Privacy Policy

Who is responsible

This policy covers Prepinn at prepinn.com, including guest demos, student accounts, practice attempts and reports. Prepinn is owned and operated by Muhammad Ahmad, based in Pakistan, who is responsible for the information handled by the service as described in this policy.

For a privacy question, account-data request or complaint, email support@prepinn.com. Do not send passwords or email-verification links.

Information you provide and information we create

We use the information needed to provide the features you choose. The current registration form asks for your name, email address and password. The password is processed for authentication and stored as a salted hash, not as a readable password.

Marks entered into the merit calculator are processed in the current browser page. They are not sent to our server, saved in your account or retained by the calculator after the page is closed or reloaded. Saving a pack review downloads a copy of that report to your device.

Information generated through your use of the service includes:

• Your account identifier, role, email-verification status and relevant account-security records.
• Individual paper assignments, expiry or revocation status, and administrator reasons and audit records used to manage access.
• Paper and attempt identifiers, the paper version used for an attempt, selected answers, review flags, question position and saved revisions.
• Attempt start times, deadlines, submission times, whether time expired, scores and information used to calculate your reports.
• Access grants and expiry dates, and administrative recovery or access actions with their recorded reasons and times.
• Bundle orders, accepted purchase-term versions and times, quoted prices, included papers, payment methods, uploaded receipt images, submitted or verified transaction references, paying account holder names, verification decisions and access activation or expiry records.
• Messages or feedback you choose to send. In-app issue reports are linked to your account and can include the saved test, attempt and question you reported. Prepinn administrators use this information to investigate and track the issue.

Why we use information

We use account details to create and authenticate your account, verify your email, maintain one active sign-in, control access and communicate about account or support issues.

We use practice information to save and resume attempts, enforce deadlines and attempt rules, score papers, show explanations and reports, and assess requests for technical recovery.

We use order and payment information to match payments actually received, prevent duplicate use of a transaction, activate the correct papers, send purchase confirmations and handle payment or access issues. We do not collect wallet PINs, OTPs, banking passwords or card credentials.

We process technical and security information to deliver pages, limit abuse, investigate errors and protect accounts and the service. Providing a name, email and authentication details is necessary for an account; feedback is optional. Without the information needed for a feature, we may be unable to provide that feature.

Creating an account does not subscribe you to marketing emails. Account verification and messages needed to handle your account or request are service communications.

Guest demo and linking it to an account

You can take the ten-question demo without registering. We store its answers, flags, question position, timing, paper version and a protected identifier so it can be resumed in the same browser.

A completed demo is attached to a newly created account during registration, or claimed by the account you are signed into when you open the report. New accounts must verify their email and sign in before viewing results. Once attached, the demo becomes part of that account’s history and is kept separately from full-paper progress.

An unclaimed demo expires after seven days and can no longer be resumed or claimed. Expired, unclaimed records are removed in batches when later demos start, so expiry is not a promise that every stored copy is deleted at that exact moment.

Functional cookies and browser storage

The application uses cookies to support sign-in and the guest demo. These cookies identify a session or demo; they are not advertising cookies. Their identifiers are protected in the application database using token hashes.

The net_session cookie can remain in your browser for up to seven days from sign-in. Signing out invalidates that session, and signing in again replaces the earlier account session even if the old browser still holds its cookie.

The prepinn_demo cookie lasts up to seven days and helps recover an unclaimed demo in the same browser. It is cleared when a completed demo is claimed by a signed-in account. Deleting or blocking it can make an unclaimed demo inaccessible.

You can control cookies through your browser. Blocking functional cookies can prevent sign-in or demo recovery. This application does not provide an offline copy of unsaved answers; keep the page open and check the save status if your connection fails.

Technical information and visitor measurement

Delivering a page or API request involves information such as an IP address, request time, requested address and browser or device information supplied with the request. Our application uses request information for security controls such as sign-in rate limits. Hosting and email infrastructure also process operational logs.

We may review hosting traffic and error statistics to understand site use, monitor reliability and investigate problems.

If optional visitor analytics, advertising tags or other tracking are introduced, we will identify their purposes and providers in this policy and provide any choices required by applicable law before using them. The functional cookies described above do not provide permission for unrelated tracking.

Who can access information

Your saved attempts and results are associated with your account. Publishing a practice paper does not publish students’ attempts. Other ordinary student accounts are not given access to your private attempt history.

Authorised administrators can view account details, student progress and individual attempts, including saved or completed answers where needed to operate the service. They can manage access and technical recovery. Administrative access and recovery actions have audit records.

We do not sell or rent account details, answers or test results. We may disclose information when reasonably necessary to comply with a valid legal requirement or protect users and the service, limiting the disclosure to what is needed for that purpose.

