Privacy Policy

This Privacy Policy explains how PrepEx ("we", "us", "our") collects, uses, and protects your information when you use our platform and services (the "Service").

By using the Service, you acknowledge this policy and consent to data processing as described here. If you do not agree, please do not use the Service.

We collect the following to operate and improve the Service:

• Account information: name, email address, username, and authentication identifiers.
• Event registration information: webinar contact details, attendance preferences, registration responses, and confirmation status.
• Practice data: written submissions, voice recordings, practice responses, scores, feedback, transcripts, pronunciation analysis, and learning analytics. When you use speaking features, we retain your recordings in private storage for scoring, service improvement, and research purposes as described below.
• Usage data: device and browser info, IP address, pages visited, features used, and interaction patterns.
• Billing data: payment method details and transaction records processed by Stripe.
• Communications: support requests, feedback, and preferences you share with us.

• Operate, maintain, and improve the Service and its features.
• Personalize your practice experience and deliver tailored feedback, including speech transcription, scoring, and review.
• Process payments, manage subscriptions, and maintain billing records.
• Send you service updates, security alerts, and support responses.
• Measure advertising performance and understand which campaigns lead to completed registrations or subscriptions.
• Train and improve our AI scoring and feedback systems to benefit all users.
• Conduct research and develop educational products using de-identified practice data.
• License de-identified datasets (including voice recordings, transcripts, and scores) to trusted education, publishing, and research partners under contractual restrictions.
• Detect fraud, prevent abuse, and meet legal obligations.

We use de-identified practice data from user submissions to train and improve our AI models, scoring algorithms, and feedback systems. This includes voice recordings, transcripts, scores, and related annotations stored in our internal learner audio archive.

We may also license de-identified datasets to trusted education, publishing, and research partners (for example, publishers, universities, or assessment organizations) for purposes such as language learning research, speech corpus development, and test preparation product improvement. Licensed data does not include your name, email address, account identifiers, or other information that directly identifies you. Partners are contractually required to use the data only for agreed research or educational purposes and not to re-identify users.

We apply de-identification techniques and access controls before any internal model training or external licensing. If you prefer your submissions not be used for AI training or licensed research datasets, email us at hello@prepex.ai and we will honor that request going forward.

We process personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong and other applicable laws. Our processing is based on:

• Your use of the Service, which constitutes consent to processing as described here.
• Our legitimate business purposes: operating the Service, developing AI, and ensuring security.
• Compliance with applicable legal requirements.

We use industry-standard measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access controls: Role-based access limits data to authorized personnel only.
• Infrastructure: Hosted on enterprise-grade, SOC 2 Type II certified providers.
• Authentication: Secure session management via Supabase Auth with optional MFA.

No transmission method is 100% secure. We continuously improve our security practices.

We share data only with trusted service providers who help us run the Service:

• Supabase: Database hosting, authentication, and file storage.
• Stripe: Secure payment processing (we never see your full card number).
• SendGrid: Email delivery for account notifications.
• Speech-assessment and AI service providers: We share voice recordings, transcripts, written responses and assessment results with providers that perform speech recognition, pronunciation analysis, scoring and personalized feedback. In the mobile Listen and Repeat feature, the app asks for your consent before sharing recordings, transcripts and assessment results for this processing. Our providers and models may change, but we remain responsible for the protections and purposes described in this policy.
• Analytics providers: Aggregated usage analytics to improve the Service.
• Advertising and attribution providers: Providers such as Meta may receive campaign and device information, browser or click identifiers, IP address, and one-way hashed contact identifiers to measure completed registrations, attribute them to advertising, prevent duplicate event counting, and improve campaign delivery. We do not send plain-text email addresses or names in these conversion events. In the iOS app, native signup measurement shares hashed email and account identifiers and request information with Meta only after you allow tracking through Apple's App Tracking Transparency prompt. Declining does not affect access to learning features. You can change your choice in iOS Settings. The Android app does not send native signup advertising events.
• Education and research partners: De-identified practice datasets (voice recordings, transcripts, scores, and annotations) shared under license for research and educational product development. Partners do not receive account information or other directly identifying personal data.

All providers and licensed partners are contractually required to protect data and use it only for specified purposes.

We keep your data for as long as needed to provide the Service, meet legal obligations, and resolve disputes. You can request account and associated personal-data deletion at any time in the PrepEx app under You → Delete account or at prepex.ai/account/delete. This includes your personal learning history, recordings, transcripts, scores and saved vocabulary. Confirming deletion on the website closes your account immediately; data and recordings are deleted in the background within 7 days, without a confirmation email. App requests are processed within 7 days. We retain a minimal private record of account deletion. Legally required records and data already irreversibly anonymized may be retained; simply removing a name from a voice recording does not make it irreversibly anonymous.

Under Hong Kong's Personal Data (Privacy) Ordinance and other applicable laws, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that inaccurate data be corrected.
• Deletion: Request deletion of your account and associated data.
• Opt out of research use: Request that your submissions not be used for AI training or licensed research datasets.

Email hello@prepex.ai to make any request. We will respond within 40 days as required by Hong Kong law and may ask you to verify your identity.

Users in other jurisdictions may have additional rights. Contact us with any questions.

PrepEx is operated from Hong Kong. Data may be processed in Hong Kong, the United States, and other countries where our providers operate. By using the Service, you consent to this. We take appropriate steps to protect your data during international transfers.

We use essential cookies for session management and authentication. We may also use analytics and advertising-attribution cookies to understand how people use our Service and which campaigns lead to completed registrations or subscriptions. You can limit or remove these cookies through your browser and device privacy settings.

The Service is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with their information, contact us immediately and we will delete it.

We may update this policy as our practices evolve or as laws change. Material updates will be communicated through the Service or by email. Continued use after changes take effect means you accept the updated policy.