Privacy Policy

1. Controller

The data controller for promptreps.com is Anastasia Bir, Spain. Privacy questions and requests: support@promptreps.com.

2. What we collect and why

• Account data — your email and sign-in identifiers, to create and secure your account (legal basis: contract).
• Learning data — course progress, quiz results, practice submissions, and AI mentor conversations, to run the courses and save your place (contract).
• Purchase data — which course you bought, the amount, and a Stripe payment reference, to grant access and handle refunds (contract, legal obligations). Card details go directly to Stripe; we never see or store them.
• Technical logs — standard server logs (IP, time, route) kept by our hosting provider for security and debugging (legitimate interest).
• Error diagnostics — when something breaks we capture the error, your IP, device and browser, and a session replay (a recording of the affected session) to find and fix the bug (legitimate interest). The replay masks all text and form inputs by default, so your typing is not recorded.
• Usage analytics — we measure how the site is used (page views and funnel steps such as sign-ups and purchases) with our own first-party, privacy-preserving analytics: no cookies, nothing stored on your device, no third-party trackers, and no cross-site tracking. Anonymous visitors are counted with a daily-rotating identifier derived on our server and never linked across days. Lawful basis: legitimate interest in running and improving our service; you can object at any time (see §5).

We do not run advertising trackers and we do not sell personal data.

3. Processors

We use a small set of service providers to operate the Service:

• Supabase — authentication and database (accounts, progress, purchases).
• Vercel — hosting and serving the site.
• Stripe — payment processing.
• Anthropic — AI grading and mentor chat. Your exercise submissions and mentor messages are sent to the Claude API to generate feedback; we do not use them to train models.
• Sentry — error tracking and session replay (hosted in the EU), to detect and diagnose bugs. It receives the error diagnostics described above.
• Resend — sends our transactional emails (such as sign-in links). It processes your email address to deliver them.

Some providers process data outside the EU; transfers rely on EU Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework).

4. Retention

Account and learning data are kept while your account exists. Purchase records are kept as long as required for tax and accounting law. If you delete your account, we remove or anonymise personal data within 30 days except where law requires longer retention.

5. Your rights (GDPR)

You can ask for access, a copy (portability), correction, deletion, restriction, or object to processing — email support@promptreps.com and we will respond within one month. You also have the right to lodge a complaint with your local supervisory authority (in Spain: the AEPD, Agencia Española de Protección de Datos).

6. Cookies

We only use strictly necessary cookies (your sign-in session). Details in the Cookie policy.

7. Changes

We will announce material changes to this policy on the site or by email before they take effect.