Privacy policy
This policy explains what personal data Prepium collects when you use prepium.sh, why, who processes it for us, and the choices you have. We do not sell your personal data and we do not use it for advertising.
What we collect
| Account | Email address, username, a salted hash of your password (never the password itself), or your Google account identity if you sign in with Google. Optionally, the certification and exam date you tell us about. |
|---|---|
| Purchases | Order number, product, price, date and status, received from Lemon Squeezy. Your card or payment details never reach us. |
| Learning activity | Lab sessions, task and exam scores, question-bank answers, readiness history and lab progress such as timers and flagged tasks. |
| Lab environments | Commands, files and system state inside the lab environments created for you. Graders inspect them to score your work, and AI Lab Coach reads them when you ask it for a diagnosis. |
| Messages | Support chat, learner-to-learner chat, problem reports and any email you send us. |
| Technical data | IP address, browser user agent, request and security logs, and an audit log of account actions such as sign-ins and purchases. |
| Marketing source | The campaign or referrer that first brought you to the site (for example a UTM tag), stored with your account at sign-up. |
Why we use it
- To run the service: sign you in, provision and grade labs, track access periods and show your progress (performance of our contract with you).
- To support you: answer messages, fix problems and process refunds.
- To keep the platform secure and fair: detect abuse, protect lab infrastructure and investigate incidents (legitimate interests).
- To improve Prepium: understand which pages and tracks are used and which marketing channels work (legitimate interests, and consent where required for analytics cookies).
- To send service emails such as email verification (order receipts come from Lemon Squeezy). If you tell us your exam date we may send exam-related study offers; reply to any of them and we will stop.
Cookies and local storage
- Session cookie (
sid): keeps you signed in. Strictly necessary; the site does not work without it. - Google Analytics: measures visits and page use with its own cookies. You can block it with your browser settings or an extension without affecting the service.
- Local storage: remembers small preferences in your browser, such as the track you last selected or flashcard progress.
Who processes data for us
| Hetzner | Hosts the platform and lab environments in EU data centres. Some lab environments also run on servers operated directly by Prepium. |
|---|---|
| Cloudflare | Delivers the website and protects it from attacks; it sees connection data such as IP addresses. |
| Lemon Squeezy | Merchant of record: takes payments, handles tax and issues refunds under its own privacy policy. |
| "Sign in with Google", Google Analytics, and storage for our database backups. | |
| Resend | Sends account and service emails. |
| AI model provider | Processes the lab context (commands, files, task text and results) when you use AI Lab Coach or AI exam reviews. We send only what the feature needs, not your email or payment details. |
| Discord | Problem reports, and "exam ready" milestones you choose to share, are posted to the Prepium Discord so we can act on them. |
Some of these providers are outside your country, including in the United States. Where the law requires it, transfers are covered by appropriate safeguards such as standard contractual clauses.
How long we keep it
- Account, purchase and learning data: for as long as your account exists, so your history and access stay available.
- Audit and security logs: 90 days.
- Lab environments: deleted when the session ends; scores and results are kept with your account.
- Backups: deleted data can remain in database backups until those backups are rotated out.
- Records we must keep for tax or accounting are held by Lemon Squeezy and by us for as long as the law requires.
Your rights
You can ask to access, correct, export or delete your personal data, or object to how we use it, by emailing [email protected] from your account email. We answer within 30 days. Deleting your account removes your access, including any paid access. You also have the right to complain to your local data protection authority.
Children
Prepium is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
Changes
We will update this page when our practices change. The date at the top shows the latest version; significant changes will also be announced by email.
Contact
Privacy questions or requests: [email protected].