Privacy Policy — PharmPrep

1. Who we are

PharmPrep ("we", "us", "our") is an AI-powered pharmacy technician exam preparation service. Our website is pharmprep.ai. Questions? Email us at [email protected].

2. What data we collect

Account data — email address, hashed password (we never store your plain-text password), and optional Google account ID if you sign in with Google.
Usage data — flashcard answers, practice question attempts, simulation transcripts, XP, streak counts, and competency scores. We use this to personalise your study experience.
Payment data — billing is handled by Stripe. We store only your Stripe customer ID; your card details never touch our servers.
Technical data — server logs (IP address, browser/device type, pages visited) retained for up to 30 days for security and debugging.

3. How we use your data

Operate and personalise the learning platform (spaced repetition scheduling, competency scoring, readiness tracking).
Send transactional emails — email verification, password reset. We do not send marketing email without your explicit consent.
Process subscription payments via Stripe.
Detect fraud and abuse.
Improve the service using aggregated, anonymised analytics.

4. Legal bases for processing (GDPR)

For users in the European Economic Area and UK, our processing bases are:

Contract — processing necessary to provide the service you signed up for.
Legitimate interests — security logging, fraud prevention, service improvement.
Consent — optional analytics cookies (you can withdraw consent at any time via the cookie banner).

5. Cookies

We use the following cookies:

access_token — strictly necessary, httpOnly session cookie. Expires after 7 days. Cannot be disabled.
pp_cookie_consent — stores your cookie preference. Expires after 1 year.

We do not currently use third-party advertising or tracking cookies.

6. Data sharing

We share your data only with sub-processors needed to operate the service:

Anthropic — AI responses during simulations (your messages are sent to the Claude API). Anthropic's privacy policy applies to this processing.
Stripe — payment processing.
Resend — transactional email delivery.
Railway / Fly.io — cloud hosting.

We never sell your data to third parties.

7. Data retention

We retain your account and learning data for as long as your account is active. If you delete your account, we erase your personal data within 30 days, except where we are required to retain it by law (e.g. financial records for 7 years).

8. Your rights

You have the right to:

Access — request a copy of the data we hold about you.
Rectification — correct inaccurate data.
Erasure — request deletion of your account and data.
Portability — receive your data in a machine-readable format.
Object — object to processing based on legitimate interests.
Withdraw consent — at any time, for consent-based processing.

To exercise these rights, use our data deletion request form or email [email protected]. We will respond within 30 days.

9. California residents (CCPA)

California residents have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information. To submit a request, use our data deletion form or email [email protected].

10. Security

Passwords are hashed with bcrypt. Session cookies are httpOnly and Secure. All traffic is encrypted in transit via TLS. We apply the principle of least privilege to database access.

11. Changes to this policy

We may update this policy. Material changes will be communicated by email or a notice on the dashboard. Continued use of the service after the effective date constitutes acceptance.

12. Contact

For privacy questions or to exercise your rights: [email protected]