Privacy Policy

Last updated: October 10, 2026

1. Introduction

Preporato runs preporato.com and the Preporato plugin for ChatGPT. This policy explains what personal data we collect, why we use it, who receives it, how long we keep it, and the choices you have. Questions about it go to [email protected].

2. Personal Data We Collect

  • Account data: your email address and password, which is stored only as a secure hash. If you sign in with Google, we also receive your name and profile picture from Google.
  • Learning data: practice test attempts, answers and scores, progress in courses, study guides and study plans, bookmarks, flashcard reviews, lab progress, and work you submit for graded tasks.
  • Lab code: the code you write and run in hands-on labs, and its output.
  • Purchase data: what you bought, the price, your subscription status, your billing country, and the reason you give if you cancel. Stripe handles your card details; we never receive full card numbers.
  • Content you send us: reviews you post, team requests (name, work email, company, role, team size and message), and emails to support.
  • Email choices: whether you agreed to marketing email, and when and how you made that choice.
  • Device and usage data: IP address, browser and device type, the country we work out from your IP address or time zone, the pages you visit and what you do on them, and cookie identifiers (see section 8).
  • From ChatGPT: what the plugin needs to answer you, described in section 7.

3. How We Use Your Data

  • To run your account and the service: practice tests, flashcards, courses, labs and your saved progress.
  • To take payments, manage subscriptions, show prices for your country, and send receipts.
  • To send account email, such as receipts, payment problems, password resets and invites.
  • To email you study tips, news about new certifications and courses, and offers. In the United States we send these unless you turn them off; everywhere else, only if you agree. Every such email has an unsubscribe link, you can turn them off in your profile at any time, and we keep a record of when and how you made your choice. Receipts and account emails are not affected.
  • To understand how the site is used and to improve it.
  • To measure which advertisements lead to sign-ups and purchases, if you accept advertising cookies.
  • To keep the service secure: prevent fraud and abuse, enforce limits such as the number of labs per day, and fix errors.
  • To keep the records the law requires, such as tax and accounting records.

Where the law asks for a legal basis, we rely on our contract with you, your consent (marketing email where consent is required, and cookies that need it), our legitimate interests (security, fixing errors and improving the service) and our legal obligations (tax and accounting records).

4. Who Receives Your Data

We do not sell your personal data. These are the recipients we share it with, each receiving only what its job needs:

  • Hosting and infrastructure: the company that hosts our servers; Cloudflare, which delivers the site and protects it from attacks and so handles your IP address and requests; and Supabase, which runs our database and sign-in.
  • Payments: Stripe processes payments and subscriptions and receives your email address, billing details and purchase data.
  • Email delivery: Resend sends our account and marketing emails and receives your email address and the message.
  • AI model providers: OpenRouter, the model providers it routes requests to, and NVIDIA's API process the text that features using language models send them, such as prompts from your lab code and work you submit for AI-graded tasks.
  • GPU labs: RunPod runs our GPU labs, so the code you run in a GPU lab and its output are processed on RunPod's servers.
  • Product analytics: PostHog, on its servers in the European Union, receives the pages you view and what you click, and records some visits so we can see how the pages are used. Recordings hide what you type into forms, code editors and terminals, and any email address on the page. PostHog uses your IP address only to find your country and does not store it. Where you decline analytics cookies, it counts your visit without cookies and records nothing.
  • Analytics and advertising: Google (Analytics, Ads and Google sign-in) and Meta Platforms (Facebook and Instagram). To measure which advertisements lead to a purchase, we send these partners a one-way cryptographic hash of the buyer's email address along with the IP address and browser user agent of the device used to buy. The hash cannot be reversed to recover your email, and we never send the address itself. Where you decline advertising cookies, we do not send this information.
  • OpenAI: when you use Preporato in ChatGPT, the plugin's results appear in your ChatGPT conversation (see section 7).
  • Authorities: when the law requires it, or to protect our rights, our users or the service.

These recipients handle the data under their own privacy policies. Some of them process it outside your country, including in the United States.

