This policy describes what PrepGraph collects, why, who it is shared with, and what you can ask us to do about it. It describes the service as actually built, not a generic template.
PrepGraph (“we”, “us”) operates getprepgraph.com
and its subdomains gmat.getprepgraph.com and gre.getprepgraph.com. We are the
data controller for the personal data described here.
Contact for any privacy question or request: [email protected].
| Data | When |
|---|---|
| Email address, and a hashed password if you register with one | Account creation |
| Name and profile picture URL | If you sign in with Google, from your Google profile |
| Career track and stated goal | Onboarding |
| Concepts, topics and notes you create | As you use the Workshop |
| Practice answers, self-ratings and generated feedback | As you practise in the Arena |
| Résumés you upload or paste, and job descriptions you submit for analysis | If you use the résumé and job-match features |
| Data | Purpose |
|---|---|
| Practice streak, last practice date, last AI-call date | Progress display |
| Count of AI sessions and résumé rewrites used | Enforcing free-tier limits |
| Subscription status and period end | Access control |
| Stripe customer identifier | Linking your account to billing |
| API keys and OAuth tokens you create, stored as SHA-256 hashes | Authenticating connectors |
| Purpose | Basis (UK/EU GDPR) |
|---|---|
| Creating and running your account; delivering the features you ask for | Performance of a contract |
| Taking payment and managing subscriptions | Performance of a contract |
| Daily or weekly study emails | Consent — withdraw any time via the unsubscribe link |
| Keeping the service secure and enforcing usage limits | Legitimate interests |
| Meeting tax and accounting obligations | Legal obligation |
We use the following processors. We do not sell personal data, and we do not share it with anyone not listed here except where section 5 applies.
| Processor | What it receives | Where |
|---|---|---|
| Amazon Web Services (Bedrock) | Text you submit to AI features: practice answers, concepts, résumé contents, job descriptions | United States (us-east-1) |
| Stripe | Email address and payment details you enter on Stripe’s checkout | United States / EU |
| Resend | Email address and message content, for transactional and study emails | United States |
| DigitalOcean | Hosting for the application and database | United States |
| Cloudflare | Traffic proxying and TLS termination | Global edge network |
| Authentication, only if you choose “Sign in with Google” | United States |
Our servers and several processors are in the United States. If you are in the UK, EEA or Switzerland, your personal data is transferred outside your jurisdiction. These transfers rely on the processors’ Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
PrepGraph can be connected to external AI assistants through the Model Context Protocol. If you authorise such a connector, you are granting that third party access to your PrepGraph data, and its own privacy policy will govern what it does with what it reads.
Subject to your local law, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, port it elsewhere, or withdraw consent. If you are in California, you additionally have the right to know, delete, correct, and to opt out of “sale” or “sharing” — we do neither.
Email [email protected]. We will respond within 30 days. You will not be charged or treated differently for exercising these rights. If you are in the UK or EEA and are unhappy with our response, you may complain to your national data protection authority.
Traffic is encrypted in transit with TLS. Passwords are stored as bcrypt hashes and API keys and OAuth tokens as SHA-256 hashes, so none are recoverable from our database. Access to production infrastructure is limited to key-based SSH. Database backups run on an automated schedule.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and notify you where the breach is likely to present a high risk to you.
PrepGraph is intended for adults preparing for professional interviews and graduate admissions tests. It is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.
If we change this policy materially, we will update the date above and notify registered users by email before the change takes effect.