Privacy Policy

The data controller is NextPrep Academy. This notice covers https://nexprep.academy, accounts, checkout, protected courses, quizzes, certificates, newsletters, support, and chat.

For privacy requests, contact support@nextprep.academy.

• Account and authentication data, including email, provider identifiers, verification state, secure session records, preferences, and activity dates.
• Order and access data, including course, plan, price, currency, Stripe references, payment or refund status, receipts, entitlements, and purchase events. We do not store full card details.
• Learning and support data, including progress, quiz results, AI-credit use, certificate details, notes, chat messages, replies, locale, and support correspondence. Do not submit sensitive data in chat.
• Technical and security data, including request metadata, rate-limit identifiers, browser or device information, timestamps, and diagnostic logs.
• Optional measurement data, including page views, interactions, approximate location, session replay, and conversions, collected separately through Google Analytics, Microsoft Clarity, or Reddit Pixel only for the services you consent to.

• Contract: create accounts, authenticate users, take payment, grant access, provide courses, AI credits, certificates, support, and service messages.
• Legal obligation: keep and disclose records required by accounting, tax, consumer, payment, or lawful-authority rules.
• Legitimate interests: secure the platform, prevent fraud and abuse, diagnose faults, protect claims, and maintain essential reliability.
• Consent: send optional marketing and activate each optional analytics, behavior, or advertising provider selected in Cookie preferences. Consent can be withdrawn at any time.

We do not sell personal data. Where processing occurs outside the EEA, we use an adequacy decision, applicable privacy framework, Standard Contractual Clauses, or another lawful safeguard where required.

• Firebase and Google Cloud for authentication, data, protected files, and email workflows; Google or GitHub when selected for sign-in.
• Stripe for checkout, payments, fraud prevention, refunds, and receipts; hosting, email, automation, and AI providers needed to run the service.
• Google Analytics, Microsoft Clarity, and Reddit Pixel only when separately authorized; Trustpilot where review invitations are configured; advisers or authorities where legally required.

• Authentication sessions expire after 30 days or earlier on logout or revocation.
• Account, access, progress, certificate, and signed-in chat data is kept while the account is active or until a valid deletion request, subject to legal claims and mandatory retention.
• Purchase, refund, tax, and accounting evidence is kept for the applicable statutory period.
• Security and public-chat records are kept only as long as needed for abuse prevention, troubleshooting, and provider settings. Newsletter data remains until withdrawal, with a minimal suppression record afterwards.
• Optional provider data follows the durations described in the Cookie Policy and the configured provider controls.

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent and object to direct marketing at any time. You may complain to your local supervisory authority; in Italy this is the Garante per la protezione dei dati personali.

Optional providers stay disabled until selected in Cookie preferences and can be withdrawn there. We use server-side access checks, hashed sessions, signed URLs, rate limits, and provider security controls. We do not use solely automated decisions producing legal or similarly significant effects.

To exercise your rights, contact support@nextprep.academy.

The service is not directed to children under 16, subject to any lower lawful age of independent consent. We may update this notice when the service, providers, or law changes; material changes will be highlighted or communicated where required.