Privacy Policy

1. Data Controller

The controller responsible for data processing on this platform is:

PrepScore Learning
Bobe & Bürder GbR
Rudolf-Harbig-Weg 55 D08
48149 Münster
Germany
Email: support@prepscorelearning.com

2. Purposes of Data Processing

• user registration and authentication
• provision and operation of the test platform
• storage and evaluation of test results
• processing of audio recordings for speaking tasks
• technical operation, security, and stability of the platform
• fulfilment of legal obligations

3. Categories of Personal Data

• Account data: email address, encrypted password
• Usage data: test results, progress data, timestamps
• Technical data: IP address, browser type, operating system (processed only as technically required)
• Audio data: voice recordings submitted for speaking exercises

4. Legal Basis for Processing

• Art. 6 (1) b GDPR – performance of a contract
• Art. 6 (1) f GDPR – legitimate interests (technical security and service operation)
• Art. 6 (1) a GDPR – consent (audio recordings)

5. Hosting and Infrastructure

This platform is hosted by:

Vercel Inc.
Hosting infrastructure may process personal data in the United States and the European Union. Data processing is based on a Data Processing Agreement (Art. 28 GDPR) and the EU–US Data Privacy Framework.

6. Database and Authentication

User accounts, test results, and audio data are stored and processed using:

Supabase Inc.
Supabase acts as a data processor under Art. 28 GDPR. Data is primarily processed within the European Union.

7. Audio Recordings

Audio recordings are processed exclusively for the purpose of evaluating speaking tasks. Recordings are stored temporarily and deleted once they are no longer required for evaluation or training purposes. Processing is based on explicit user consent and can be withdrawn at any time with future effect.

8. Data Retention

Personal data is retained only for as long as necessary for the stated purposes or as required by statutory retention obligations. Users may request deletion of their account and associated data at any time.

9. Your Rights

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object (Art. 21 GDPR),
• right to withdraw consent at any time.

10. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence.

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
https://www.ldi.nrw.de

11. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or manipulation.

12. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time. The current version is always available on this page.

Last updated: February 2026