Privacy Policy

Last updated: July 29, 2026 · Effective date: July 18, 2026

1. Who we are

PREP is operated by Three Point Advisory LLC, a Virginia limited liability company ("we," "us," or "our"). This Privacy Policy explains what personal information we collect when you use PREP (the "Service"), how we use it, and the choices and rights you have.

For the purposes of the EU/UK General Data Protection Regulation (GDPR), Three Point Advisory LLC is the "data controller" of the personal information described here.

2. What we collect

Information you give us

• Account information. Your email address, which you provide to sign in via a magic link. We do not require or store a password.
• Billing information. When you purchase a Single Session or subscribe to Pro, our payment processor collects your name, billing address, and payment card details on our behalf. We do not see, receive, or store your full card number. We receive a customer identifier, subscription status, plan, renewal date, and — if a payment fails — a status flag.
• Practice content ("Your Inputs"). The scenarios, dialogue lines, and configuration options you enter while rehearsing.
• Communications. If you contact us by email, we'll receive your message, email address, and any information you include.

Information we collect automatically

• Usage & technical data. IP address, browser type, device type, timestamps, pages visited, features used, and error logs. Some of this is collected by our hosting and infrastructure provider. For Free Preview abuse prevention, PREP stores keyed, one-way hashes derived from a signed browser identifier and limited connection data; the Free Preview claim does not store the raw IP address or user-agent string.
• Cookies and similar technologies. Signed session and device cookies used to keep you signed in and enforce Free Preview limits. See Cookies below.

Information we do not collect

• We do not knowingly collect information from children under 18.
• We do not collect biometric data or track your precise location.
• We do not use PREP inputs to build a profile of you outside the Service.

3. How we use it

We use personal information to:

• Create and authenticate your account (magic-link sign-in);
• Generate AI-simulated counterparts, coaching, and readiness reports in response to Your Inputs;
• Enforce plan limits and prevent abuse (for example, tracking how many rehearsals you've used this month);
• Process payments, subscriptions, and receipts through our payment processor;
• Send transactional email (sign-in links, receipts, account notices) and, if you subscribe, occasional service updates;
• Maintain, secure, debug, and improve the Service;
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use Your Inputs to train machine-learning models.

4. Legal bases (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 GDPR:

• Contract — to provide the Service you asked for (running rehearsals, generating reports, processing payments, sending transactional email);
• Legitimate interests — to secure and improve the Service, prevent fraud and abuse, and communicate with you about the Service (balanced against your rights);
• Consent — for non-essential communications where consent is required;
• Legal obligation — where required by law.

5. When we share information

We share personal information only in these limited circumstances:

• Service providers ("processors"). Companies that help us run PREP — currently including a payment processor (for billing), a hosting/infrastructure provider (for the site and databases), an email delivery service (for sign-in links and receipts), and third-party AI service providers (to generate AI Output). Each is bound by contract to process personal information only on our instructions and to protect it.
• Team & Enterprise plans. If your organization has a Team or Enterprise plan, we may share limited administrative information (for example, seat count and whether you have an active seat) with the organization's designated admin. We never share individual practice content or transcripts with an organization. Team & Enterprise admins see only anonymized, aggregated readiness patterns across the organization, if enabled.
• Legal compliance. To comply with law, respond to lawful requests, protect our rights, or protect the safety of any person.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, personal information may be transferred, subject to this policy.

We do not sell your personal information, and we do not share it with advertisers.

6. AI service providers

PREP uses one or more third-party AI service providers to generate the simulated counterpart, mid-conversation coaching, and STEADY readiness report. When you interact with the Service, Your Inputs (and, for scoring, transcripts of the rehearsal you're currently running) are transmitted to these providers on our behalf so they can generate the AI Output.

Our AI service providers process Your Inputs under contractual protections designed for their commercial API offerings, which generally include commitments not to use API inputs to train their public models by default and to hold API content for a limited retention period for safety and abuse-prevention purposes. The exact terms are set by each provider.

Because AI Output is generated in real time from Your Inputs, please continue to follow our guidance and keep every detail fictional — use invented names and situations, and do not enter real identities, employer information, confidential business information, protected health information, or details relating to an active investigation or legal matter.

