1. Who is responsible
PrepPulse is the seller and data controller responsible for personal information processed to operate the PrepPulse exam-preparation service. This notice explains our practices and your choices. Paddle acts separately for personal information it processes as Merchant of Record.
2. Information we use and why
- Account information: email address, name or profile details you provide, sign-in identifiers, and authentication records enable account creation, login, account administration, and security. Google sign-in may supply your basic profile and email if you choose it. The legal bases, where required, are performance of our contract and legitimate interests in security.
- Study activity: quiz answers, attempts, scores, bookmarks, progress, and submitted writing provide practice, feedback, and progress tracking. This processing is necessary to provide the service you request.
- AI inputs: essays, prompts, and relevant question context may be processed by AI providers when you request AI evaluation, to return feedback. Do not submit sensitive information or personal information about others unnecessarily. The legal basis is providing the requested service.
- Diagnostic offers: an email address submitted to request an offer is stored with the offer identifier to fulfil that request. Where consent is required, it is the legal basis; unrelated promotional messages require appropriate consent, which you can withdraw.
- Support messages: correspondence and details you provide are used to respond to enquiries, resolve disputes, and handle privacy or rights complaints, based on contract performance, legitimate interests, or legal obligations as appropriate.
- Technical information: IP addresses, browser and device details, error reports, and service logs support delivery, troubleshooting, fraud prevention, and reliability. These uses rely on legitimate interests in operating a secure service, subject to applicable consent requirements.
- Purchase status: plan identifiers, subscription status, and transaction references enable paid access and subscription management, based on contract performance and legal obligations. Paddle processes checkout and payment information under its own privacy notice.
3. Sharing and international processing
We share information only as needed with service providers for hosting, authentication, data storage, AI evaluation, service monitoring, and support; with Paddle for sales, subscription management, payments, tax compliance, and invoicing; with professional legal and accounting advisers; and with authorities when required by law. We do not sell personal information.
Providers may process information outside your province or country, including outside Canada, where local laws may differ. We use appropriate contractual and organisational safeguards. Where UK or EEA transfer rules apply, we rely on applicable adequacy decisions or approved standard contractual clauses and additional safeguards where required.
Read Paddle’s Privacy Notice for its independent processing.
4. Retention
Account and learning records are kept while your account is active and as needed to provide the service. Offer-request information is retained only while needed to fulfil the request and any consented communications. Support and security records are kept for as long as reasonably necessary to resolve issues and protect the service. Records required for legal, accounting, or dispute purposes may be retained for the applicable statutory period. When no longer needed, information is deleted or anonymised; backup copies expire through normal retention cycles.
5. Your privacy rights
Depending on applicable Canadian federal or provincial privacy law, you may request access to your personal information, corrections, information about its use or disclosure, and withdrawal of consent, subject to legal or contractual limits. You may also request deletion where applicable and raise a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial regulator.
If UK or EEA data protection law applies, rights also include erasure, restriction, portability, objection, withdrawal of consent without affecting prior lawful processing, and complaint to your supervisory authority. We respond within one month where GDPR applies, subject to permitted extensions, or within the deadline required by applicable law. We may verify your identity before acting. Direct privacy requests to PrepPulse and identify your account and the right you wish to exercise.
6. Security
We use appropriate technical and organisational safeguards, including encrypted connections, authentication, and access controls, to protect personal information. Access is limited to authorised purposes. No internet service can guarantee absolute security; protect your account credentials and do not share your password.
7. Cookies and local storage
Essential cookies and similar browser storage support sign-in, security, checkout, and preferences such as the colour theme. You can manage cookies and site storage in your browser; blocking essential storage can prevent sign-in or checkout from working. Paddle may use storage needed to operate its checkout, as explained in its privacy notice.
This notice does not authorise optional advertising or analytics cookies without consent where required. If such technologies are introduced, we will explain them and provide the required preference controls before enabling them.
8. Updates
We will update this notice when practices change, update the effective date, and provide additional notice for material changes where required by law.