Privacy Policy
Last updated: 9 August 2026
This policy explains what personal data we collect when you use CorPrep (the “Service”, at corprep.co.uk), why we collect it, and the rights you have over it. CorPrep is operated by Synen Limited, a company registered in England and Wales (company number 16545765), whose registered office is 60 Vicarage Farm Road, Hounslow, England, TW5 0AB (“we”, “us”, “our”). Synen Limited is the data controller for the personal data described here.
If you have any questions about this policy or your data, contact us at [email protected].
1. The data we collect
Account data
When you create an account we collect your email address and a password. Your password is never stored in readable form: it is hashed by our authentication provider. You may optionally add a display name or pseudonym and a university or organisation (used only for the optional leaderboard).
Practice data
As you use the Service we store your practice activity (the tests and games you attempt, your answers, scores, and progress over time) so we can show you your results, track improvement and (if you opt in) rank you on a leaderboard.
Analytics data
We record basic, first-party analytics to understand how the Service is used and to improve it: page views and key steps (e.g. sign-up, starting or completing a practice test), tied to a random, anonymous identifier stored in your browser. This data contains no name, email or other directly identifying information, and we honour your browser’s “Do Not Track” setting: if it is on, we collect no analytics from you.
Payment data
If you take out a paid subscription, payment is handled by Stripe. Your card details go directly to Stripe and are never sent to or stored by us: we do not see your full card number at any point.
What we do store is what we need to know whether your subscription is active: a Stripe customer and subscription reference, the plan you are on, its status (for example active, past due or cancelled), the date your current period ends, and any referral code used. We also keep a record of the payment events Stripe sends us, so that a message delivered twice cannot charge or credit you twice.
Technical data
Like any website, our hosting and security provider automatically processes technical information such as your IP address, browser type and the pages you request, in order to serve the site and protect it from abuse.
Video-interview practice: important
The record-yourself interview practice uses your device’s camera and microphone locally in your browser only. Your video is never uploaded to us or stored on our servers. If you use the automatic-transcription feature in a supported browser, your browser may send the audio to its own speech-recognition service (for example, Google in Chrome) to produce a transcript: this happens between your browser and that service, not through us. You can type your answer instead to avoid this.
2. How we use your data, and our legal bases
Under UK data-protection law we must have a lawful basis for using your data. We rely on the following:
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account; save your progress; provide the practice materials | To deliver the Service you asked for | Performance of a contract |
| Send you account emails (confirmation, password reset) | To operate and secure your account | Performance of a contract |
| Keep the Service secure and prevent abuse; basic analytics to improve it | To run a safe, reliable, improving product | Legitimate interests |
| Take payment, run your subscription, and give you access to paid features | To deliver the subscription you bought | Performance of a contract |
| Keep records of payments and subscription changes | To meet our tax, accounting and consumer-law obligations | Legal obligation |
| Show you on the leaderboard | Only if you choose to take part | Consent |
| Send you marketing email about new practice material, features and offers | Only if you have asked us to, and only until you tell us to stop | Consent |
We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects about you.
3. Who we share it with
We share data only with the service providers (“processors”) that help us run CorPrep, under contracts that require them to protect it:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database & user authentication | Account and practice data (hosted in the EU) |
| Cloudflare | Website hosting, delivery & security | Technical data (e.g. IP address, requests) |
| Resend | Sending our account, support and marketing emails | Your email address |
| Stripe | Processing subscription payments | Your email address and card details, which you give to Stripe directly |
We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety or property of our users or ourselves.
4. International transfers
Your account and practice data are stored in the European Union. Some providers (such as Cloudflare and Google) may process technical data outside the UK/EEA. Where they do, that transfer is covered by appropriate safeguards recognised under UK law, such as the UK International Data Transfer Agreement / Addendum or an adequacy decision.
5. How long we keep it
We keep your account and practice data for as long as your account is active. If you delete your account, we delete your associated personal data (see “Your rights” below), except where we must retain limited information to comply with the law. Anonymous analytics data, which does not identify you, may be retained on an aggregated basis.
Records relating to payments and subscriptions are an example of that exception: UK tax and company law requires us to keep transaction records for six years, so we retain them for that period even if you close your account. They are kept for that purpose only.
6. Your rights
Under UK GDPR you have the right to: access your data; ask us to correct it; ask us to delete it; restrict or object to our use of it; request a portable copy; and withdraw consent at any time where we rely on it. To exercise any of these rights, including deleting your account and its personal data, contact us at [email protected] and we will action your request. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. We would appreciate the chance to address your concern first.
7. Cookies & local storage
CorPrep does not use advertising or third-party tracking cookies. To make the Service work we store a small amount of information in your browser’s local storage on your device. UK law treats this the same way it treats cookies, so here is exactly what we keep and why.
Necessary, and always on. Your sign-in session, your saved practice progress, and any preferences you have set yourself, such as exam conditions and accessibility options. Without these you could not stay signed in, keep your results, or have the Service behave the way you asked it to.
Optional, and you can switch it off. An anonymous identifier we use to count how the Service is used so we can improve it. It is not linked to your name or email, it is used only by us, and it is never shared with anyone else or used for advertising. You can turn it off at any time, free of charge, from Storage preferences in your account. We also honour your browser’s “Do Not Track” setting.
Signing in with Google, and paying through Stripe, each take place on those providers’ own pages, where they may set their own cookies under their own policies.
8. Security
We protect your data with measures including encrypted connections (HTTPS), hashed passwords, and database access controls that ensure each user can only access their own records. No online service can be guaranteed perfectly secure, but we work to protect your information and to address any issues promptly.
9. Children
CorPrep is intended for people preparing for graduate and professional job assessments and is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the “last updated” date above and, where appropriate, notify you. Please review it periodically.
11. Contact us
Email: [email protected]