Privacy Policy

Welcome to Prepify ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our IELTS and CEFR exam practice platform at prepify.uz (the "Service").

By accessing or using our Service, you agree to the terms of this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

1. Information We Collect

1.1 Information You Provide to Us

We collect information that you voluntarily provide when you:

• Create an account (full name, email address, password)
• Complete practice tests and exercises, including text you type for Reading and Listening answers and the essays and audio recordings you submit for Writing and Speaking tasks
• Verify your email address during registration (we send a one-time verification code, or "OTP", to the email address you provide)
• Send us a payment confirmation, such as a screenshot of your payment receipt and your order number, via Telegram (see Section 1.4)
• Register through an instructor's or partner's invite link, in which case we record that your account was created via that referral
• Participate in our referral program (we generate a referral link for you and record the accounts that register or subscribe through it)
• Purchase a subscription (see Section 1.4 regarding payment information)
• Contact us for support or feedback
• Participate in surveys or promotional activities

1.2 Information Collected via Google OAuth 2.0

When you choose to sign in using Google OAuth 2.0, we collect:

• Basic Profile Information: Your name, email address, and profile picture from your Google account
• Google User ID: A unique identifier for your Google account

We only request the minimum permissions necessary to authenticate your account. We do not access your Google emails, contacts, or any other data beyond your basic profile information. Your use of Google Sign-In is also governed by Google's Privacy Policy.

1.3 Automatically Collected Information

When you use our Service, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, time spent on pages, features used, test performance data
• Cookies and Similar Technologies: We use cookies and local storage to maintain your session and preferences

1.4 Voice Recordings and Microphone Access

Speaking tasks require access to your device's microphone. Your browser will ask for your permission before any recording begins, and you may refuse or revoke that permission at any time through your browser settings — in which case Speaking tasks will not be available to you. We record audio only while a Speaking task is actively running, and only for the duration of each individual answer.

Your recordings are stored temporarily in your own browser (using IndexedDB) until you submit the attempt, and are removed from your browser once our servers confirm they have been received. Submitted recordings are then processed as described in Section 4. We do not activate your microphone outside of an active Speaking task, and we do not use your recordings for voice identification or biometric purposes.

1.5 Payment Information

Payments are currently handled manually. When you create an order, we generate an order number and record the order details (the products selected, the period, and the amount due). You then pay using the method indicated to you and send confirmation of your payment — typically a screenshot of your payment receipt together with your order number — to our administrator via Telegram, who reviews and approves the order.

This means that any information visible in the confirmation you send us (for example, a partial card or account number, a transaction reference, or a sender name shown on your receipt) is received and stored by us as part of your order record. Please do not send us your full card number, CVV/CVC code, PIN, one-time banking passwords, or full bank statements — we do not need them and never ask for them. We are not responsible for information you choose to disclose to us beyond what is necessary to confirm your payment, and we ask that you redact anything sensitive before sending.

Your communication with us over Telegram is also subject to Telegram's own terms and privacy policy, which we do not control. If and when we introduce automated payment providers (such as Payme, Click, or Uzum), your payment details will be handled directly by that provider in accordance with their privacy policy, and we will update this Policy accordingly.

1.6 Data Stored Locally on Your Device

To let you continue a test after a reload and to remember your preferences, we store certain data in your browser's local storage and IndexedDB — including your in-progress answers, highlights, remaining test time, font size, theme, sound preference, and your signed-in account details. This data lives on your device, not on our servers, until you submit an attempt. Clearing your browser data will remove it, which may mean losing an unsubmitted attempt in progress.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Provide access to IELTS and CEFR practice materials and tests
• Evaluate and score your submitted answers, including using automated and AI-based grading for Writing and Speaking tasks to generate feedback and scores (see Section 4 regarding AI evaluation)
• Track your progress and performance
• Display your name and score on public leaderboards (see Section 3.1)
• Process your subscription purchases and manage your access to paid features
• Operate our referral program, including attributing referrals and applying any related discounts
• Personalize your learning experience
• Send you important updates about the Service
• Respond to your inquiries and provide customer support
• Improve and optimize our Service
• Detect and prevent fraud, abuse, or security issues
• Comply with legal obligations

3. How We Share Your Information

3.1 Public Leaderboards

Our Service includes leaderboards that rank students by their practice test scores. If your score qualifies, your full name and score may be displayed publicly on these leaderboards to other signed-in users. We do not display your email address, location, country, or other personal details on the leaderboard. By using the Service and completing tests, you understand that your name and score may appear in this ranking. If you do not wish your name to appear, please contact us at the email address below.

3.2 Referrals and Instructors

If you register through an instructor's or partner's invite link, or you refer other students through your own referral link, we share limited information to make these programs work. An instructor or referrer may see that an account registered or purchased a subscription through their link, including the registered student's name and registration/subscription status. We do not share your password, email content, or test answers with instructors or referrers through these programs.

