Privacy Policy

We collect the minimum we need to run the Service: your email address, the answers you submit for AI marking, and feedback ratings you leave on solutions. We share data with three processors — Safepay (billing), Google (the AI provider), and Cloudflare (hosting) — and nobody else. We do not sell your data. You can delete your account and have your data erased at any time.

The data controller is the operator of prepare.xtremepape.rs. For questions about this policy, or to exercise any of your rights described below, contact hi@prepare.xtremepape.rs.

Account data: your email address, account-creation timestamp, and (if you choose to provide it) a display name.

Usage data: the answers you submit for AI marking; the questions you view; ratings and notes you leave on worked solutions; timestamps and basic event logs.

Billing data: if you buy a plan, Safepay collects payment details on our behalf. We receive only the information needed to recognise the purchase (e.g. plan, order ID, billing country) — never your card number.

Technical data: IP address, browser user-agent, and approximate region. Used for security, fraud prevention, and basic aggregate analytics.

What we don’t collect: we do not run third-party advertising trackers, social-media pixels, or behavioural-ad networks. We do not collect biometric data, precise geolocation, or any “special category” personal data.

We process your personal data only to:

• Deliver the Service — authenticate you, store your progress, send your answers to the AI marker, return the graded result;
• Bill you — via Safepay, our payment processor;
• Improve the Service — review aggregate, often anonymised, statistics on which solutions are flagged as wrong so we can re-generate them with a better model;
• Detect abuse — rate-limit scrapers, flag account sharing, prevent fraud;
• Communicate with you — send transactional emails (sign-in links, billing receipts), and occasional product updates you can opt out of.

If you are in the UK or the European Economic Area, we rely on:

• Contract — to deliver the Service you signed up for;
• Legitimate interests — to secure the Service, prevent abuse, and improve product quality;
• Consent — for any optional marketing emails (you can withdraw consent at any time).

We share personal data only with the following service providers (“processors”), each bound by a data processing agreement:

• Safepay (Wave Solutions) (Pakistan) — payment processing for card payments, RAAST, JazzCash, and EasyPaisa. Safepay is licensed by the State Bank of Pakistan. See Safepay’s Privacy Policy.
• Google LLC / Google Ireland Ltd — we send questions and your submitted answers to Google’s Gemini API for AI marking and worked-solution generation. Google processes these requests as an API customer under the terms of its Data Processing Addendum and Gemini API terms. Paid-tier Gemini API requests are not used by Google to train its models.
• Cloudflare, Inc. — hosting, edge networking, database (D1), object storage (R2), email delivery. See Cloudflare’s Privacy Policy.

We do not sell, rent, or otherwise commercialise your personal data. We may disclose data if compelled by lawful court order or valid legal process — and only the minimum strictly required.

Cloudflare D1 and R2 store data on Cloudflare’s global edge network, which may include facilities in the United States, the European Union, the United Kingdom, and the Asia-Pacific region. For users in the UK and EEA, transfers are protected by the UK’s International Data Transfer Addendum / Standard Contractual Clauses as adopted by our processors.

Account data: as long as your account is active, and for up to 90 days after you delete it (to handle billing disputes and abuse).

Submitted answers and feedback: as long as the associated account exists. You can delete individual submissions at any time.

Billing records: retained by Safepay and by us for the period required by Pakistani tax and accounting law (typically 6 years).

Server logs and security events: 30 days, then deleted or fully anonymised.

Regardless of where you live, you can ask us to:

• Access a copy of the personal data we hold about you;
• Correct data that’s wrong;
• Delete your account and have associated personal data erased (we’ll keep only what we’re legally required to retain);
• Export your data in a portable, machine-readable format;
• Object to processing based on legitimate interests, or withdraw consent for marketing.

Email hi@prepare.xtremepape.rs from the address on your account. We respond within 30 days.

If you are in the UK or EEA and believe we have mishandled your data, you also have the right to complain to your local data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk).

We use a small number of strictly necessary cookies — primarily your session token, which keeps you logged in. We do not use third-party advertising cookies. We may use first-party, privacy-respecting analytics (no personal identifiers, no cross-site tracking).

The Service is intended for examination candidates aged 13 and older. If you are under the age of digital consent in your jurisdiction (typically 13–16), you may only use the Service with the involvement of a parent or guardian. If we learn that we have collected data from a child below the applicable age without verifiable parental consent, we will delete it promptly.

We use industry-standard safeguards — TLS in transit, encrypted storage at rest, hashed credentials, scoped access keys, and principle-of-least-privilege access for the team. No system is perfectly secure; if we ever discover a breach affecting your personal data, we will notify you and applicable authorities within the timelines required by law.

If we make material changes, we will email registered users and update the “Last updated” date at the top of this page. Continued use of the Service after the change constitutes acceptance.

Email hi@prepare.xtremepape.rs for anything privacy-related.