Privacy Policy

1. Who we are

Prepina (prepina.com) is an AI-assisted English and exam coach for YDS, YÖKDİL, IELTS and TOEFL learners. The service is operated by ELLISEKIZ LLC, 30 North Gould Street, Suite 100, Sheridan, WY 82801, United States (EIN 38-4402067), which is the data controller for the personal data described here.

For any privacy question or request, write to hello@prepina.com.

2. Data we collect

We collect only what we need to run your account and your learning plan:

• Account data: e-mail address, name or display name, and a password stored only as a one-way hash.
• Profile and goals: target exam, target score or level, exam date, daily study time, interface language and time zone.
• Learning evidence: answers, attempts, scores, review schedules, mistake patterns and progress estimates.
• Speaking recordings: audio you record for speaking practice, together with its transcript and assessment.
• Writing: essays and drafts you submit for feedback, together with their assessment.
• Profile: what you do (student, graduate, academic, other) and, optionally, your university, department and year.
• Optional gender: Female, Male or “Prefer not to say”. Answering is not required; leaving it blank changes nothing.
• Optional contact details: mobile phone, Instagram and X username. Never shown to other learners, in the community or to team managers.
• Campus badge: if you choose, the university domain you verified (e.g. metu.edu.tr). We use your university e-mail address only to send the verification link; we do not keep the address, only a one-way hash so one address backs one account. The badge shows next to your name in the community; you can remove it any time.
• Marketing permissions: which permission you gave or withdrew, with which wording, when and where.
• Community: messages you post in discussions, reports you make, people you block and when you accepted the community rules.
• Notification data: your notification preferences and, if you allow push notifications, the browser push subscription.
• Technical data: IP address, browser and device type, request identifiers and error reports, used for security and reliability.
• Payment data, if paid plans are offered: handled by our payment processor; we keep only a customer id and subscription status, never card numbers.

3. How we use your data

We use personal data to:

• create and secure your account and keep you signed in;
• build your daily plan, schedule reviews and estimate your level and exam score;
• transcribe and assess your speaking and writing with AI models and show you feedback;
• send the account e-mails you need (verification, password reset) and the reminders you opt into;
• measure how the product is used, in aggregate and with pseudonymous ids, so we can improve it;
• if you answered it, use your gender only for aggregate statistics (for example what share of learners are female or male); it does not change your plan, your scores or the content you see, and it never reaches analytics tools or marketing lists;
• prevent abuse, investigate errors and meet legal obligations;
• only if you separately agreed: send campaign, event and feature news by e-mail or SMS/WhatsApp, and share your contact details with our partners (see sections 4 and 7).

4. Legal bases

We process your data to perform our contract with you (providing the service), on the basis of our legitimate interests (security, fraud prevention, product improvement with pseudonymous data), with your consent where the law requires it (for example push notifications), and to comply with legal obligations. You can withdraw consent at any time without affecting earlier processing.

Marketing news and partner sharing rely only on your explicit consent, given separately for each; they are not a condition of using the service and start unticked. Commercial electronic messages follow Turkish Law No. 6563 and the Message Management System (İYS). Withdraw them in Settings › Profile and permissions or through the opt-out in any message.

Gender relies only on the explicit consent you give by answering the optional question (KVKK art. 5/1). Change it at any time in Settings › Profile and permissions, or choose “Not selected” to delete it; once deleted it no longer counts in the statistics.

5. AI processing

Speaking and writing feedback is produced by automated models. The text or audio of a submission is sent to the AI provider only to produce that assessment; providers are configured not to use it to train their models where that option exists. Scores and score ranges are estimates for practice and are not official exam results. No decision with legal or similarly significant effect is made about you solely by automated means.

6. Service providers

We share data only with providers that help us run the service, under contracts that limit their use of it:

• hosting, database, file storage and content delivery (including Cloudflare);
• AI providers for transcription, pronunciation scoring, assessment and text-to-speech;
• transactional e-mail delivery;
• product analytics (PostHog, US; pseudonymous id, no name or e-mail) and error monitoring;
• only if you accept cookies, Google Analytics / Firebase (Google, US) for website usage statistics, with advertising uses switched off;
• browser push services (Apple, Google, Mozilla) for notifications you enable;
• a payment processor (Stripe), only if paid plans are offered.

7. Sharing with partners

Only if you gave explicit consent to partner sharing and declared that you are 18 or older, your name, e-mail address, phone, school and department and exam goal may be shared with our partners in education, publishing and study-abroad advisory so they can offer you their own products. Partners are separate controllers of this data and are bound by contract to use it only for that purpose and to honour withdrawals. We log every transfer with the partner and the date; you can ask us who received your details. When you withdraw consent, no new sharing happens and we forward the withdrawal to partners who already received your details. Gender is never shared with partners.

8. International transfers

ELLISEKIZ LLC is established in the United States and some providers process data outside your country, including in the European Union and the United States. Where data leaves Türkiye, the European Economic Area or the United Kingdom, we rely on the safeguards the applicable law provides, such as standard contractual clauses or your explicit consent where required.

9. Retention

We keep account and learning data for as long as your account exists. Speaking recordings are deleted automatically 90 days after they are made, and you can delete a recording sooner; its assessment stays with your progress. Data exports are available for 7 days. When you delete your account, we delete or anonymise your personal data, except where we must keep records to meet a legal obligation. Your community messages stay for the coherence of discussions but lose their author (shown as "deleted user"); your reports and blocks are deleted. You can delete a message yourself before deleting your account.

10. Your rights

Depending on where you live (for example under KVKK in Türkiye, the GDPR in the EEA and UK, or the CCPA in California), you have the right to:

• know whether we process your data and access a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• receive your data in a portable format;
• object to or restrict certain processing, and withdraw consent;
• learn which third parties receive your data;
• complain to your data protection authority (in Türkiye, the Personal Data Protection Authority).

11. Exercising your rights

You can download your data and delete your account yourself under Settings → Privacy and my data. For any other request, write to hello@prepina.com from the address on your account. We answer within 30 days and may ask you to confirm your identity.

12. Cookies and local storage

We use essential cookies to keep you signed in and remember your language, and browser storage for settings such as the theme. Analytics cookies (Google Analytics / Firebase) load only if you accept them in the cookie banner; if you reject, they never load. Change your choice any time with "Cookie settings" at the bottom of the page. We use no advertising cookies and do not sell or share personal data for advertising.

13. Security

Data is encrypted in transit, passwords are hashed, recordings are kept in private storage that is reachable only through short-lived signed links, and access by our team is limited to what their role requires. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

14. Teams

If you join a team through your school or employer, the team manager sees only activity counts (such as days studied and items completed). Managers cannot see your answers, recordings or essays.

15. Children

Prepina is intended for people aged 16 and over. We do not knowingly collect data from younger children; if you believe a child has created an account, contact us and we will delete it.

16. Changes

We may update this policy as the service changes. We will show the new date at the top and, for material changes, tell you in the app or by e-mail before they take effect.

17. Contact

ELLISEKIZ LLC, 30 North Gould Street, Suite 100, Sheridan, WY 82801, United States (EIN 38-4402067). E-mail: hello@prepina.com.