1. Who this covers
This policy explains how PrepMeX ("we", "us") handles personal data when you use prepmex.com and the PrepMeX platform. PrepMeX is an independent exam-preparation service operated as a sole proprietorship in the Kingdom of Saudi Arabia, and is the data controller for the data described here. You can reach us about anything privacy-related at support@prepmex.com. The operator's registered legal and identity details are held by Dodo Payments as part of its merchant verification, and we will provide them to any buyer on request at support@prepmex.com.
2. Data we collect
- Account data — your name, email address, study goal, and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name and email from Google.
- Study activity — the attempts you start, your answers, essays you write, speaking responses you record (audio), scores, AI-generated feedback and its translations, vocabulary progress, and study statistics.
- Preferences — interface language, chosen exam, test date, target score, notification choices, and your mastered-word list. These are stored on our servers against your account so they follow you between devices, and mirrored in your browser so the app works offline. Your theme choice is the exception: it stays on the device.
- Purchase data — your plan, subscription status, and credit balance. Payments are processed by Dodo Payments, our Merchant of Record: Dodo collects your payment details as its own controller, and we never receive your full card number. From Dodo we receive and store what billing and support need — the order reference, the plan bought, the amount and currency charged, the subscription's status, a link to your invoice, and the name and email you gave at checkout.
- Support messages — emails you send to support@prepmex.com, and any problem report you submit from inside the app, including the screenshot of your screen that the report form captures and the page and device details it records.
- Technical basics — sign-in records we keep ourselves: for each session, the IP address, the browser and device reported by your browser, the sign-in method, and the times it started and ended. We show these back to you on your Security page so you can see who has been in your account, and we keep the 50 most recent per account. We also record refused requests (for example a rejected verification code) for security monitoring. Our hosting and infrastructure providers keep their own operational logs in addition to this.
We do not collect data for advertising, we use no advertising cookies or third-party trackers, and we never sell personal data.
3. How we use your data
- To run the product: draw your exams, save your answers, grade them, and show you your results and progress.
- To score speaking and writing: transcribe your recordings and grade your responses with AI (see section 4).
- To translate AI feedback into your interface language when you ask for it.
- To process purchases, manage subscriptions and credits, and prevent abuse of free credits and refunds.
- To answer your support requests.
- To keep the Service secure and diagnose failures.
We process this data because it is necessary to provide the Service you signed up for (performance of a contract), because of our legitimate interest in securing and improving the Service, or with your consent where required.
4. AI processing
When you complete a speaking or writing task, your recording or essay is sent to our AI provider, OpenRouter, Inc. (United States), which routes it to speech-recognition and language models for transcription, scoring, and feedback — and, on request, feedback translation. The data shared is what the task requires: your response, the task prompt, and the scoring rubric. It is processed to deliver your results, not to build advertising profiles.
Practical tip: your essays and recordings should contain only what the exam task asks for — there is never a reason to include real personal details like ID numbers or addresses in a practice answer.
5. Who processes data for us
We share personal data only with the service providers that run PrepMeX:
- Supabase — database, authentication, and file storage (your account, attempts, and recordings).
- Vercel — web hosting and delivery.
- Resend — transactional email (sign-in confirmations, security notices, and account messages).
- OpenRouter — AI transcription, scoring, feedback, and translation (section 4).
- Dodo Payments (Dodo Payments Inc, Dodope Payments Limited and Sarvapanchhi Technologies Private Limited (together, the Dodo Payments group)) — Merchant of Record: checkout, payment processing, tax calculation and remittance, invoices, subscription billing, and billing support. For payment data Dodo is an independent controller under its own privacy policy, not a processor acting on our instructions; you can reach Dodo's privacy team at privacy@dodopayments.com.
Each provider processes data under its own contractual safeguards and only to provide its service to us. We may also disclose data if the law requires it, or as part of a merger or acquisition (in which case this policy continues to apply to data collected before the change).
These providers may store data in the United States, the European Union, or India. Where data leaves your jurisdiction, it is protected by the providers' standard contractual safeguards.
7. How long we keep data
Account and study data are kept while your account exists, so your history and analytics keep working. You can delete your account yourself at any time — Settings → Support → Delete this account — and it takes effect immediately rather than within the 30 days this policy allows us. Your simulations, answers, scores, AI feedback, vocabulary progress, preferences, sign-in history and stored recordings are removed. Records we must keep for legal, security, or accounting reasons remain, with your name and email removed from them. Payment and invoice records are retained by Dodo Payments under its own legal and tax obligations, and deleting your PrepMeX account does not erase them.
8. Your rights
Depending on where you live (including under the GDPR and similar laws), you can ask us to:
- Access the personal data we hold about you, or receive an export of it.
- Correct inaccurate data.
- Delete your data ("right to be forgotten").
- Restrict or object to certain processing.
You can download a copy of your data yourself at any time: Settings → Support → Your data. You can delete the account yourself in the same place. For anything else — corrections, restriction — email support@prepmex.com from your account email and we will respond within 30 days. For payment and invoice data held by Dodo Payments as its own controller, write to privacy@dodopayments.com. If you are unsatisfied, you can complain to your local data-protection authority.
9. Security
All traffic is encrypted in transit (TLS). Database access is governed by row-level security so learners can only read their own records; answer keys and grading data are never exposed to the browser. Service credentials are restricted to server-side use. No system is perfectly secure, but if a breach affects your data we will notify you as the law requires.
10. Children
PrepMeX is not directed at children under 13, and we do not knowingly collect their data. Learners aged 13–18 may use PrepMeX with a parent or guardian's consent. If you believe a child under 13 has created an account, contact us and we will delete it.
11. Changes to this policy
We will update this policy as the product evolves and note the new date at the top. For material changes we will give notice in the product or by email before they take effect.
Questions or requests: support@prepmex.com.