Privacy Policy

1. Who This Service Is For

Prepo is intended for students aged 13 to 18 years old:

• We do not knowingly collect personal data from children under 13
• If we discover such data has been collected, it will be deleted promptly
• Parental or guardian consent is required for users under 18
• Parents or guardians may contact us to exercise privacy rights on behalf of minors

2. Information We Collect

3. How We Use Your Information

We use personal data to:

• Provide, maintain, and operate the Service
• Create and manage user accounts securely
• Generate AI tutoring responses and step-by-step solutions
• Personalise educational experiences and study deck schedules
• Improve AI accuracy, problem detection, and system performance
• Monitor safety and prevent abusive or harmful activity
• Comply with legal and regulatory obligations
• Respond to support requests and parental inquiries

We do not sell personal data. We do not use student data for behavioural advertising profiling.

4. AI Data Processing

Prepo uses artificial intelligence systems to generate tutoring responses. Your messages and study inputs:

• May be processed automatically by AI models
• May be temporarily stored to generate responses
• May be retained to improve safety and system performance
• May be reviewed in anonymised or aggregated format for quality control

We implement comprehensive safeguards to reduce risks of harmful or inappropriate outputs.

5. Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contractual necessity: to provide the Service you requested
• Legitimate interests: improving security, safety, and core educational functionality
• Consent: where required (including parental consent for minors)
• Legal obligation: where required by UK statutory law

Where consent is relied upon, it may be withdrawn at any time.

6. Data Sharing

We may share personal data with:

• Cloud hosting and storage providers
• AI infrastructure and machine learning providers
• Analytical and crash diagnostics providers
• Payment processors (if applicable)
• Professional advisers and auditors
• Law enforcement or regulators where legally required
• A buyer or successor in the event of a merger or acquisition

All third parties are contractually required to implement appropriate technical and organisational safeguards. We do not sell personal data.

7. International Transfers

Your data may be processed outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTA)
• Standard Contractual Clauses (SCCs)
• Transfers to countries with recognized UK adequacy decisions

8. Data Retention

We retain personal data:

• For as long as your account remains active
• As necessary to provide services and maintain flashcard retention schedules
• To comply with legal obligations
• To resolve disputes or enforce agreements

When data is no longer required, it is securely deleted or anonymised. You may request deletion of your account and associated personal data at any time.

9. Security Measures

We implement appropriate technical and organisational security measures, including:

• Encryption in transit (HTTPS/TLS) and encryption at rest
• Secure, audited cloud infrastructure
• Role-based access controls and robust authentication measures
• Continuous monitoring systems for abuse or suspicious activity
• Automated AI content moderation safeguards

10. Children’s Safety & Online Protection

In compliance with the UK Online Safety Act:

• We implement safeguards to reduce exposure to harmful or inappropriate content
• We use automated AI moderation and content filtering tools
• We allow immediate reporting of unsafe content via email
• We cooperate with Ofcom and law enforcement where required

Parents or legal guardians may request oversight, export, or deletion of a minor's account at any time.

11. Your Data Protection Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate or incomplete information
• Request erasure ("right to be forgotten")
• Restrict processing of your data
• Object to processing
• Request data portability
• Withdraw consent at any time (where applicable)

To exercise these rights, please email us at [email protected].

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk.

12. Cookies & Tracking Technologies

If you access Prepo via a website, we may use:

• Essential cookies (strictly required for navigation and login functionality)
• Analytics cookies (to measure system performance and improve user experience)

You can manage cookie preferences through your browser settings.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. If changes materially affect your rights, we will notify users via email or in-app notification. Continued use of the Service after updates constitutes acceptance of the revised Privacy Policy.