7. How long we keep information

• Account information (email, plan, quota counters, Stripe customer ID) — kept while your account is active. If you delete your account or ask us to delete it, we'll delete your account record within 30 days, subject to legal retention obligations (for example, tax and payment records).
• Practice content (Your Inputs). Not stored as a durable, retrievable record after your session ends. Transient copies exist while a rehearsal is running so the counterpart can respond and the STEADY report can be scored, and short-lived provider-side logs may exist per Section 6.
• Payment records — retained by our payment processor and by us for as long as required for tax, accounting, and legal compliance (typically 7 years in the U.S.).
• Support communications — retained for up to 3 years so we can respond to follow-ups and disputes.
• Server logs — retained for a limited period (typically 30–90 days) for security and debugging.
• Free Preview claim signals — keyed, one-way hashes and the applicable monthly claim period are retained for abuse prevention. Raw connection data is not stored in the claim record.

8. Security

We use administrative, technical, and organizational safeguards designed to protect personal information — including TLS encryption in transit, signed session cookies, HMAC-signed authentication tokens, restricted access to production systems, and a payment processor that is PCI-DSS certified. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International data transfers

We are based in the United States, and our service providers may process information in the United States or other countries. If you are located outside the United States, your information may be transferred to and processed in a country whose data-protection laws differ from those in your country. For transfers from the European Economic Area, United Kingdom, or Switzerland to the United States or other third countries, we rely on the European Commission's Standard Contractual Clauses (or equivalent UK/Swiss safeguards) where required.

10. Your privacy rights

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal information we hold about you;
• Correction — ask us to correct information that's inaccurate;
• Deletion — ask us to delete your account and associated information;
• Portability — receive certain information in a machine-readable format;
• Objection or restriction — object to or restrict certain processing;
• Withdraw consent — where processing is based on consent;
• Non-discrimination — we will not deny you service or charge you more for exercising a privacy right.

To exercise any of these, email hello@threepointadvisory.com from the address associated with your account. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law (typically within 30 days).

11. California-specific disclosures

If you are a California resident, the California Consumer Privacy Act ("CCPA") as amended gives you rights to know what personal information we collect, request deletion, correct inaccurate information, opt out of certain "sharing" for cross-context behavioral advertising, and limit use of sensitive personal information.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA.

You may nevertheless record an opt-out request through our Do Not Sell or Share My Personal Information page. It does not require an account or identity verification. PREP also recognizes a user-enabled Global Privacy Control signal and treats it as an opt-out request for the browser or device sending the signal.

Categories of personal information we collect are described in Section 2. Purposes are described in Section 3. Sources are you (directly), your browser and device (automatically), and our payment processor (for billing status). You may use an authorized agent where applicable. To exercise another CCPA right, contact us using the details in Section 16.

12. EU / UK-specific disclosures

If you are in the European Economic Area or the United Kingdom:

• The legal bases we rely on are described in Section 4.
• You have the right to lodge a complaint with your local data-protection authority. In the UK, that's the Information Commissioner's Office (ico.org.uk).
• We rely on Standard Contractual Clauses (or equivalent UK/Swiss safeguards) for international transfers as described in Section 9.

13. Children

PREP is intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn we've collected information from someone under 18, we'll delete it. If you believe a minor has provided us information, please contact us at hello@threepointadvisory.com.

14. Cookies & similar technologies

We use a small number of first-party cookies:

• Session cookie (prep_session) — a signed, HTTP-only cookie that keeps you signed in. Required for account features.
• Device cookie (prep_device) — a signed, HTTP-only identifier used to enforce Free Preview limits across different email addresses on the same browser. It lasts up to one year.
• Privacy-choice cookie (prep_privacy_opt_out) — records a Do Not Sell or Share preference for this browser for one year.

We do not use third-party analytics, advertising, or tracking cookies.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top. If we make material changes, we'll notify you (for example, by email or in-app notice) before they take effect. Your continued use of the Service after the change takes effect constitutes acceptance.

16. Contact us

Three Point Advisory LLC
Virginia, United States
hello@threepointadvisory.com

© 2026 Three Point Advisory LLC. All rights reserved.