Privacy Policy

Prepr is provided by Simon Musmos, operating as Prepr, based in the Philippines, who is the personal information controller responsible for your personal data ("we", "us"). For any privacy question or request, contact simonmusmos@gmail.com. That address also reaches the person responsible for data protection at Prepr.

This policy explains how we handle personal data when you use the Prepr website, web app, interview copilot and Prepr Job Capture browser extension. It is written to meet the Data Privacy Act of 2012 of the Philippines (Republic Act No. 10173). Where other privacy laws apply to you, such as the GDPR in the EU or the UK GDPR, we apply this policy in line with them too.

• Account details: your email address, your name if you give it, and your password, which we store only as a one-way hash (bcrypt). We also keep a session record while you're signed in.
• Resumes and profile: the file you upload (we keep the original file so you can download it), the text we extract from it, and the profile you edit (name, contact details, summary, skills, experience, education, certifications). A resume can contain personal details such as your age or education. Only include what you're comfortable sharing.
• Roles you add: job titles, company names, job posting links and job descriptions.
• What Prepr generates for you: match analyses (including strengths and gaps), your answers to follow-up questions, and tailored resumes. Each version you generate is kept.
• Live copilot, processed but not stored: the audio you choose to share (call audio, your microphone, or room audio, which can include your voice and the interviewer's), the resulting transcript and suggested answers. See section 4.
• Usage and billing records: when copilot sessions start and end and how many minutes were used, your plan, minute balances, and the order and subscription references from our payment provider. We don't receive your card details.
• Technical data: our hosting provider processes standard request information, such as your IP address, browser type and request times, to deliver and secure the Service, and may keep error logs.
• Usage analytics: we use Vercel Web Analytics to count page views. It records the page visited (only the path, with any query or link fragment removed before sending), the referring site, browser, operating system, device type and approximate country. It doesn't use cookies. According to Vercel, visitors are told apart only by a temporary hash of request details that is discarded within 24 hours, and IP addresses aren't stored. We see aggregate numbers, not individual people.

We don't use advertising or cross-site tracking tools, and we don't collect your precise location.

• To provide the Service you asked for: to parse resumes, analyse matches, tailor resumes, generate flashcards and prepared answers, transcribe and answer interview questions, and run your account. The legal basis is performing our contract with you.
• To meter usage and handle billing: to count copilot minutes, apply plan limits and record purchases. The legal basis is performing our contract with you, and keeping records the law requires.
• To keep Prepr secure and working: to prevent abuse and investigate errors. The legal basis is our legitimate interest in a safe, reliable service.
• To understand and improve Prepr: aggregate, cookieless page-view analytics. The legal basis is our legitimate interest in knowing which pages are used.
• To support you: to answer the messages you send us.
• Information that may be sensitive in your resume is processed only to provide the features you use, with your consent, which you can withdraw by deleting the content or your account.

We don't sell or rent personal data, we don't use it for advertising, and we don't use your content to train AI models.

• Audio isn't stored by us. In live mode, audio goes directly from your browser to our transcription provider (OpenAI). In standard mode, short audio clips pass through our server to OpenAI in memory and aren't saved. If you share your screen to capture call audio, the browser also offers video, but Prepr doesn't record or send it.
• Transcripts stay in your browser. The transcript and suggested answers exist only in your open Prepr tab and are gone when you close it. To produce a suggestion, the recent part of the transcript and the question are sent to OpenAI along with your resume profile and the role. They aren't saved on our servers.
• Other people's voices. Call or room audio can include the interviewer and others. You are responsible for getting any consent the law requires before you share that audio. See our Terms.
• Prepared answers for a role are saved in your browser's local storage on your device, so the copilot can use them quickly. They stay until you clear your browser data.

