Privacy Policy

1. Who we are

PointPrep ("PointPrep", "we", "us") runs the PointPrep website at pointprep.com, the web app at app.pointprep.com, and the PointPrep apps for iPhone and Android. We decide how and why your personal data is used, so we are its data controller under Ghana's Data Protection Act, 2012 (Act 843).

PointPrep isn't registered as a company yet. It's owned and run by its two founders, and we'll add its registration details here once it's registered.

Address: Residential Enclave, KNUST, Kumasi, Ghana. Email: support@pointprep.com.

PointPrep is applying to register with the Data Protection Commission.

2. What we collect

Your account

• Your email address. You need one to have an account: it's how you sign in, and where we send sign-in codes and receipts.
• Your name, if you add it in Profile. It's optional.
• Sign-in codes. When you sign in with your email, we send a 5-digit code that works for 5 minutes.
• Sign in with Google: your name, email address and profile photo from your Google account.
• Sign in with Apple: your name, if you choose to share it, your email address (or Apple's relay address if you use Hide My Email) and an identifier that links your Apple ID to your account. We may also keep a token from Apple so that we can unlink PointPrep from your Apple ID when you delete your account.
• Sessions: for each device you're signed in on, a sign-in token, the IP address you signed in from, and when it was last used.

Your studying

• The quizzes you create and take, the mode and time limit you choose, and when you start and submit them.
• Each answer you choose, whether it was right, and your scores.
• The days you used PointPrep, for your daily streak.
• Messages we show you in the app's notifications, such as plan reminders.

Your payments

When you buy a plan, we keep your email address, the plan, the amount, the payment reference, its status and dates. Paystack sends us a confirmation of each payment. It includes details Paystack holds about the payment, such as whether you paid by card or mobile money, the card's brand, issuing bank, first six and last four digits and expiry date or your mobile-money provider and number, your name and phone number if you gave them to Paystack, and the IP address you paid from. We never receive your full card number, security code or PIN.

Gifts

When you buy a plan as a gift, we keep the email address you give us for the person, your name as you entered it and any note, with the payment, and email them about the plan. If someone gave you a plan, we got your email address from them, and use it to put the plan on your account and tell you about it. When the giver deletes their account, we remove their name and note from the gift; when the person who received it deletes theirs, we remove their email address and the note.

Android beta

When you ask to test the Android app, we keep the Google account email you give us, your name (as you type it on the website, or from your account in the web app) and when you asked. If you ask from the web app, the request is linked to your account. Each evening the people who run PointPrep get an email listing who is waiting. We add the email to the app's testers on Google Play and email you when you can install it.

Reports and feedback

When you report a problem with a question or send us an idea, we keep your message, the reason you chose (for example "wrong answer"), the question or quiz it's about, and any screenshots you attach. Each report is linked to your account, so we can look into it and reply.

Using the website and apps

• Analytics, only if you accept them. If you accept optional cookies on pointprep.com, PostHog records the pages you visit and how you use them, with your browser, device and an approximate location worked out from your IP address. If you don't accept, nothing is recorded. The web app and the mobile apps don't use analytics.
• Technical data. Our servers log each request, with its IP address, time and the browser or app version. When something breaks or a page stops responding, an error report is sent to Sentry with technical details of what went wrong and, if you're signed in, your account ID. On the website, web app and admin site, the report includes a replay of the page in the minute before, with all text and anything you typed hidden.
• Abuse protection. We count sign-in code requests and Android beta sign-ups by IP address and email address, to stop people flooding the service.

3. How we use it

Act 843 allows us to use personal data only for a lawful reason. These are ours:

We combine answers from all learners into statistics about each question, such as how many people got it right first time, to find questions that are unclear or wrong. These statistics don't identify anyone.

We don't send marketing emails. If we ever want to, we'll ask for your consent first. We don't sell personal data, use it for advertising, or make decisions about you by automated means alone.

