Privacy Policy

This Privacy Policy explains what data PrepLab collects when you use the service, why we collect it, who we share it with, and what you can ask us to do with it.

PrepLab is operated from Ukraine by the two teachers who write the lessons. Each of us is registered separately as an individual entrepreneur (ФОП), and for the purposes of this policy we act as joint controllers: we decide together what data is collected, why, and how long it is kept.

Being joint controllers means you can exercise any of the rights described below against either of us, and it makes no difference which one you write to — the request reaches both. Whichever of us receives it is responsible for answering it.

Contact for anything to do with your data: [email protected]. Both of us read that inbox and we usually reply within a few business days. Our full registration details — registered names and entrepreneur registration numbers — are available on request to the same address.

We have not appointed a Data Protection Officer and are not required to at our size.

We collect only what the service needs to work:

We use your data to give you access to what you paid for, to keep your account secure, to send transactional email such as verification and password-reset links, and to answer your support messages.

We do not sell your data, and we do not use it for third-party advertising. We use no third-party analytics — no Google Analytics, no PostHog, no Plausible, no Mixpanel, no Segment. We embed no advertising trackers and no marketing pixels.

All payments are processed by WayForPay, a Ukrainian payment processor. Your card details go directly to WayForPay during checkout — PrepLab never sees or stores your card number, CVV, expiry date, or billing address. We keep only the order references, the transaction outcomes, and the recurring-payment token WayForPay returns for a Monthly subscription, so we can match a payment to your lesson or subscription.

Your card data is subject to WayForPay's own privacy practices. WayForPay is our sole payment processor — we do not use Stripe, PayPal, or any other.

PrepLab uses one essential cookie, named session, to keep you signed in. It is set when you sign in, and it is marked HttpOnly — so browser JavaScript cannot read it — SameSite=Lax, and Secure whenever the site is served over HTTPS in production. We do not use advertising or cross-site tracking cookies.

One third party sets a cookie: the contact form is protected by Google reCAPTCHA, which sets cookies from Google when that page loads, in order to tell people from automated abuse. It runs on the contact page only. Google’s handling of that data is covered by their own privacy policy.

We keep your account and purchase records for as long as your account exists, because they are what proves your access to the lessons you bought. Server logs are retained for a limited period for security and debugging. Auth tokens are short-lived: email-verification and password-reset tokens expire on a timer and stop working after a single use.

Commerce records — purchases, subscriptions and billing events — outlive the account. When an account is closed we anonymise it rather than delete the row, because those records point at it, and we keep them for accounting, tax and dispute-resolution purposes for the periods applicable law requires, which for digital-goods commerce typically spans several years.

You can ask us for any of the following at any time by writing to [email protected]. We usually reply within a few business days and act on the request within 30 days.

Account and purchase records: to perform the contract you entered into when you bought a lesson or took a subscription. Without them we cannot prove what you have access to.

Transactional email such as verification links, password resets and receipts: also contract performance.

The record of when you accepted the Terms of Service and this Privacy Policy: our legitimate interest in being able to show that you agreed to them before the account was created.

Support messages and the reCAPTCHA check on the contact form: our legitimate interest in answering you and in keeping the form free of automated abuse.

Server logs: our legitimate interest in keeping the service secure and working.

Write to us first at [email protected] — it reaches both joint controllers. If we cannot resolve it, you have the right to complain to a data protection authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU or the UK, the supervisory authority for the country you live in.

Passwords are stored hashed with Argon2, never in plain text, so we never see or store the password itself. Signing in uses an HttpOnly session cookie, which browser JavaScript cannot read. Content files are served through short-lived signed S3 URLs rather than public links, so a lesson file cannot be shared by copying its address — only a signed-in user with valid access is issued a fresh URL. All traffic to PrepLab is secured by HTTPS at the ingress. If you believe your account has been compromised, contact us and we can disable it on request.

PrepLab is intended for tutors and other adult educators, and is not directed to children under 13, or the applicable local age of digital consent where that is higher. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

PrepLab relies on a small number of third-party services, each of which has its own privacy policy:

We do not embed any third-party analytics, advertising, or marketing SDKs in the PrepLab frontend.

We may update this policy from time to time. The version published on this page is always the one in force. For material changes we will make reasonable efforts to notify you by email or an in-product notice before they take effect. Continued use of the service after a change constitutes acceptance of the revised policy.

Questions about your data or this policy? Reach us at [email protected].