Privacy Policy

WePrepUni (“we”, “us”, “our”) is an independent private educational platform operating at weprepuni.com. We are not affiliated with, endorsed by, or partnered with CISIA, the University of Milan (UniMi), the University of Turin (UniTo), Bocconi University, or any other official university or testing organisation.

• Email address — collected when you sign in via magic link. Used solely to authenticate your account and send you transactional emails (sign-in links, purchase receipts).
• Purchase records — we store which exams you have unlocked so we can grant you access across sessions and devices.
• Exam attempt history — your mock-exam scores and section results are stored so you can review them in your account.
• Study progress— lesson completion, drill scores, and study mode preferences are stored in your browser’s local storage only. They are never transmitted to our servers.
• Payment data — card details are handled entirely by Stripe and never seen or stored by us. We only receive a confirmation that a payment succeeded.
• Analytics — if you consent via the cookie banner, we collect aggregated, anonymised usage data (pages visited, session length) to improve the platform. No personal identifiers are included.

• Contract performance — processing your email and purchase record is necessary to provide the service you paid for (Art. 6(1)(b) GDPR).
• Legitimate interest — storing exam attempt history so you can track your progress (Art. 6(1)(f) GDPR).
• Consent— analytics cookies are only set if you click “Accept all” on the cookie banner (Art. 6(1)(a) GDPR). You can withdraw consent at any time by clearing your browser’s local storage.

We use the following types of cookies:

• Essential cookies — a session cookie set by Supabase to keep you signed in. These cannot be disabled without breaking the service.
• Preference cookies — we store your theme (light/dark) and language (IT/EN) choice in local storage. These are not transmitted to any third party.
• Analytics cookies — only set with your explicit consent. Used to measure aggregate page traffic. No cross-site tracking.

Account data (email, purchases, attempt history) is retained for as long as your account exists. You may request deletion at any time by emailing us (see contact details below), after which your data will be permanently removed within 30 days.

If you are in the EU/EEA you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion (“right to be forgotten”)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (for consent-based processing)

To exercise any of these rights, email us at the address below. We will respond within 30 days.

• Supabase — authentication and database hosting (EU region).
• Stripe — payment processing. Stripe is PCI-DSS certified. We do not store card data.
• Vercel — website hosting and CDN.

All processors operate under Data Processing Agreements compliant with GDPR.

We may update this policy from time to time. The “Last updated” date at the top of this page will reflect any changes. Continued use of the platform after a change constitutes acceptance of the updated policy.

For privacy-related questions or to exercise your GDPR rights, email us at privacy@weprepuni.com.