Privacy Policy

Prep4 by nrol ("Prep4," "we," "us") provides IELTS (and, soon, other English-proficiency) test preparation — practice content, automated and AI-assisted scoring, and progress tracking. Prep4 is built and operated separately from nrol's main study-abroad platform, with its own account system and database; this policy covers Prep4 only.

Account information. Email address, and for password accounts, a phone number and a securely hashed password (we never store your password itself). If you sign in with Google or Microsoft, we receive your name, email address, and a stable account identifier from that provider — never your password with either provider.

Practice and progress data. Your answers, attempts, timing, target scores, and the estimated band scores we calculate from them.

Speaking recordings. If you use Speaking practice, we record your voice response only after you give explicit consent for that recording. Recordings are used solely for assessment and are automatically deleted 30 days after submission.

Technical data. Standard server logs (IP address, timestamps, basic request metadata) and session identifiers needed to keep you signed in.

• To create and maintain your account, and to keep you signed in between visits.
• To grade your practice attempts and show you progress and estimated band scores.
• To assess Writing and Speaking submissions using AI-assisted scoring where that capability is enabled (see "AI processing" below).
• To communicate with you about your account, e.g. account or security notices.
• To detect abuse and keep the service secure.

We do not sell your personal information.

Some features (Writing scoring, Speaking scoring, speech-to-text, and text-to-speech for Listening audio) can be powered by third-party AI providers. Which provider, if any, is active for a given feature is a runtime configuration — when a feature isn't configured with a live provider yet, it runs in a mock mode that produces no real AI output rather than a fabricated result. When a live provider is active, the specific content needed for that request (e.g. your written answer, or your recording's audio) is sent to that provider for processing, and the result is returned to Prep4.

We also use, where you choose it, Google or Microsoft for sign-in (standard OAuth) — see "Information we collect" above.

There is no online payment processing live yet. When it is enabled, we intend to use a third-party payment processor (Razorpay) to handle card/UPI details directly — Prep4 itself does not store your full payment card number.

• Passwords are hashed with a standard, salted key-derivation function (scrypt) — we cannot see or recover your actual password.
• Session identifiers are random, server-issued tokens, stored hashed in our database, in an httpOnly cookie your browser doesn't expose to page scripts.
• Speaking recordings are automatically deleted 30 days after submission.
• We use industry-standard technical and organizational measures to protect your data, but no system is 100% secure, and we cannot guarantee absolute security.

We keep your account and practice data for as long as your account is active, so your history and progress stay available to you. Speaking recordings are kept for 30 days only, then deleted automatically. If you'd like your account and associated data deleted sooner, contact us using the details below — we don't yet have a self-service delete-my-account option.

Depending on where you live, you may have rights to access, correct, or request deletion of your personal information, or to object to certain processing. To exercise any of these, contact us below and we'll respond as required by applicable law.

Prep4 is intended for users preparing for university-level English proficiency exams and is not directed at children under 13. If you believe a child has provided us personal information, contact us and we will take appropriate steps to remove it.

We use a small number of strictly functional cookies — to keep you signed in (or to remember a guest practice session before you sign up), and briefly during sign-in with Google/Microsoft to verify that flow hasn't been tampered with. We do not currently use third-party advertising or analytics cookies.

We may update this policy as the product changes. We'll update the "Last updated" date above when we do; material changes will be communicated to you directly where required.

Questions about this policy or your data? Email support@nrol.me.

See also our Terms & Conditions.