4. Who we share it with

The people who run PointPrep can see account, payment and report details when they need to, for example to help you with a problem or a refund. We also use these providers, who handle data for us under contracts that let them use it only to provide their service:

Paystack, Apple and Google also use what you give them under their own privacy policies. So do Apple's App Store and Google Play when you download our apps.

We'll only share personal data with anyone else:

• when the law requires it, for example a court order or a request from a regulator;
• to protect people's safety, or our rights against fraud or abuse;
• if PointPrep is registered as a company or its business moves to a new owner, in which case the new owner takes over as data controller under this policy, and we'll tell you.

5. Data stored outside Ghana

Our providers store and process data outside Ghana, mainly in the United Kingdom and the United States (see the table above). We choose providers that protect data with strong security and that commit, in their data processing terms, to use it only to provide their service to us. If you're in the European Union or the United Kingdom, these terms include the standard contractual clauses approved for transfers outside those areas.

6. Cookies and similar storage

Cookies, and the browser storage that works like them, keep small pieces of information on your device. We use only what's needed to make PointPrep work, plus website analytics if you accept them.

Strictly necessary storage doesn't need your consent. Analytics stay off until you choose "Accept optional cookies", and you can change your mind at any time with "Cookie settings" at the bottom of every page on the website. Paystack's payment page sets its own cookies, which its policy covers.

7. How long we keep it

Deleted data can stay in our database backups for a short time until those backups are replaced. Nobody uses backups except to restore the service after a failure.

8. How we protect it

• All connections to PointPrep and between our systems are encrypted.
• We don't use passwords: you sign in with a short-lived code, or with Apple or Google.
• Report screenshots are kept in private storage, and only the people who run PointPrep can open them.
• Sign-in attempts are limited, to stop people guessing codes.
• Access to personal data is limited to the people who need it to run PointPrep.

If a security breach puts your personal data at risk, we'll tell the Data Protection Commission and you as soon as we reasonably can, and say what we're doing about it.

9. Your rights

Under Act 843 you can:

• ask whether we hold personal data about you, and for a copy of it;
• ask us to correct or delete personal data that's inaccurate, out of date, incomplete, irrelevant, excessive, misleading, or that we got unlawfully;
• ask us to stop using your data in a way that causes, or is likely to cause, you unwarranted damage or distress;
• refuse direct marketing;
• withdraw your consent where we rely on it (analytics), without affecting what we did before;
• complain to the Data Protection Commission, at dpc.gov.gh, info@dpc.gov.gh or +233 25 630 1533.

If you're in the European Union or the United Kingdom, you also have the rights the GDPR gives you, including to have your data erased, to restrict how we use it, to object to uses based on our interests, to get the data you gave us in a format you can take elsewhere, and to complain to your local data protection authority.

How to use them

• Change your name at any time in Profile.
• Delete your account in the app or web app under Account, then Delete account. This erases your profile, study history, reports and notifications straight away, and unlinks Sign in with Apple.
• For anything else, email support@pointprep.com from the address on your account. We may ask you to confirm it's you, and we'll reply within 21 days.

10. The mobile apps

• The apps ask to open your photos only when you choose a screenshot to attach to a report, and read only the pictures you pick. They don't use your camera, microphone, location or contacts.
• The apps don't track you across other companies' apps or websites, don't use advertising identifiers, show no ads and contain no analytics tools.
• Your sign-in token is kept in your phone's secure storage.
• Notifications appear inside the app only. We don't send push notifications.
• You can delete your account from inside the app: Profile, then Delete account.

11. Age limit

PointPrep is for people preparing for the GPPQE. You must be 16 or older to use it. If we learn that someone younger has an account, we'll delete it. If you think a child has given us personal data, contact us.

12. Changes to this policy

When this policy changes, we'll post the new version here and update the date at the top. If a change affects how we use data you've already given us, we'll tell you by email or in the app before it takes effect.

13. Contact us

For questions about this policy or your personal data, email support@pointprep.com, or write to PointPrep, Residential Enclave, KNUST, Kumasi, Ghana. You can also reach us through the contact page.