GDPR and your rights

Cacobeez LLC, which owns Prepiva, is the controller of your personal data. Contact: our support form.

• Contract: to provide what you signed up for, including your account, tests, score reports, AI scoring and your subscription.
• Legitimate interests: to keep Prepiva secure, prevent abuse, fix errors, answer the support messages you send us, improve the practice material, count visits to see how the site is used, and compare two versions of a page to keep the one that works better (A/B tests, linked to the account that saw them). Our own visit count uses no cookies, skips browsers that send the Global Privacy Control signal, and is never linked to your account.
• Legal obligation: to keep payment and tax records.
• Consent: Google Analytics cookies are set, and Microsoft Clarity records how pages are used, only if you accept them in the cookie banner, and you can withdraw that at any time under Cookie settings. Our own visit count does not ask for consent: it sets no cookies, stores nothing in your browser and relies on the legitimate interests above. Study emails (your next step after your first test and checkout reminders) go only to members who ask for them, and you can withdraw that from any of these emails or on your Profile page. We will also ask first if we ever want to use your data for anything else, such as a newsletter.

Access

Get a copy of the personal data we hold about you.

Correction

Have inaccurate data fixed. You can change your name and target score yourself on your Profile page.

Erasure

Have your account and its data deleted.

Restriction

Ask us to pause using your data while a question about it is sorted out.

Portability

Receive your answers, scores and account details in a machine-readable file.

Objection

Object to processing we base on our legitimate interests.

Withdrawing consent

Where we rely on your consent, withdraw it at any time.

Complaint

Complain to the data protection authority where you live or work.

AI scores on Prepiva are practice estimates. They have no legal or similarly significant effect on you, so no decision about you is made solely by automated means.

Write to us through our support form, choose My data and tell us which right you want to use, signed in to your account or with the email address you use for Prepiva. We may ask you to confirm your identity. We answer within one month, free of charge. If a request is complex, we may extend this by up to two more months and will tell you why.

Prepiva is for people aged 13 and over. In the EU and EEA, if you are under 16, or under the lower age your country sets for consenting to online services (never below 13), a parent or guardian must agree to your use of Prepiva and to the processing of your data. If we learn that we hold a child’s data without that consent, we delete it.

Supabase (database, sign-in, file storage and visit statistics) and Render (hosting) process your data in the EU. Stripe (payments), Anthropic (rating of Writing and Speaking), OpenRouter and the speech model it routes to (transcription), Resend (account emails and support messages), Render (the tool in which our team answers support messages), Cloudflare (bot protection), Google Analytics (additional visit statistics) and Microsoft Clarity (heatmaps and page recordings) may process it in the United States. For those transfers we rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, and on their UK equivalents.

We keep your data while your account exists and delete it within 30 days after you ask us to delete your account. Payment records are kept as long as tax and accounting laws require. Notes of which page version you saw are deleted 180 days after that comparison ends. Visit statistics are never linked to your account; shortly after the day of your visit ends, their codes can no longer be traced back to your IP address or browser, and they are deleted after 90 days, or sooner if you ask us. The Privacy Policy has the details.