Privacy Policy

01Who is responsible for your data

MILETUS INNOVATION SRL, a Romanian company trading as AceItPrep, is the controller for personal data processed to operate the website at aipreptest.com and its browser study space. This Policy covers the website; it does not replace the notices applicable to our iOS apps or third-party services.

For questions about this Policy or to exercise a privacy right, use our contact form.

02Information the website processes

We do not receive your Google password or access to Gmail, contacts, or Google Drive through this sign-in. Google/Firebase manages authentication credentials and session tokens. Stripe collects payment details on its checkout; we do not store full card numbers or card security codes in our website database.

Do not submit patient records, health information about identifiable people, or other sensitive information. Answering an educational medical question does not require you to disclose your personal medical history.

03Why we use information

• Provide your account and study tools: authenticate you, attach purchases to the correct account, save and synchronize completed progress, and apply your settings. Our legal basis is performance of the service contract or steps taken at your request before it.
• Personalize practice: use study attempts and flashcard reviews to suggest due cards, missed questions, and useful next actions as part of the study service.
• Protect and maintain the website: detect abuse, investigate errors, and secure access. We rely on legitimate interests in a reliable, secure service, balanced against your rights.
• Manage transactions and obligations: verify entitlement and handle billing issues for the service contract; retain records required by applicable accounting, tax, and other laws on the basis of legal obligations.
• Respond to requests: provide support or address privacy and legal claims, using the applicable contract, legal obligation, or legitimate-interest basis.

Optional processing that requires consent would require a separate choice. Reading this Policy or accepting the Terms is not consent to advertising. If required account information is not supplied, we may be unable to provide sign-in, purchase verification, or account synchronization; optional study preferences can be left unset.

04Study recommendations and readiness estimates

Next Best Action and AceReady use recorded study performance, topic coverage, review history, and timing to produce recommendations and estimated readiness. This is automated personalization of study activity. It does not decide school admission, certification, employment, credit, or any matter with a legal or similarly significant effect.

You can choose a different practice mode and topics instead of following a recommendation. A readiness estimate is a study indicator and may not reflect performance on the actual exam.

05Device storage, cookies, and synchronization

The study space uses browser storage, including localStorage and IndexedDB, to retain preferences, progress, downloaded question banks, and unfinished sessions. When signed in, Firebase uses persistent browser storage for your session. Temporary sessionStorage may keep a billing snapshot while you navigate. When you request an email sign-in link, your email address may be retained temporarily in browser storage to recognize the request on the same device; it is cleared after sign-in completes.

Submitted progress and preferences synchronize to the website account when connected. Unfinished question sessions and bank caches remain on the device where they were created. They are not evidence that another device has downloaded the same materials. Local copies can remain after sign-out until you clear that browser’s storage.

Our hosting, Firebase authentication, email-delivery, and Stripe/Link checkout providers may use cookies or similar technologies necessary for their services, security, and fraud prevention. Those providers explain their own use in their notices. Blocking storage can prevent persistent sign-in, offline study, or saved preferences.

We currently have no advertising pixels or optional analytics SDKs in the website code. We do not use your study history to target third-party advertisements. If optional tracking is introduced, this notice and any required consent controls must be updated first.

The website loads typography from Google Fonts. A font request sends Google technical request information, including an IP address and browser metadata, even if you do not sign in. Google’s Fonts privacy explanation (opens in a new tab) describes this delivery.

06Providers and other recipients

• Google / Firebase: account authentication and session persistence. Google Privacy Policy (opens in a new tab) and Firebase privacy information (opens in a new tab) explain their services.
• Resend: delivers sign-in emails and contact-form messages and processes recipient addresses, email content, and delivery events. Authentication links are sensitive; never share them. We disable open and click tracking for sign-in emails. See Resend Privacy Policy (opens in a new tab).
• Stripe / Link: checkout, subscription billing, transaction support, fraud prevention, and merchant-of-record obligations through Managed Payments. We send your account identifier, email/name where available, selected exam, plan, and purchase reference to connect a transaction to your access. Stripe independently determines purposes for its payment and merchant services. See Stripe Privacy Policy (opens in a new tab).
• Cloudflare and our Sites hosting platform: website delivery, Turnstile bot protection, request security, database storage for submitted progress and billing references, and storage of question-bank assets. See Cloudflare Privacy Policy (opens in a new tab) and the hosting platform’s privacy information (opens in a new tab) for their own processing.

