How PrepifyLabs privacy policy governing the collects, uses, shares and retains your data - and what we deliberately do not do. No ad trackers.
In short: we collect what is needed to run your account and your learning, we process payments through Stripe without ever seeing your card number, and we run no advertising trackers and no third-party analytics. We do not sell personal data. You can export everything we hold, or ask us to erase it, from your own account.
PrepifyLabs is operated by Prepifylabs LLC, 5900 Balcones Drive STE 38508, Austin, TX 78731, United States. We provide IT certification practice exams, hands-on labs and courses, and we are the controller of the personal data described in this policy.
This policy applies to our website, the learner portal and the partner portal.
If you are studying through an employer, university or training provider, that organization is the controller of your enrollment and results, and we process that data on their behalf. Their own privacy notice applies alongside this one.
Your data is stored on servers we own and operate ourselves in Austin, Texas, in the United States. It does not sit on rented capacity in a public cloud, and it is not moved between regions for convenience.
If you use the platform from outside the United States, using it means your data is transferred to and stored in the US. Where we rely on a processor listed below, that processor may handle data in its own locations under its own terms.
Your name, email address and password, which is stored only as a one-way hash - we cannot read it, and neither can anyone who obtains the database. Optionally, a profile photo, job title, department, time zone and preferred language, if you choose to add them.
The exams and labs you start, your answers, scores, time taken, attempt history, domain-level results, study streaks, and any certificates you earn. This is the record that makes progress tracking, analytics and certification possible - it is the product, not a by-product.
Purchases are processed by Stripe. Card numbers never reach our servers. We store a Stripe customer reference, the card brand and its last four digits so you can recognize a saved payment method, plus a record of what was bought, when, and for how much.
If you contact support we keep the ticket: the name and email address given at the time, the message, any attachments, and the replies. We also keep the questions typed into the help search so we can find gaps in our documentation.
To keep accounts secure we record the IP address and browser user-agent attached to each sign-in session, and a device fingerprint held in your browser. Administrative actions taken inside the platform are written to an audit log with the acting account, the IP address and the user-agent. These exist to detect account sharing and unauthorized access, and to reconstruct what happened if something goes wrong.
During a live exam we count how many times the exam window loses focus. We record a count, and nothing else: no screenshots, no camera, no microphone, no keystroke logging, and no visibility into any other tab, window or application. Repeated focus loss can end an attempt, and the rule is stated on screen before an exam begins.
We use browser storage for the platform to function, not to profile you. It holds your session token, an admin or partner sidebar preference, a device fingerprint used to detect duplicate sessions, an exam or lab session lock that stops the same attempt being opened in two tabs, and an in-progress checkout selection.
We run no advertising cookies, no cross-site tracking pixels, no tag manager and no third-party analytics. Fonts and icons are served from our own servers rather than a public CDN, so loading a page does not disclose your IP address to a font provider.
We do not sell personal data, and we do not share it for advertising. We use a small number of processors to run the service:
We also disclose data where the law requires it, or to establish or defend legal claims.
Every certificate we issue carries a unique ID, and anyone holding that ID can verify it on our public verification page. That check displays the holder's name, the certification passed, the score and the date awarded - which is the entire point, because a credential nobody can check is worth nothing.
Only the ID unlocks it: certificates are not listed, indexed or searchable by name, and your email address is never shown. If you need a certificate withdrawn from public verification, contact support.
If a seat was assigned to you by an employer or training provider, staff at that organization can see your enrollment, your attempts and your results for the classrooms you belong to. They cannot see purchases you made personally, and removing you from a classroom removes their access to your results in it - it does not delete your account or anything you bought yourself.
Account and learning records are kept while your account is open, because they are what your progress and certificates are made of. Sign-in session records are short-lived and cleared as sessions expire. Payment records are retained as long as tax and accounting law requires, which is generally several years and is not something we can shorten on request. Support conversations are retained under a configurable lifecycle policy and closed threads are cleared on that schedule.
You can, from your own account settings:
Depending on where you live you may also have the right to object to or restrict certain processing, and to complain to your local data protection authority.
We are specific about this, because "delete" is used loosely across the industry. When an erasure request is completed we anonymize the account rather than dropping rows: your name and email are replaced with a placeholder, your avatar, job title, department and two-factor secrets are cleared, every access token is revoked, and the account is closed. Support tickets you filed are scrubbed of the name, email and country captured with them, and the raw text of questions typed into the help search is removed.
What remains is a pseudonymous shell that no longer identifies you, kept because financial records must be retained by law and because deleting a learner outright would corrupt the results of classrooms and exams they took part in. It cannot be reversed, and it cannot be used to sign in.
Traffic is encrypted in transit. Passwords are hashed, never stored in a readable form. Optional two-factor authentication is available on every account. Sessions are bound to a device, and the platform enforces a single live exam or lab session per account. Administrative access is governed by granular per-section permissions, and privileged actions are written to an audit log.
The platform is intended for people aged 16 and over, and accounts are not knowingly created for children under that age. If you believe a child has registered, contact us and we will remove the account.
When this policy changes we update the effective date shown at the top of the page. Where a change materially affects how we handle your data we will say so in the platform rather than relying on you to re-read the page.
Questions about this policy, or about data we hold, can be raised through our support page and we will respond. If you are exercising a data right, use the privacy controls in your account settings so the request is logged and tracked rather than sitting in an inbox.
The most advanced examination and certification readiness platform available. Train autonomously, pass effortlessly.
Prepifylabs LLC, 5900 Balcones Drive STE 38508, Austin, TX 78731, United States