PRIVACY POLICY
LAST UPDATED: APRIL 2026 · VERSION 2.0 · GDPR · UK-GDPR · CCPA/CPRA · UAE-PDPL · KSA-PDPL
1. Controller & Contact
v1prep (“we”, “us”, “our”) is the trading name under which the Operator (a natural person or legal entity identified in our Legal Notice / Imprint) provides the Service. The Operator is the Data Controller for personal data processed through the Service, as that term is defined in Article 4(7) GDPR / UK-GDPR. For any privacy enquiry please use our Contact form with subject “Privacy Request”. A formal Data Protection Officer (DPO) is appointed only if mandated by Art. 37 GDPR (most solo operators are exempt); where no DPO is required, privacy requests are handled directly by the Operator via the Contact form.
2. Scope
This policy applies to all users of the Service worldwide. Regional laws apply in addition — we have included specific sections for EU/EEA & UK, California, other US states, UAE and Saudi Arabia.
3. What data we collect
- Account data — name, email, hashed password, plan tier, account creation date, language and theme preference.
- Usage data — questions attempted, correctness, session duration, streak, bookmarks, flagged questions, error reports.
- Payment metadata — billing country, plan purchased, subscription status, transaction reference. Card data is handled exclusively by Gumroad (PCI-DSS Level 1). We never see or store card numbers or CVVs.
- Contact data — name, email, organisation, message content (if you contact us).
- Technical data — IP address (truncated to /24 for storage), browser type, device type, referrer, approximate region (from IP), timestamps.
- Support data — correspondence content and attachments you send to support.
We do not knowingly collect special-category data (health, biometric, genetic, political, religious, sexual-orientation data) and ask you not to submit any. We do not engage in automated decision-making or profiling with legal or significant effect on you.
4. Purposes & lawful bases (GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Create and operate your account | Contract §6(1)(b) |
| Deliver Content and track progress | Contract §6(1)(b) |
| Process payments and prevent fraud | Contract §6(1)(b) · Legal obligation §6(1)(c) |
| Send transactional emails (receipts, resets) | Contract §6(1)(b) |
| Answer support requests | Contract §6(1)(b) · Legitimate interest §6(1)(f) |
| Accounting & tax records | Legal obligation §6(1)(c) |
| Site security, abuse/fraud prevention, log analysis | Legitimate interest §6(1)(f) |
| Aggregated usage analytics (no personal profiling) | Legitimate interest §6(1)(f) |
| Marketing emails & newsletters | Consent §6(1)(a) — opt-in & opt-out anytime |
| Non-essential cookies & tracking | Consent §6(1)(a) · ePrivacy Art. 5(3) |
5. Third-party processors & recipients
| Processor | Purpose | Location |
|---|---|---|
| Gumroad | Payment processing (Merchant of Record), VAT/sales-tax handling, invoicing | USA — SCCs + supplementary measures |
| Google Firebase | Authentication, event analytics, hosting (if enabled) | USA/EU — SCCs + Data Privacy Framework |
| Transactional email provider | Password resets, receipts, account emails | USA/EU — SCCs |
| Netlify / hosting provider | Static site hosting, TLS, CDN | Multiple — SCCs where applicable |
All processors are bound by Data Processing Agreements and are contractually restricted to processing your data only on our documented instructions.
6. International transfers
Some processors operate outside the EU/EEA and UK. When we transfer personal data to such countries we rely on: the EU Commission adequacy decision (if any), Standard Contractual Clauses (SCCs) 2021/914, the UK International Data Transfer Addendum, or (for US-Data-Privacy-Framework-certified recipients) the DPF. You may request a copy of the safeguards we use.
7. Retention periods
| Category | Period |
|---|---|
| Account data (active account) | As long as the account is active |
| Account data (after deletion request) | 30 days then erased |
| Transaction records, invoices, tax | 10 years (legal obligation) |
| Usage & progress data | 24 months then anonymised |
| Server access logs | 90 days |
| Security logs (incident investigation) | 12 months |
| Support correspondence | 24 months |
| Marketing consent / opt-out records | 3 years after last interaction |
8. Security
We apply appropriate technical and organisational measures including TLS 1.2+ in transit, encryption at rest for passwords (bcrypt/argon2), least-privilege access, logging, MFA for admin access, security patching, supplier due-diligence, and incident-response procedures. No system is 100% secure and we cannot guarantee absolute security.
