PrepFinity ("the Service", "we", "us") is operated by Yash Verma as an individual. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over your data. By using the Service you consent to the practices described here.
1. Information we collect
- Account data — your name, email, password (stored as a bcrypt hash, never in plaintext), and the experience level and preferred technologies you optionally provide on signup.
- Interview data — the questions our AI asks you, your typed or spoken answers, transcripts of voice sessions, and the AI's scores and feedback. Voice audio is processed in real time by OpenAI under their API terms and is not stored by us.
- Resume data — if you choose to upload a resume, we store the file along with the parsed structured summary (name, projects, skills, employment). You can delete this at any time by emailing us.
- Payment data — when you purchase credits, we record the Razorpay order and payment identifiers, the amount paid, and the pack purchased. We do not see or store your card number, CVV, or banking credentials; those are handled entirely by Razorpay.
- Usage data — basic web analytics (page views, anonymized device info) collected via Vercel Analytics and, optionally, PostHog. We do not sell this data.
- Technical data — IP address, browser user-agent, and timestamps in our server logs for security and abuse detection. Retained for 30 days unless required longer for an open investigation.
2. How we use your data
- To deliver the interview practice service — generating questions, scoring answers, computing your weak-topic analytics.
- To process payments via Razorpay and credit your account.
- To enforce fair use (rate limiting, abuse detection, account lockout after repeated failed logins).
- To respond to support requests you initiate.
- To send transactional emails about your account or purchases (we do not send marketing emails without separate opt-in).
3. How we share your data
We share the minimum necessary data with the following processors, each governed by their own privacy and security commitments:
- OpenAI — your interview prompts and answers are sent to OpenAI's API for the AI interviewer to function. Per their API terms, content is not used to train their public models.
- Razorpay — your name and email are passed to Razorpay's checkout to process credit-pack payments. Card details flow directly to Razorpay and never touch our servers.
- Railway — our hosting provider for the backend API and Postgres database (servers located in the US).
- Vercel — our hosting provider for the frontend, also handling page-view analytics.
We never sell your personal data and we do not share it with advertisers.
4. Data security
Passwords are hashed with bcrypt at work factor 12. Authentication uses signed JWT cookies (HttpOnly, Secure, SameSite enforced). All traffic between you, our backend, and our processors is encrypted in transit (TLS 1.2+). Database connections use SSL. We log security events (failed logins, signature mismatches, suspicious refresh-token reuse) and lock accounts after 5 failed login attempts.
5. Your rights
Under the Indian Digital Personal Data Protection Act, 2023, you have the right to:
- Access the personal data we hold about you.
- Correct any inaccurate data.
- Request deletion of your account and associated data, except where retention is required by law (e.g. tax records of completed transactions).
- Withdraw consent, after which we will stop processing your data (account deletion will follow).
To exercise any of these rights, email yverma32@gmail.com. We aim to respond within 7 working days.
6. Data retention
- Active accounts — retained as long as your account is active.
- Deleted accounts — personal data deleted within 30 days of your request, except records required for tax/accounting (Payment rows are retained for 8 years per Indian tax law, with PII stripped).
- Logs — 30 days, unless retained longer for a specific investigation.
7. Children
The Service is not directed to users under 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we'll remove it.
8. Changes to this policy
If we change this policy materially, we'll notify active account holders by email. The "Effective" date above reflects the current version.
9. Contact
Questions, requests, or complaints: yverma32@gmail.com.