Privacy Policy

Overview

CertPrepX is an independent certification exam-preparation web app covering CISA, CISM, CISSP, PMP, ISO 27001, and AAIA. This policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have. It applies to your use of the CertPrepX web app and the account you create to study with it.

What we collect and why

• Account details — created when you sign in with Google via Firebase Authentication. We collect the account information needed to identify you and keep you signed in (a session token is stored on your device). This is used to give you a secure, personal account.
• Study activity and progress — your practice answers, scores, streaks, and study history. This is used to power adaptive study, track your progress, and show your stats.
• Payment status — whether your account is free or has an active subscription. Payments themselves are processed by Stripe, Inc.; we do not store card details on our servers.
• Abuse-prevention signals — to keep the service secure, Google reCAPTCHA / Firebase App Check processes your IP address and basic interaction signals to verify that requests come from a genuine browser.

Your account and study data are stored in Google Firestore.

Analytics (optional)

We use Google Analytics and PostHog product analytics only if you choose Accept on the cookie banner. They are off by default, use IP anonymization, are not used for advertising, and we do not sell data. See our Cookies & Local Storage page to accept, decline, or change your mind.

How we use your information

We use the data above to operate your account, deliver and personalize study features, process subscriptions, keep the service secure, respond to support requests, and — only with your consent — measure and improve the product.

Who we share it with

We rely on a small set of service providers to run CertPrepX. We do not sell personal data. See the full list of Subprocessors for what each one processes.

Retention

We keep your data while your account is active and remove it after deletion as described in our Data Retention policy.

Your rights

• Access and correction — view and update your account information in Account Settings.
• Deletion — delete your account from Account Settings or by emailing support@certprepx.com.
• Export / portability — request a copy of your data.
• Withdraw analytics consent — decline or clear your choice at any time via the cookie banner.

Children

CertPrepX is intended for users aged 18 and over. It is not directed at children, and we do not knowingly collect data from them.

International processing

Our providers (Google and Stripe) operate global infrastructure, so your data may be processed in facilities outside your country.

Changes and contact

If we make material changes to this policy, we will update this page. Questions? Email support@certprepx.com — we respond within 2–3 business days.