9. Breach notification
In the event of a personal-data breach likely to result in a risk to your rights and freedoms we will notify the competent supervisory authority within 72 hours (GDPR Art. 33) and will notify affected individuals without undue delay where the breach is likely to result in a high risk (Art. 34).
10. Cookies & similar technologies
We describe cookies and browser-storage usage in a separate Cookie Policy. You can change your preferences at any time via the “Cookie Settings” link in the footer.
11. Your rights (all regions — summary)
- Access — obtain a copy of your personal data.
- Rectification — correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”) — request deletion subject to legal retention.
- Restriction — limit processing while a dispute is pending.
- Portability — receive your data in a commonly-used machine-readable format.
- Object — to processing based on legitimate interest or direct marketing.
- Withdraw consent — at any time, without affecting prior lawful processing.
- Not be subject to solely automated decision-making — with legal or significant effect (we do not engage in this).
- Lodge a complaint with your supervisory authority (see regional sections).
To exercise any right, use our Contact form. We respond within 30 days (GDPR) or 45 days (CCPA/CPRA); we may ask you to verify identity before acting on a request. There is no fee; excessive or manifestly unfounded requests may be charged or refused.
12. Children's privacy
The Service is not intended for children under 16 (EU/EEA) or 13 (US/UK). We do not knowingly collect data from such children. If you believe a child has provided us data, contact us and we will delete it promptly.
13. EU/EEA supplement (GDPR)
If you are in the EU/EEA, the General Data Protection Regulation (EU) 2016/679 applies. You may lodge a complaint with the supervisory authority of your country of residence, work or alleged infringement. A list of EU DPAs is available at edpb.europa.eu. If we do not have an establishment in the EU we will designate an EU representative (Art. 27); their contact details will appear in our Legal Notice.
14. UK supplement (UK GDPR & DPA 2018)
If you are in the UK, the UK General Data Protection Regulation and the Data Protection Act 2018 apply. You may complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. If we are based outside the UK we will designate a UK representative where required by Art. 27 UK-GDPR.
15. California & other US residents (CCPA/CPRA & state privacy laws)
Notice at collection: in the previous 12 months we have collected the categories of personal information listed in section 3 (identifiers, commercial information, internet/network activity, geolocation approximation, inferences). Purposes and disclosures are described above. We retain each category as set out in section 7.
Sale / sharing: we do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA.
Your California rights: the right to know, delete, correct, limit the use of sensitive personal information (we do not collect such information), opt-out of sale/sharing (N/A), and the right to non-discrimination for exercising any right. You may also make a “Shine the Light” request (Cal. Civ. Code § 1798.83).
Global Privacy Control: we honor the GPC browser signal as an opt-out of sale/sharing where applicable.
How to exercise: submit a request via our Contact form. Authorised agents may act on your behalf with written authorisation and identity verification.
Other states: residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA) and other states with comparable laws have equivalent access, deletion, correction and opt-out rights. Submit requests via the Contact form.
16. Middle East supplement (UAE PDPL, Saudi PDPL)
If you are in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) applies. You have rights comparable to the GDPR: access, correction, erasure, restriction, objection, portability and withdrawal of consent. Complaints may be addressed to the UAE Data Office.
If you are in the Kingdom of Saudi Arabia, the Personal Data Protection Law (Royal Decree M/19 of 2021, as amended) applies. You have comparable rights of access, correction and deletion; cross-border transfers are permitted only with appropriate safeguards and, where required, authorisation of the Saudi Data & AI Authority (SDAIA).
Other Middle-Eastern jurisdictions (Bahrain, Qatar QFC, DIFC Law 5 of 2020, ADGM) have similar regimes; we honour equivalent rights. Submit requests via our Contact form.
17. Other regions
We honour equivalent privacy rights granted under applicable law to residents of Canada (PIPEDA/Law 25 Quebec), Brazil (LGPD), Switzerland (revFADP), Australia (Privacy Act 1988), Japan (APPI), South Korea (PIPA), Singapore (PDPA), and others.
18. Changes to this policy
We may update this Policy to reflect changes in law or our practices. Material changes will be notified via email or a prominent site banner at least 30 days before taking effect. The “Last updated” date at the top reflects the latest revision.
19. Contact
Privacy enquiries, rights requests, complaints: use our Contact form. DPO and EU/UK representative details (where appointed) appear in our Legal Notice / Imprint.