Privacy Policy

This policy explains how MMIPrep (“we”) handles your personal data when you use MMIPrep. We are the data controller. For any privacy question, contact mmiprepofficial@gmail.com.

1. Data we collect

• Account data — your email address and authentication data (managed by our auth provider).
• Practice data — the answers you type or speak, the resulting transcriptions, AI scores and feedback, your session history, and any target universities or interview dates you add.
• Voice audio — if you use voice mode, audio is recorded in your browser and sent to our server and to our transcription provider to produce text. We do not retain the audio after transcription; the resulting text is stored as part of your practice data.
• Payment data — processed by Stripe. We receive confirmation of payment and a Stripe identifier, but not your full card number.
• Technical & usage data — IP address, device/browser information, and aggregate analytics about how the Service is used.

2. How and why we use it

• To provide the Service (create your account, run practice sessions, generate feedback, track your quota) — legal basis: performance of our contract with you.
• To take payment and prevent fraud — contract and legitimate interests.
• To secure and improve the Service (debugging, abuse prevention, analytics) — legitimate interests.
• Voice transcription — consent, which you give by choosing voice mode and allowing microphone access. You can use type mode instead.
• To contact you about your account or material changes to these policies — contract and legitimate interests.

3. Service providers (processors)

We share data with the following providers only as needed to run the Service:

• Supabase — database and authentication hosting.
• Vercel — application hosting and aggregate analytics.
• OpenAI — speech-to-text transcription of voice answers.
• Anthropic — generation of feedback and scoring from your answers.
• Stripe — payment processing.

We do not sell your personal data. Our AI providers process the content we send them to return a result; check each provider’s own policy for how they handle data submitted via their API.

4. International transfers

Some providers process data outside the UK/EEA, including in the United States. Where that happens we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or the providers’ approved transfer mechanisms.

5. Retention

We keep your account and practice data for as long as your account is active. If you ask us to delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep limited records (for example, transaction records for tax and accounting).

6. Your rights

Under UK data protection law you have the right to:

• access a copy of your data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• data portability;
• withdraw consent (for example, stop using voice mode);
• complain to the Information Commissioner’s Office (ico.org.uk).

To exercise any of these, email mmiprepofficial@gmail.com.

7. Children

The Service is intended for users aged 16 and over. If you are under 18 we strongly recommend a parent or guardian reviews these policies with you. We do not knowingly collect data from children under 13.

8. Security

Data is encrypted in transit. Database access is protected by row-level security so that your practice data is only accessible to your account. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

9. Cookies and local storage

We use essential browser storage to keep you signed in and remember preferences such as light/dark mode. We use privacy-friendly, aggregate analytics to understand usage. We do not use advertising cookies.

10. Changes

We may update this policy. We will change the “Last updated” date and, for material changes, notify you by email.

11. Contact

MMIPrep
mmiprepofficial@gmail.com