Hosting, email and external feedback

Hostinger provides the current website hosting, MariaDB database hosting and outgoing email service. These services process the information needed to host your account and practice records and deliver verification and bundle-confirmation emails. Your own email provider also handles messages sent to your address.

When administrator order alerts are enabled, limited order details (student name, bundle, amount, payment method, order identifier and event time) are sent to Prepinn’s configured administrator inbox and processed by its email provider to support manual verification. Receipt images, transaction references, student email addresses and account credentials are not included in these alerts. Receipt images remain inside the authenticated order dashboard.

For JazzCash, Easypaisa or bank transfer, your wallet or bank processes the payment through its own service. Prepinn stores your uploaded payment receipt and paying account holder name. An administrator checks the receiving account and records the verified transaction reference. Receipt images are available only to the order owner and Prepinn administrators; crop out balances and unrelated transactions before uploading. This version does not use an automatic payment-gateway integration.

The optional launch feedback survey uses Google Forms. Opening the form takes you to Google, and information you submit there is processed by Google and made available to Prepinn for reviewing feedback. The application does not append your account name, email or test answers to the survey link.

Do not include passwords, verification links, identity documents or other people’s personal information in feedback. Feedback and any identifiers you voluntarily include are used to evaluate test quality, fix problems and plan future offers. We seek separate permission before publishing identifiable feedback as a testimonial.

These providers may process information outside your country. Their policies explain their own services and processing locations. A provider’s policy does not replace our responsibility for information we control.

• Hostinger Privacy Policy
• Google Privacy Policy

How long information is kept

Account details, attached demo reports, full-paper attempts and results are retained while the account remains open so that your history and progress remain available. Access expiry, signing out or finishing a test does not automatically delete them. You can request account closure or deletion.

Session access expires after seven days or earlier when invalidated. Expired session records may remain until application cleanup. An email-verification link is valid for 24 hours; its stored token is removed when used or replaced by a new link. Expiry alone does not automatically delete an unverified account or every token record.

The latest receipt image is stored with its order. Replacing a rejected receipt replaces that image; submission metadata remains in the audit history. Receipt images and other order and payment-verification records are retained to provide purchased access, resolve payment disputes, prevent duplicate use of a transaction and meet applicable record-keeping obligations. Closure does not automatically erase a payment record still needed for those purposes; we explain the reason and retention criteria when handling the request.

Support messages, feedback and security or administrative audit records are kept for the purpose they serve, taking account of whether an issue is resolved, whether identifying details are still necessary, and any applicable legal obligation or unresolved dispute. We review the need for retained records when handling a closure or deletion request.

Deletion from an active system may not immediately remove restricted backup copies or provider logs. Their retention depends on the relevant backup cycle and provider settings. If some information needs to be retained, we will explain the reason and applicable period or criteria when handling your request.

Your requests and choices

Email support@prepinn.com to request access to your personal information, correction of inaccurate details, account closure or deletion. You can also raise an objection to a use of your information or ask about restricting it; we will explain which options and legal rights apply to your request.

Use your registered email where possible and describe the information or account concerned. We may need proportionate proof of account ownership or authority before disclosing or changing records. We do not need your password or verification link to handle a request.

Requests are handled manually; the website does not currently offer an account-deletion button. We will explain the action taken, any necessary exception and any further steps, and respond within applicable legal time limits. Deletion may remove access to saved reports. We may need to retain limited information for a valid legal obligation, security investigation or unresolved dispute rather than erase every record immediately.

Feedback is optional. If you request removal of a survey response, provide enough information to locate it. We may be unable to identify a response that was submitted without an account reference or other identifying information. You can make a complaint through the same address, and this process does not limit any right to contact a competent authority.

Students and parent or guardian involvement

Prepinn is designed for students preparing for admission tests. If you cannot legally agree to the service yourself, involve a parent or legal guardian before registering. The current registration form does not collect a date of birth or verify a guardian’s identity.

A parent or guardian can contact us about a student’s privacy or an account created without any permission required by law. We will verify the relevant authority and consider the student’s privacy before disclosing or changing account information.

Security and calculated reports

We use measures such as password hashing, protected session identifiers, access controls and HTTPS on the production website to help protect information. No internet service can guarantee absolute security. Keep your password private and contact us promptly about suspected misuse.

The current test reports are calculated from saved practice answers, timing and results. They are study information, not decisions about admission or another legal entitlement. Contact us if you believe a result or its underlying information is wrong.

If we identify a security incident affecting personal information, we will investigate, take appropriate protective steps and provide notifications required by applicable law.

Changes to this policy

We will update this policy when the information we collect, its purposes, providers or retention practices materially change. The date on this page identifies the version.

Where a change materially affects how account information is used, we will give an appropriate notice through the website or account email. If a new use requires consent or another choice, we will provide it before that use begins.