Privacy Policy

This Privacy Policy explains how PrepEx ("we", "us", "our") collects, uses, and protects your information when you use our platform and services (the "Service").

By using the Service, you acknowledge this policy and consent to data processing as described here. If you do not agree, please do not use the Service.

We collect the following to operate and improve the Service:

• Account information: name, email address, username, and authentication identifiers.
• Practice data: written submissions, voice recordings, practice responses, scores, feedback, transcripts, pronunciation analysis, and learning analytics. When you use speaking features, we retain your recordings in private storage for scoring, service improvement, and research purposes as described below.
• Usage data: device and browser info, IP address, pages visited, features used, and interaction patterns.
• Billing data: payment method details and transaction records processed by Stripe.
• Communications: support requests, feedback, and preferences you share with us.

• Operate, maintain, and improve the Service and its features.
• Personalize your practice experience and deliver tailored feedback, including speech transcription, scoring, and review.
• Process payments, manage subscriptions, and maintain billing records.
• Send you service updates, security alerts, and support responses.
• Train and improve our AI scoring and feedback systems to benefit all users.
• Conduct research and develop educational products using de-identified practice data.
• License de-identified datasets (including voice recordings, transcripts, and scores) to trusted education, publishing, and research partners under contractual restrictions.
• Detect fraud, prevent abuse, and meet legal obligations.

We use de-identified practice data from user submissions to train and improve our AI models, scoring algorithms, and feedback systems. This includes voice recordings, transcripts, scores, and related annotations stored in our internal learner audio archive.

We may also license de-identified datasets to trusted education, publishing, and research partners (for example, publishers, universities, or assessment organizations) for purposes such as language learning research, speech corpus development, and test preparation product improvement. Licensed data does not include your name, email address, account identifiers, or other information that directly identifies you. Partners are contractually required to use the data only for agreed research or educational purposes and not to re-identify users.

We apply de-identification techniques and access controls before any internal model training or external licensing. If you prefer your submissions not be used for AI training or licensed research datasets, email us at hello@prepex.ai and we will honor that request going forward.

We process personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and other applicable laws. Our processing is based on:

• Your use of the Service, which constitutes consent to processing as described here.
• Our legitimate business purposes: operating the Service, developing AI, and ensuring security.
• Compliance with applicable legal requirements.

We use industry-standard measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access controls: Role-based access limits data to authorized personnel only.
• Infrastructure: Hosted on enterprise-grade, SOC 2 Type II certified providers.
• Authentication: Secure session management via Supabase Auth with optional MFA.

No transmission method is 100% secure. We continuously improve our security practices.

We share data only with trusted service providers who help us run the Service:

• Supabase: Database hosting, authentication, and file storage.
• Stripe: Secure payment processing (we never see your full card number).
• SendGrid: Email delivery for account notifications.
• AI service providers: Speech recognition, voice recording analysis, natural language processing, and scoring.
• Analytics providers: Aggregated usage analytics to improve the Service.
• Education and research partners: De-identified practice datasets (voice recordings, transcripts, scores, and annotations) shared under license for research and educational product development. Partners do not receive account information or other directly identifying personal data.

All providers and licensed partners are contractually required to protect data and use it only for specified purposes.

We keep your data for as long as needed to provide the Service, meet legal obligations, and resolve disputes. Voice recordings and related practice data may be retained in de-identified form for AI development, research, and licensed dataset purposes after account deletion, unless you have opted out. You can request account and data deletion at any time by contacting us.

Under Hong Kong's Personal Data (Privacy) Ordinance and other applicable laws, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that inaccurate data be corrected.
• Deletion: Request deletion of your account and associated data.
• Opt out of research use: Request that your submissions not be used for AI training or licensed research datasets.

Email hello@prepex.ai to make any request. We will respond within 40 days as required by Hong Kong law and may ask you to verify your identity.

Users in other jurisdictions may have additional rights. Contact us with any questions.

PrepEx is operated from Hong Kong. Data may be processed in Hong Kong, the United States, and other countries where our providers operate. By using the Service, you consent to this. We take appropriate steps to protect your data during international transfers.

We use essential cookies for session management and authentication. We may also use analytics cookies to understand how people use our Service. You can manage cookie preferences through your browser settings.

The Service is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their information, contact us immediately and we will delete it.

We may update this policy as our practices evolve or as laws change. Material updates will be communicated through the Service or by email. Continued use after changes take effect means you accept the updated policy.