Privacy Policy
Effective Date: 10th September, 2026
EnglishPrep is operated by Inceptech Pvt Ltd (“we,” “us,” or “our”), a company registered in India. This Privacy Policy explains what we collect when you use www.englishprep.ai (“Website”), why we collect it, who we share it with, and the rights you have over it.
It is written to meet our obligations under India’s Digital Personal Data Protection Act, 2023 and, for users in the European Economic Area and the United Kingdom, the GDPR and UK GDPR. Inceptech Pvt Ltd is the data fiduciary and data controller for the information described here.
Information We Collect
We collect only what the service needs in order to work.
- Account information: your email address, first and last name, and a securely hashed version of your password. If you sign in with Google we receive your email address and name from Google instead. You may optionally add your country, time zone, the universities you are applying to, and your target and previous TOEFL scores. We do not ask for or store a phone number.
- Your practice work: the written responses you submit, the audio recordings you make for speaking tasks, the transcripts produced from those recordings, and the scores, feedback, strengths, improvements, and estimated level generated for each attempt.
- Technical information: your IP address, used only to protect the service against abuse and automated misuse. We keep it briefly for that purpose, and never use it to identify you or build a profile of you.
- Support and feedback: if you send us feedback through the app or by email, we keep your message and your email address so we can reply.
We do not use Google Analytics, Hotjar, Microsoft Clarity, or any other third-party analytics or session-recording service, and we do not run advertising or tracking pixels.
How We Use Your Information, and On What Basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, and delivering the practice, grading, and feedback you ask for | Performance of our contract with you |
| Sending transactional email — address verification and password resets | Performance of our contract with you |
| Protecting the service against abuse, fraud, and automated misuse | Our legitimate interest in a working service |
| Understanding aggregate usage so we can improve the product | Our legitimate interest, using non-identifying data |
| Responding to your support messages | Performance of our contract with you |
We do not sell your personal data, we do not share it with advertisers, and we do not use it for marketing.
AI Grading and Your Recordings
Grading is performed by third-party AI providers, not by us. When you submit a writing task, the text of your response is sent to our active AI provider for scoring. When you submit a speaking task, your audio recording is sent to that provider to be transcribed and scored. Depending on our configuration that provider is either OpenAI or Google; both are listed below.
We do not use your responses or recordings to train any model of our own. We send them to our AI provider for the sole purpose of producing your score and feedback, and we do not use them for any other purpose. What the provider may do with content submitted through its API is governed by that provider’s own terms; see the table below for who they are.
AI scores and estimated levels are practice estimates only. They are not official TOEFL scores, they do not come from ETS, and they are not decisions that produce legal or similarly significant effects for you.
Who We Share Your Information With
We share your information only with the service providers we need in order to operate. Each is bound to protect it and to use it only for the service they provide to us.
| Provider | What it does for us | Location |
|---|---|---|
| OpenAI | Grading written responses and transcribing speaking recordings, when configured as the active provider. | United States |
| Google (Gemini) | Grading written responses and transcribing speaking recordings, when configured as the active provider. | United States |
| Google (Sign-In) | Verifying your identity if you choose to sign in with Google. We receive your email address, name, and verified-email status. | United States |
| Amazon Web Services | Application hosting, and storage of your speaking recordings and our question media. | Asia Pacific (Mumbai) |
| MongoDB Atlas | The database holding your account, attempts, scores, and feedback. | Asia Pacific (Mumbai) |
| Cloudflare | Content delivery, DNS, and protection against abuse and denial-of-service. | Global edge network |
| Our email provider | Delivering transactional email only — address verification and password resets. | United States |
We may also disclose information where we are required to by law, such as to comply with a court order or lawful request, or to protect the safety, rights, or property of Inceptech Pvt Ltd, our users, or the public. If Inceptech Pvt Ltd is acquired by or merged with another company, your information may transfer as part of that transaction; we will tell you before it does.
International Transfers
Some of the providers above process data outside India and outside the European Economic Area, principally in the United States. Where we transfer personal data out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one applies.
How Long We Keep It
| Data | Retention |
|---|---|
| Account details and practice history (attempts, scores, feedback, recordings) | Until you delete your account |
| Page-view analytics | 365 days |
| Abuse-prevention records, including IP address | 15 minutes, then deleted automatically |
| Refresh tokens | 7 days, then deleted automatically |
| Email-verification and password-reset tokens | Until used or expired, then deleted automatically |
| Support and feedback messages | 24 months |
Your Rights
You can exercise any of these by emailing [email protected]. We will respond within 30 days, and may ask you to confirm your identity first.
- Access: ask for a copy of the personal data we hold about you.
- Correction: most account details can be corrected yourself from your settings page; ask us for anything else.
- Deletion: delete your account yourself from your settings page. This immediately erases your account and everything associated with it, including your practice history, scores and recordings. It cannot be undone. You can also ask us by email, and we will action it within 30 days. Deleted recordings are purged from our storage within 7 days; copies of deleted data may persist in encrypted backups until those expire on their normal schedule, and we re-apply your deletion to anything we ever restore.
- Portability: ask for your data in a machine-readable format.
- Objection and restriction: object to processing we carry out on the basis of legitimate interests, or ask us to restrict it.
- Withdraw consent: where we rely on your consent, withdraw it at any time.
- Grievance redressal: users in India may raise a grievance with us under the Digital Personal Data Protection Act, 2023, and may escalate to the Data Protection Board of India. Users in the EEA or UK may complain to their local supervisory authority.
Cookies and Local Storage
We use only what the service needs to function. We do not use advertising, profiling, or cross-site tracking cookies.
| What | Why | Type |
|---|---|---|
| Session cookie | Keeps you signed in between pages | Strictly necessary |
| CSRF token cookie | Protects your sign-in against cross-site request forgery | Strictly necessary |
Because these are strictly necessary to deliver a service you have asked for, they do not require consent. You can clear or block them in your browser, but you will not be able to stay signed in.
Security
Passwords are stored only as PBKDF2-SHA256 hashes and are never recoverable in plain text. Traffic to the Website is encrypted in transit. Your speaking recordings are private: they are never publicly listable, and are served only through short-lived signed links issued after we have checked that the recording is yours. Access to production data is limited to those who need it.
No system is perfectly secure. Please keep your password confidential and use one you have not reused elsewhere.
Children
The Website is intended for users aged 18 and over. Users aged 13 to 17 may use it only with the verifiable consent of a parent or guardian, and we do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.
Updates to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page and the Effective Date above will be updated. Where a change is material we will tell you directly.
Contact Us
For any question about this policy, to exercise any of your rights, or to raise a grievance, contact Inceptech Pvt Ltd at [email protected].