PrepClubsPrepClubs

Privacy Policy

Effective date: September 24, 2026.

This Privacy Policy explains what data PrepClubs collects, how we use it, who processes it on our behalf, and what rights you have. By using PrepClubs you agree to the practices described below.

1. Data we collect

  • Account data: email address, hashed password, sign-up date.
  • Practice data: test attempts, answers, scores, progress timestamps, time-per-question.
  • Billing data: Stripe customer ID, purchase records, plan key, access-window expiry. Full card details never touch our servers. Stripe handles them directly.
  • Communications: emails you send us and optional email preferences.
  • Technical data: IP address, browser user agent, and essential session cookies used only to keep you logged in and secure.
  • Usage data: pages you view, approximate location, device and browser type, and actions such as viewing pricing, starting checkout, or completing a purchase. We collect this with Google Analytics (see section 6).

Google Analytics 4 is the only third-party web analytics tool we use (see section 6). We do not use other analytics tools (no Plausible, no Mixpanel) and we do not run third-party error monitoring (no Sentry, no Datadog RUM) on PrepClubs.

2. How we use your data

  • To provide the practice tests, score them, and show you your history.
  • To process one-time purchases and unlock the tests you paid for.
  • To send transactional emails such as receipts, password resets, and access-window expiry notices.
  • To send product updates or educational emails only when you opt in.
  • To detect abuse, scraping, or fraud, and to enforce our Terms of Service.
  • To understand how visitors use PrepClubs and improve the site, pricing, and checkout, using Google Analytics.

We do not sell personal data. We do not rent it. We do not share it with advertising networks.

3. Subprocessors

The following third-party services process limited personal data on our behalf to operate PrepClubs:

  • Stripe, Inc. Payment processing. Stores card data, billing address, and Stripe customer ID. See stripe.com/privacy.
  • Meisa. Transactional and opt-in email delivery. Stores email address, first name if provided, and message metadata.
  • Shared hosted database infrastructure. We run a managed MongoDB deployment on infrastructure shared across a small set of PrepClubs products. Your PrepClubs data lives in a dedicated prepclubs database isolated at the schema level and access-controlled per application.
  • Google LLC (Google Analytics 4). Website usage measurement. Receives the usage data described in section 6, never your name, email address, or payment details. See policies.google.com/privacy.

Each subprocessor is bound by a data processing agreement and is only sent the minimum data required for the function listed.

4. Data retention

  • Account and practice data: retained while your account is active and for up to 24 months after last login, then deleted or anonymized.
  • Billing records: retained for 7 years to meet tax and accounting obligations.
  • Email logs: retained by Meisa for up to 12 months, then purged.
  • Support emails: retained for 24 months.
  • Google Analytics data: kept for up to 14 months, then deleted automatically.

You can request earlier deletion at any time (see Your rights below).

5. Your rights

Depending on where you live, you have some or all of these rights under GDPR, UK GDPR, CCPA, and similar laws:

  • Access: request a copy of the personal data we hold about you.
  • Export: receive your account and practice data in a machine-readable format.
  • Correction: fix inaccurate data.
  • Deletion: ask us to erase your account and associated data, subject to legal retention obligations.
  • Opt out: unsubscribe from non-transactional email from the link in any email.
  • Complaint: lodge a complaint with your local data protection authority.

To exercise any of these rights, email [email protected]. We respond within 30 days.

6. Cookies and analytics

Essential cookies. These keep you signed in, maintain your test session, remember your language, and protect against CSRF. PrepClubs cannot work without them.

Google Analytics. We use Google Analytics 4, a service provided by Google LLC, to understand how visitors use PrepClubs and to improve it. It sets first-party cookies (_ga and _ga_<id>) that store a random identifier, so visits from the same browser can be counted together. It collects the pages you view, your approximate location (derived from your IP address; Google Analytics 4 does not log or store IP addresses), your device and browser type, and events such as viewing pricing, starting checkout, and completing a purchase, including the plan, the test category, the price version shown to you, and the amount paid. Checkout, purchase, and refund events are sent from our server with the same random identifier and an internal account ID (not your name or email address).

We do not send your name, email address, or payment details to Google Analytics. Google processes this data on our behalf as our service provider. Google Analytics data is kept for up to 14 months. We do not set advertising cookies.

How to opt out. Block or delete these cookies in your browser settings, or install the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout. PrepClubs works the same if you opt out.

7. International transfers

Our servers and subprocessors may be located outside your country of residence, including the United States and the European Union. Transfers rely on Standard Contractual Clauses where required. Google Analytics data is processed by Google LLC in the United States and other countries. Google relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for these transfers.

8. Security

We use TLS in transit, hashed passwords, scoped database credentials, and principle-of-least-privilege access controls. No system is perfectly secure, but we take reasonable and industry-standard steps.

9. Children

PrepClubs is intended for users 16 and older. We do not knowingly collect data from children under 16. If you believe a child has signed up, email us and we will delete the account.

10. Changes

We may update this policy. When we make material changes, we update the effective date at the top and, where required, notify you by email. Continued use after an update constitutes acceptance.

11. Contact

Privacy questions: [email protected].

Mailing address:
PrepClubs, attn: Privacy
Email contact preferred for fastest response.