Privacy Policy

This Privacy Policy explains how preppito collects, uses, shares, and protects personal data when you visit our website and when you use our interview practice platform. preppito provides a practice environment only. We do not run hiring processes and we do not make selection decisions for employers.

1. Scope

This policy covers the preppito website and the interview practice platform, including accounts, sessions, transcripts, generated questions, and related features such as feedback and reports.

2. What data we process

We process only what we need to deliver the service, to keep it secure, and to meet our legal duties.

We do not intentionally collect data about you from third parties, other than retrieving the job posting you point us to.

3. Purposes and legal bases

We process personal data only where a legal basis in Article 6 GDPR applies and, where relevant, Article 9 for special categories.

4. Providers we use and where processing takes place

We use two main providers to deliver the experience.

We do not permit our providers to use your prompts or outputs to train their models for other customers. We do not grant such permission for preppito user content.

5. International transfers

Our design is to process and store personal data for the core service in the European Union. We do not routinely transfer this personal data outside the European Economic Area.

If a transfer outside the EEA is necessary, for example for support or incident response, we will use the safeguards that the law requires. These include the European Commission Standard Contractual Clauses and, where applicable, adequacy decisions. We keep a record of any such transfers.

6. Retention

We keep personal data only for as long as needed for the stated purposes.

• CV file and job description are used to generate questions and are wiped from our systems right after processing
• Generated questions and transcripts are stored for up to 30 days by default so that you can review your session
• You can delete your transcript and generated questions at any time from your account, which removes the content from our active systems
• Consent logs that evidence your explicit consent are retained for up to 60 days after deletion of the related session for compliance
• Security logs are retained for up to 90 days unless a longer period is needed to investigate incidents
• Support tickets are retained for up to 12 months unless a longer period is required by law
• Backups follow fixed rotation schedules and are overwritten. When you delete content we remove it from active systems and it will fall out of backups on the normal cycle

If law requires a longer retention we may retain the minimum necessary information for that period.

7. Your rights

Subject to conditions and exceptions in the GDPR, you have the following rights:

• Right of access and to obtain a copy of your data
• Right to rectification
• Right to deletion
• Right to restriction
• Right to object where we rely on legitimate interests
• Right to data portability
• Right to withdraw consent at any time, which does not affect processing that took place before withdrawal

You can exercise these rights from within your account where features are available or by contacting info@preppito.com. We may need to verify your identity. We will respond without undue delay and within one month where possible.

You also have the right to lodge a complaint with your local supervisory authority. In the Netherlands the authority is Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.

8. Children

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe that a child provided us with personal data please contact us and we will delete it.

9. Security

We use technical and organisational measures intended to protect personal data. These include encryption in transit and at rest, role based access control, least privilege, logging and audit trails, vulnerability management, and staff training. If we become aware of a personal data breach we will notify affected users and regulators where legally required.

10. Automated decision making and fairness

We do not make automated decisions that produce legal or similarly significant effects for you. Our feedback is advisory for practice purposes only. We monitor for bias and quality issues as part of our model governance.

11. Transparency about AI

You practice with an AI system that generates questions and feedback. We clearly label AI generated content in the product. If you have questions about how the system works, contact info@preppito.com.

12. Who we share data with

We share personal data only with:

• Our processors who act on our instructions to deliver the service
• Professional advisers and auditors under a duty of confidentiality
• Authorities where required by law

We do not sell personal data.

13. How we make decisions about data

We follow the principles of data minimisation, purpose limitation, and storage limitation. We review this policy and our records of processing at least once a year.

14. Changes to this policy

We may update this policy from time to time. Significant changes will be announced on the website or by email. You can see the date of the latest update at the top of this page. If changes materially affect how we process your data we will ask for consent again where required.

Annex A consent text used in the product