Privacy Policy

1) Scope and entity

This Policy covers the Prepico web application, a product of DataShastri. Governing law and venue: India, state of Uttar Pradesh.

2) Data we collect now

• Account and profile: name, email, optional phone, sign-in identifiers and the provider you signed in with (email and password, Google or LinkedIn).
• Your documents: the resume content you upload or type (work history, education, skills, projects), cover letters, and the job postings and descriptions you paste to check fit or tailor a copy.
• Your search: the companies and applications you track and connections you note (roles, not names, unless you type them).
• Interview practice: selected topics, question settings, generated questions, submitted answers, voice transcripts, feedback, reports and progress history. Optional interviewer professional context is processed once to steer a question set and is not saved in Prepico records.
• LinkedIn: only the post URLs you paste and the words you write yourself. Third-party post text is used once to draft a reply and is not stored.
• Payments: via Razorpay. We receive payment status and metadata, not full card details.
• Technical logs: IP address, browser, timestamps and request logs, kept for security and troubleshooting.
• Cookies and browser storage: essential sign-in, security and preferences; optional PostHog product analytics and separately optional Google Ads signup measurement. Each starts only after you enable its checkbox and save your preferences. See the Cookie Policy.

3) Optional product analytics and replay

If you enable Product analytics, we send PostHog page paths without query strings or fragments, timestamps, browser and device information, and named feature events with counts, choices and plan or payment amounts. A random browser ID links visits; after sign-in, an internal account ID and admin flag associate events with your account. Names, email, phone, resume text, job descriptions, application or career-profile IDs, document links and payment credentials are excluded from these events.

Browser error reports contain redacted error messages and diagnostic stack information. Session replay is restricted to public pages, with text and input values masked and embedded documents and media blocked. Account, authentication, checkout, administrator and workspace pages are excluded from replay. Console logs and network request or response bodies are not recorded. PostHog does not receive ad click identifiers. We do not enable automatic form or click-text collection, or IP-based location enrichment in PostHog. PostHog necessarily receives the connection IP when handling a request.

This processing helps us understand feature adoption and diagnose failures. It is optional and separate from accepting the Terms or Privacy Policy. Essential only keeps it off, and Cookie settings lets you withdraw permission at any time without losing access. The choice applies to this browser, not automatically to other devices.

PostHog is a separate processor using the EU region. Data already received follows the project retention settings and the provider's retention and backup processes; withdrawing permission stops new collection rather than deleting historical records. Contact sujatakumari@prepico.ai for access or deletion requests concerning analytics linked to your account.

4) Optional ad measurement

If you enable Ad measurement and save your preferences, Google Ads helps us measure which ads lead to completed account creation. Its tag can use Google ad click identifiers, first-party advertising cookies, connection IP and browser information. The signup event contains a random event identifier used to avoid duplicates. We do not include your name, email, phone, account ID, resume content, private document links or payment details in this event.

The app disables enhanced conversions and advertising personalization, and does not send form data or enable Google Analytics storage through this integration. Page locations sent by this integration are restricted to a public path and supported advertising click identifiers; account recovery links and other query parameters are excluded.

Ad measurement is optional and separate from Product analytics and account policy acceptance. Cookie settings lets you withdraw it at any time. Declining prevents this integration from loading the Google tag; withdrawal stops new signup events and clears the advertising storage managed by this integration. Previously received data remains subject to Google and account retention settings. Browser blockers or declined consent can mean a signup is not measured.

5) Data we may collect in the future

Additional document types for new features. We will update this Policy before materially changing the data we collect.

6) What we do not intentionally collect

No special-category data (health, biometric, precise GPS) unless you include it in what you upload. No face or voice biometrics.

