's you.
9. International transfers
We are based in the United States, and our providers process data in the US and elsewhere. For people in the EU, the UK and other regions with transfer rules, we rely on our providers' standard contractual clauses or equivalent safeguards.
10. Security
- Our measures:
- all traffic uses HTTPS;
- sign-in codes and session tokens are stored only as hashes;
- access to production systems is limited to the owner;
- payments are handled entirely by Stripe and Link.
- If something goes wrong: no system is perfectly secure. If a breach affects you, we'll tell you as the law requires.
11. Children
The Service is not for anyone under 16, and we don't knowingly collect their information. If you think a child has given us information, contact us and we'll delete it.
12. Changes
If we change this policy materially, we'll update the date above and email account holders before the change applies.
13. Contact
[[LEGAL NAME]], trading as GetU Prep · support@getuprep.com · [[POSTAL ADDRESS]]