3.3 Other Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: We may share information with trusted third-party service providers who assist us in operating our Service (e.g., hosting providers, email delivery providers used to send verification codes, analytics services, and AI evaluation providers used to grade Writing and Speaking submissions)
• Analytics: We use Google Tag Manager and related Google analytics services, which receive usage and device data (such as pages visited, IP address, and browser information) as described in Section 9
• Payment Confirmation: Because payment is currently handled manually, order and payment-confirmation information is exchanged with you over Telegram and is subject to Telegram's own privacy practices
• Legal Requirements: We may disclose your information if required by law, court order, or governmental authority
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so

4. AI Evaluation of Writing and Speaking

To provide feedback and scoring for Writing and Speaking tasks, we use automated and artificial intelligence (AI) evaluation. When you submit a Writing essay or a Speaking recording:

• Your submission is sent to and processed by trusted third-party AI service providers acting on our behalf to generate your score and feedback
• The submission is used to generate a score, feedback, and corrections, and to operate and improve the evaluation features of the Service
• We do not use your submissions to publicly identify you, and we do not sell them to third parties

These third-party AI providers are permitted to process your submission only to deliver the evaluation service to us, subject to their own terms and privacy policies. Processing may take place on servers located outside Uzbekistan (see Section 11).

Important: AI-generated scores and feedback are produced automatically, are provided for practice purposes only, and may be inaccurate, inconsistent, or different from the judgment of an official examiner. They are not an official assessment of your English level and carry no official standing. Because scoring is automated, you may ask us to review a score you believe is wrong by contacting us at the email address below, and a human will look at it.

Do not include personal, confidential, or sensitive information about yourself or anyone else in the essays and recordings you submit — they are transmitted to third-party AI providers for processing, and you are responsible for the content you choose to submit.

5. Google OAuth 2.0 Authentication

When you use Google Sign-In:

• We receive only your basic profile information (name, email, profile picture)
• We use this information solely for account creation and authentication
• We do not store your Google password
• You can revoke our access to your Google account at any time through your Google Account settings
• Our use of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using SSL/TLS
• Secure password hashing
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Secure server infrastructure

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot and do not guarantee absolute security, and we cannot be held responsible for unauthorized access resulting from causes beyond our reasonable control.

You are responsible for keeping your account credentials confidential and for all activity that occurs under your account. We are not responsible for loss or disclosure of your information that results from your sharing of your password or account, your use of an insecure or compromised device or network, or your posting of personal information into test submissions or public areas of the Service. If we become aware of a data breach affecting your personal data, we will notify you and the competent authorities where required by applicable law.

7. Data Retention

We retain your personal information for as long as necessary to provide you with our Service and fulfill the purposes outlined in this Privacy Policy. When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, regulatory, or security purposes.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Data Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to certain processing of your personal information
• Withdraw Consent: Withdraw your consent for data processing at any time

To exercise any of these rights, please contact us at the email address provided below.

9. Cookies, Analytics and Tracking Technologies

We use cookies, local storage, and similar technologies to:

• Keep you logged in to your account
• Remember your preferences and settings
• Preserve your progress during a test
• Understand how you use our Service
• Improve our Service performance and user experience

We use Google Tag Manager and associated Google analytics tools to understand how our Service is used. These tools may set cookies and collect your IP address, device and browser information, and details of the pages you view. This data is processed by Google in accordance with Google's Privacy Policy, and we do not control Google's own use of it.

You can control cookies through your browser settings, and you may use browser-level or extension-based controls to block analytics scripts. Disabling cookies may limit your ability to use certain features of our Service, including staying signed in.

10. Legal Basis and Your Consent (Uzbekistan)

We process personal data in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547) and other applicable legislation. We rely on the following grounds for processing:

• Your consent: which you give by creating an account and using the Service, and which you may withdraw at any time by contacting us or deleting your account
• Performance of our agreement with you: to provide the Service, grant access to the materials you purchase, and evaluate your submissions
• Our legitimate interests: to secure the Service, prevent fraud and abuse, and improve our product
• Legal obligations: where retention or disclosure is required by law

Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw your consent, we may no longer be able to provide the Service to you.

11. Children's Privacy

Our Service is not directed to children under the age of 13, and we do not knowingly collect personal information from them. Users between the ages of 13 and 18 (or the age of majority in their jurisdiction) may use the Service only with the consent and under the supervision of a parent or legal guardian, who accepts this Policy and our Terms of Service on their behalf.

We do not verify the age of our users. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at the email address below, and we will delete that information and the associated account from our systems without undue delay.

12. International Data Transfers

Your information — including the essays and audio recordings you submit for AI evaluation, and usage data collected through analytics — may be transferred to and processed in countries other than Uzbekistan, where our hosting, analytics, and AI evaluation providers operate. These countries may have different data protection standards than your own. By using our Service and submitting content for evaluation, you expressly consent to such cross-border transfer and processing. We take reasonable measures to ensure your information receives an appropriate level of protection, including working only with providers that commit to adequate security and confidentiality obligations.

13. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

16. Your Consent

By using our Service, you consent to the collection, use, and sharing of your information as described in this Privacy Policy.