Service providers receive information needed for their role; a provider may act as a processor for some activities and an independent controller for its own legal, security, or transaction purposes. Information may also be disclosed where lawfully required to authorities or to professional advisers dealing with a specific legal or accounting obligation.

We do not sell or rent your study history or account information. Question-bank caching is a service feature, not disclosure of your individual study history to other customers.

07International processing

Our providers operate internationally, so information may be processed outside Romania or the European Economic Area, including in the United States. Their location and service terms determine the relevant processing and transfer arrangements; we do not represent that all website data stays in the EU.

Where GDPR transfer restrictions apply, appropriate safeguards or an applicable adequacy decision are required. Provider data-protection terms describe their transfer mechanisms, which may include standard contractual clauses. Details of the safeguards relevant to your information can be requested from the operator at our contact form.

08Retention and security

Account-linked progress and preferences are kept while needed to provide your account and access, unless you reset them or request applicable deletion. Purchase and subscription references may need to remain for ongoing entitlement, accounting, tax, refunds, disputes, or legal claims. The relevant legal obligation or claim period determines retention of those records; a study-progress reset does not erase them.

Contact-form submissions include your name, reply email, selected topic, optional exam and reference, and message. They are forwarded to our support inbox through Resend. Hashed identifiers are used to limit abuse; the website database does not store the message body. Support correspondence is kept for handling the request and any related dispute or legal duty. Technical logs follow the applicable hosting/security provider’s retention arrangements. This Policy does not promise a fixed deletion deadline for provider logs or records legally required to be retained.

Earlier diagnostic registrations and optional email preferences, if supplied, are retained only as needed to honor your choices and handle access or deletion requests. The current free tests do not request or collect email addresses. Short-lived email sign-in requests, delivery references, and hashed rate-limit identifiers support authentication and abuse prevention. Expired authentication records are periodically removed. Local browser data remains until removed by you, the browser, or the application’s storage controls. In Settings you can export progress or reset study history; when signed in, the reset synchronizes to your website account. Clearing browser data removes local copies but does not erase the server account or cancel billing.

The website uses HTTPS, verifies sign-in tokens on protected requests, and restricts progress and purchase access to the relevant identity. These measures reduce risk; no system can guarantee absolute security. Keep your devices and email accounts secure, especially on shared computers.

09Your privacy rights

Under applicable data-protection law, you may request access, correction, deletion, restriction, and portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. Rights may have lawful exceptions, including records we must retain.

Requests should identify your account and the right you wish to exercise. We may reasonably verify identity. Under GDPR, we normally respond within one month; a permitted extension of up to two additional months requires an explanation within the initial month. A study-progress export is a useful self-service tool but does not limit your right to a fuller response.

You can complain to ANSPDCP, Romania’s data-protection authority (opens in a new tab), or another competent supervisory authority, including in the EEA country where you live or work. You need not give up that right to contact us first.

Send privacy and account-deletion requests to our contact form. Resetting study history does not delete a Firebase account, and signing out does not cancel a subscription.

10Children, policy updates, and contact

This website is intended for exam candidates and is not directed to children under 13. Minors above that age need appropriate parent or guardian authorization under applicable law; this statement does not assert that age verification is automated. If a child’s personal data was supplied without required authorization, a parent or guardian can request review and appropriate deletion through our contact form.

We may update this Policy to reflect changes in the service, providers, or law. Material changes will be communicated appropriately before new processing begins, and consent will be obtained where legally required. The date at the top identifies this version.