Privacy Policy

• Account: your name, email address and password (kept only as a secure hash by our sign-in provider), your target score and your sign-in history. If you choose to sign in with Google, Google shares your name, email address and profile picture with us.
• Tests and progress: your answers, written responses, Speaking recordings and their transcripts, scores, AI feedback, attempts and course progress. Section practice sets run in your browser and are not saved; if you ask for AI evaluation of a practice answer, it is sent for rating and not stored.
• Billing: if you subscribe, your Stripe customer ID, your plan and its renewal dates, and the country you paid from, which decides whether checkout asks the EU and UK agreement. Card details go to Stripe; we never see or store them.
• Technical: IP address, browser and device details in server and security logs.
• Visit statistics: the pages you open and when, the site or campaign link that brought you to Prepiva, whether you use a computer, phone or tablet, and your country, which our hosting provider works out from your IP address. We also note when the free test is started or finished, when it is moved into an account, and when someone creates an account, signs in or opens checkout, without a name, email address or account ID. To count each visitor once a day, your IP address and browser details are turned into a code with a secret value that changes every day; the visit records keep the code, never the IP address or browser details.
• Page versions: sometimes we show two versions of a page, such as the free test’s results screen, to see which one helps people more (an A/B test). We note which version your account saw, or the temporary account of a free test taken without one, and when, and whether you then create an account, open checkout or pay, and how much. Nothing is stored in your browser for this.
• Page use: if you accept analytics cookies, Microsoft Clarity records how pages are used, such as clicks, taps, scrolling and mouse movement, together with the page as it looked. What you type into fields is never recorded, and your written answers, Speaking transcripts and their feedback are hidden from the recordings.
• Support: what you send with the support form: the topic, subject and message, and the name and email address we reply to. For members, the message is linked to the account and, if you choose one, to the test it is about. We also keep its status and the conversation that follows: our answers and anything you write back.

• to create and protect your account and sign you in;
• to run tests, save your progress and show your score reports and reviews;
• to transcribe Speaking and rate Writing and Speaking with AI;
• to handle subscriptions and payments;
• to send account emails, such as sign-up confirmation and password reset;
• only if you ask for them, to send study emails: your next step a day after your first full test (or a day after you ask for them, if that is later), a reminder two days later, and a reminder if you leave checkout before paying. We ask when you sign up and on your first score report, and you can stop them from any of these emails or on your Profile page;
• to answer your support messages;
• to prevent abuse and fix problems;
• to count visits and see which pages are used, with our own cookieless count and with Google Analytics;
• to compare two versions of a page and keep the one that works better;
• to see where pages are hard to use, with Microsoft Clarity’s heatmaps and recordings.

We do not sell your data, show ads or build advertising profiles.

If you start the free practice test without an account, we create a temporary account on our servers, identified by a cookie in your browser, and store your answers and Speaking recordings with it. If you enter your email on the results screen, we keep it with your test until your account is created. When you create an account or sign in from the results screen, the test moves to your account. If you do not, we delete the temporary account and everything in it within 8 days; copies in our hosting provider’s backups expire on its schedule.

To score Speaking, your recordings are sent to OpenRouter, which passes them to the AI model that turns them into text. Your written answers and those transcripts are then sent to Anthropic, whose Claude model rates them. The results are practice estimates and are never used to make legal or similarly important decisions about you.

Supabase

Database, sign-in, file storage and visit statisticsEU (Ireland)

Render

Website hosting, and the internal tool in which our team reads and answers support messages, which stores none of themEU (Frankfurt); the support tool in the United States

Stripe

Payments; Stripe is also responsible for the payment data itselfUnited States and others

Anthropic (Claude)

Rating of Writing and SpeakingUnited States

OpenRouter and the speech model it routes to

Transcription of Speaking recordingsUnited States

Resend

Account emails such as sign-up confirmation and password reset, study emails for members who ask for them, passing support messages on to our team, and our answers to themUnited States

Google Analytics

Additional visit statistics, with cookies only if you accept themUnited States

Microsoft Clarity

Heatmaps and recordings of how pages are used, without what you type or your answers, only if you accept analytics cookiesUnited States

Cloudflare

Bot protection on sign-in, sign-up, password reset, the free test start and the support form (Turnstile)United States

Transfers to the United States rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. See our GDPR page.

Some cookies are needed to keep you signed in, so they are always on. During a test and on its results screen, Prepiva keeps temporary state in your browser’s session storage.

If you start a test or choose a language on one of our pages in another language, your browser’s local storage remembers that language, so your score report can offer its guide in it.

A practice test taken without an account uses the same sign-in cookies for its temporary account, plus a cookie that remembers the test for one hour while you create an account or sign in.

Google Analytics cookies (named _ga) are set only if you choose Accept in the cookie banner. Until then, and if you decline, Google Analytics stores nothing in your browser and receives only anonymous signals without cookies. Microsoft Clarity is loaded only after you choose Accept; it then sets its cookies (_clck and _clsk) and Microsoft’s own on clarity.ms and bing.com. Your choice is remembered in your browser’s local storage and in a cookie (prepiva-analytics-consent) that prepiva.co and celpip.prepiva.co share, so one choice covers both. We do not use advertising cookies.

Prepiva’s own visit count sets no cookies and stores nothing in your browser, so it does not depend on the cookie banner. The banner choice applies to Google Analytics and Microsoft Clarity only.

You can change this choice at any time with Cookie settings, also linked at the bottom of every page.

• Account, test and progress data, including recordings, stay while your account exists. When you ask us to delete your account, we delete them within 30 days.
• Payment records are kept as long as tax and accounting laws require.
• Support messages are deleted two years after their last change, or with your account if that comes first.
• Notes of which page version you saw are deleted 180 days after that comparison ends, or with your account. When the temporary account of a free test is deleted, its note stays only under a random code that no longer points to it.
• Server and security logs are kept for a limited time, and Microsoft Clarity keeps its recordings for a limited time on its own schedule.
• Visit records never contain your IP address. The secret value behind their daily visitor codes changes every day (UTC) and the old one is deleted shortly after the day ends, so a code can no longer be traced back to an IP address or browser. Visit records are deleted after 90 days, and totals made from them, such as visitors per day, are kept; copies in our hosting provider’s backups expire on its schedule.

You can change your name and target score on your Profile page. To get a copy of your data, correct it, delete your account or object to how we use your data, write to us through our support form and choose My data, signed in to your account or with your account’s email address. If you live in the EU, EEA or UK, our GDPR page lists your rights and how we handle requests.

Our own visit count skips any browser that sends the Global Privacy Control signal. Visit records are never linked to your account, and shortly after the day of a visit ends (UTC), their codes can no longer be traced back to your IP address or browser. They are deleted after 90 days, or sooner if you ask us.

Prepiva is served over HTTPS. Recordings and test audio are in private storage that only your own account can reach, every database table is protected by access rules, and passwords are stored only as secure hashes.

Prepiva is for people aged 13 and over; under 18, a parent’s or guardian’s permission is needed. In the EU and EEA, stricter consent ages apply. If you think a child has given us data without permission, contact us and we will delete it.

When we change this policy, we update the date above. If a change matters, we tell you by email or on the site first.