5. How Long We Keep Your Data

  • Account, learning data and reviews: as long as your account exists. When you ask us to delete your account, we delete them within 30 days.
  • Purchase records: as long as tax and accounting laws require us to keep them.
  • Lab sandboxes: the code and files in them are deleted when the lab ends, after at most 30 minutes, or 90 minutes for GPU labs.
  • Lab code saved in ChatGPT: 14 days after you last save it.
  • Other lab state in ChatGPT, such as your latest check result and the step you are on: 7 to 30 days.
  • Work in ChatGPT without signing in: 7 days, unless you sign in and it moves to your account.
  • Marketing email choice: as long as your account exists. After that we keep the record of your choice only as long as we need it to show we followed it.
  • Support emails and team requests: as long as we need them to answer you and follow up. Ask us and we delete them sooner.
  • Server logs: our web server's access logs (IP address, browser and the page requested) are deleted after 15 days. Application logs, which can also include your account ID, are deleted after 12 months.
  • Google Analytics: visit events after 2 months, and user-level data 14 months after your last visit.
  • PostHog: visit events after 1 year, and recordings after 1 month.

6. Your Choices and Controls

  • Marketing email: turn it off in your profile, or use the unsubscribe link in any marketing email. Receipts and account emails still arrive.
  • Cookies: choose which cookies to allow when you first visit, and change your choice at any time with Cookie Preferences at the bottom of every page. Our Cookie Policy lists the cookies we use.
  • Google Analytics: Google's opt-out browser add-on stops Google Analytics on every site.
  • ChatGPT: disconnect Preporato in ChatGPT's settings at any time.
  • Subscriptions: cancel Preporato Pro at any time in your profile.
  • Access, correction and deletion: email us from your account's address to get a copy of your data, correct it, have it deleted, send it to another service, or object to or limit how we use it. We reply within 30 days.

You can also complain to the data protection authority where you live.

7. Preporato in ChatGPT

Preporato is also available as a plugin in ChatGPT. When you use it:

  • Signing in: Connecting your Preporato account to ChatGPT goes through our sign-in service (Supabase). ChatGPT gets a token that lets the plugin use your Preporato account; it never sees your password. You can disconnect the plugin in ChatGPT's settings at any time.
  • What we receive: What the plugin needs to answer you, such as the certification or lab you ask about, your answers to practice questions, your flashcard ratings, and the code you write in lab steps. With each request ChatGPT also sends an anonymized ID for your ChatGPT account. We use that ID only to limit how many labs can be started and to keep the work of someone who tries a lab without signing in.
  • What we keep: Practice results, flashcard reviews and lab progress save to your Preporato account, as on our website. The code you write for each lab step is kept for 14 days after you last save it, so you can continue where you left off.
  • Labs: Your lab code runs in an isolated sandbox that cannot reach the internet and is deleted after at most 30 minutes. When your code calls a language model, its prompts are processed by the model provider through OpenRouter, or by NVIDIA's API.
  • Without signing in: You can try the first step of a free lab. Your work is kept for 7 days under a code derived from ChatGPT's anonymized ID, and moves to your account if you sign in.
  • Email: If you use all the labs a day allows without Pro, we may send you one email about what you did, following your email choices (sections 3 and 6).
  • OpenAI: The plugin's results, such as practice questions and lab steps, appear in your ChatGPT conversation. OpenAI's privacy policy covers how OpenAI handles your conversations.

We do not sell data from the plugin or use it for advertising.

8. Cookies and Tracking

  • Essential cookies: keep you signed in, run the site and keep payments secure.
  • Analytics cookies: Google Analytics and PostHog, to understand how visitors use the site.
  • Advertising cookies: Google Ads and the Meta pixel, used to measure advertising performance and to show relevant advertisements. These load only after you accept advertising cookies.

Change your choice at any time with Cookie Preferences at the bottom of every page. Turning off essential cookies in your browser can stop parts of the site from working.

9. Data Storage and Security

Your data is stored with Supabase and on our own servers. We protect it with encrypted connections, access controls, and isolated sandboxes for lab code. Passwords are stored only as secure hashes, and Stripe handles card details on its PCI-compliant infrastructure.

10. Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last updated" date.

12. Contact Us

If you have any questions about this privacy policy or our privacy practices, please contact us at:

Email: [email protected]