We share personal data only with service providers who help us run Prepr, and only as needed:

• OpenAI (United States): AI processing. It receives resume text and profile, job details, your answers to follow-up questions, interview audio, transcript excerpts and questions, to return extracted profiles, analyses, tailored resumes, flashcards, transcripts and suggestions. Under OpenAI's API data policies, API data isn't used to train its models by default, and it may keep data for a limited period (currently up to 30 days) to monitor for abuse, after which it is deleted unless the law requires otherwise.
• Vercel: hosts the website and app, processes requests and logs, and provides our cookieless page-view analytics.
• Prisma Data (Prisma Postgres): hosts our database, where your account, resumes, roles and generated content are stored.
• Paddle: sells our plans as Merchant of Record. It collects and processes your payment and billing details as an independent controller under its own privacy policy. We share your email address and an internal account reference with it so your purchase reaches your account, and it tells us about orders, subscriptions and refunds.

Job posting import. When you paste a job link, our server fetches that public page or the job board's public API, so the site sees a request from Prepr, not from you.

We may also disclose personal data if the law requires it, to protect rights, safety or the Service, or as part of a sale or restructuring of Prepr, in which case this policy would continue to apply to your data.

Our providers are based in, or process data in, countries outside the Philippines, including the United States. Those countries may have different data protection laws. We use providers that commit to protecting personal data through their terms and data processing agreements, and we transfer only what's needed for the purposes in this policy.

• Account, resumes, roles and generated content: while your account exists. When you ask us to delete your account, we delete it and everything linked to it within 30 days.
• Interview audio and transcripts: not kept by us (see section 4). OpenAI's limited retention is described in section 5.
• Billing records: purchase and usage records may be kept for as long as tax, accounting or legal obligations require, even after account deletion. Paddle keeps its own records as Merchant of Record.
• Data in your browser (theme choice, prepared answers): until you clear it.
• Server logs are kept by our hosting provider for a limited period.

Under the Data Privacy Act of 2012, and similar laws where you live, you have the right to:

• be informed about how your personal data is processed (this policy);
• access your personal data and get a copy of it, including in a structured, commonly used format (data portability);
• correct inaccurate or incomplete data (you can also edit most of it in Prepr);
• object to processing, or withdraw consent where we rely on it;
• have your data deleted or blocked;
• claim damages for harm caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal data;
• file a complaint with the National Privacy Commission (privacy.gov.ph), or with the data protection authority where you live.

To use any of these rights, email simonmusmos@gmail.com from your account's email address. We may need to confirm your identity. We'll respond within 30 days, free of charge, unless a request is clearly unfounded or excessive.

We use reasonable organisational, physical and technical measures to protect your data, including encrypted connections (HTTPS and TLS to our database), password hashing, secure sign-in cookies, access checks that keep each account's data separate, and signed, time-limited tokens for copilot sessions.

No system is completely secure. If a personal data breach is likely to put you at risk, we'll notify you and the National Privacy Commission as the law requires, including within 72 hours of becoming aware of it where required.

• prepr_session (cookie): keeps you signed in for up to 30 days, or until you sign out. It's strictly necessary, so it doesn't need consent.
• prepr-theme (local storage): remembers whether you chose light or dark mode.
• prepr-copilot-prep:… (local storage): prepared answers for a role, used by the copilot on your device.

Our analytics (Vercel Web Analytics) works without cookies. We don't use advertising or tracking cookies. Paddle's checkout may set its own cookies, under its own policy.

If you use our browser extension, it reads the job posting on the page you're viewing only when you click "Capture this job". It takes the title, company, description, any text you've selected and the page address, and opens Prepr with those details so you can review them before saving. It doesn't run in the background, doesn't read other tabs and doesn't send data anywhere except to Prepr in the tab it opens. It remembers only the Prepr address it should open.

Prepr is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe someone under 18 has given us personal data, contact simonmusmos@gmail.com and we'll delete it.

We may update this policy as Prepr changes. If a change is material, we'll tell you in the Service or by email before it takes effect. The date at the top shows when it last changed.

Privacy questions and requests: simonmusmos@gmail.com. Prepr is provided by Simon Musmos, operating as Prepr, Philippines.