7) How we use data

• Sign-in, account management, fraud prevention and security.
• Delivering the service: building and improving your documents, checking job fit, tailoring copies, tracking applications, preparing you for interviews.
• AI processing: relevant document content and instructions are sent to OpenAI or Anthropic when you request an assisted action. Generated suggestions are saved for your review and may be reused to avoid duplicate calls. We do not train models on your documents. Provider retention and use depend on their API terms and the account settings in force.
• Voice: when you choose voice input, we send the recording to OpenAI for transcription. When you choose Listen, we send the question text to OpenAI to produce speech. Prepico processes raw audio temporarily in memory without retaining audio files; transcripts and submitted answers are saved with your practice. We do not identify you by your voice or create voiceprints.
• Interviewer context: only paste professional information you are entitled to share. We send it to the selected AI provider for that generation, then discard it from Prepico processing; it is excluded from our database, logs and analytics. The provider's API retention terms and account settings still apply.
• Payments and billing.
• Support communications.
• We do not sell your personal data.
• Aggregated, anonymised usage patterns may be used to improve the product.
• Data minimisation: personal data is processed only where necessary to deliver what you asked for.

8) Legal bases (where applicable)

• Contract: processing necessary to provide the service you signed up for.
• Consent: the Terms and this Policy accepted at signup; cookies and marketing where required.
• Legitimate interests: security, troubleshooting and product improvement using aggregated data.
• Legal obligation: payment and tax records, regulatory compliance.

9) Sharing and sub-processors

• Hosting: AWS EC2 and RDS for the backend and database, private AWS S3 for original uploads in Mumbai, and Vercel for the web application. Generated downloads are streamed rather than retained as files.
• AI processing: OpenAI, Anthropic.
• Payments: Razorpay (INR).
• Sign-in: Google, LinkedIn.
• Email: SMTP via the prepico.ai domain.
• Optional analytics: PostHog Cloud, using its EU ingestion region, for product usage, browser error diagnostics and masked public-page session replay. PostHog processes this data on our behalf after your browser opts in.
• Optional ad measurement: Google Ads receives advertising click identifiers, cookie identifiers and signup events after your browser separately opts in. Google processes connection IP and browser information when its tag loads. See https://business.safety.google/privacy/ for how Google uses information from sites using its services.

10) International transfers

OpenAI, Anthropic and other service providers may process data outside India. Contact us for information about the providers and safeguards applicable to your data.

11) Retention

• Account and service data: kept while your account is active. Account deletion removes the user, documents and service records, and keeps an anonymised deletion record.
• After account deletion, we retain a one-way fingerprint of the normalized email address solely to prevent repeat free-credit grants. This pseudonymous record has no account ID or credit balance and is retained for as long as we enforce this restriction. The new account starts with zero credits even if the deleted account had an unused balance.
• Suspended accounts retain data until deletion is completed. There is no automatic 30 to 180 day deletion schedule; contact us to request deletion.
• Payment records required for transaction history or legal obligations may be retained.
• Operational logs: retained in AWS CloudWatch for 14 days. Historical uploaded-file versions in S3 may remain for up to 30 days under the storage lifecycle. Account deletion does not automatically remove records held independently by your payment, AI or analytics provider; contact us for provider-specific requests.

12) Security

We use HttpOnly session cookies, cross-site request protection, rate limits and access controls. Stored provider API keys are encrypted. HTTPS is required for production sign-in; local development uses HTTP on this machine. No system provides an absolute guarantee of security.

13) Your rights

Access, correct, delete (self-serve from Account), download (your documents export as PDF and Word), withdraw consent where applicable, and opt out of marketing. We do not sell personal data. Requests: email sujatakumari@prepico.ai; we may verify by email and request additional proof.

14) Children

Prepico is for adults aged 18 and over. We do not knowingly offer accounts to or collect personal data from anyone under 18. Contact us if you believe a minor has an account so we can close it and arrange deletion.

15) Cookies and tracking

We use essential session and security cookies plus short-lived cookies during Google or LinkedIn sign-in. Product analytics and Ad measurement are separate optional choices in Cookie settings. Essential only keeps both off without limiting your account or purchases. Existing permission for PostHog does not enable Google Ads. See the Cookie Policy for storage and retention.

16) Changes

We will notify material changes by email or in-app notice with an effective date.

17) Contact

Email: sujatakumari@prepico.ai.

Concerns and complaints: write to sujatakumari@prepico.ai with the subject "Concern". We acknowledge within 2 to 5 business days and aim to resolve within 5 to 10 business days.

Prepico is operated by DataShastri, India (GSTIN 09EJYPK1192J1ZE).