Skip to content
Prepta
Check a file

Privacy policy

In force from 6 October 2026

Who is responsible

Prepta is operated as a Belgian sole proprietorship under enterprise number 1043.060.893 (VAT BE 1043.060.893), established at Eekhoutstraat 2 bus A201, 8850 Ardooie, Belgium. We are the controller for the data described in this policy unless stated otherwise. Privacy enquiries go to privacy@prepta.app. We have not appointed a data protection officer; the law does not require one for a service of our size.

Our role for artwork

Artwork you upload may itself contain personal data, such as names on business cards or addresses on mailings. For that content we act as processor on your instructions; you remain the controller and are responsible for having the right to process it. The section “Data protection and processing on your behalf” of the terms sets out our obligations as processor.

What we collect

Account details (name, email address, whether and when you used your free trial), workspace details, billing contact and VAT information, the files you submit for processing, the technical metadata produced by processing them, and product usage events such as jobs created (see “Account events”); website analytics without cookies (see “Website analytics”); and analytics and session replay in the app only if you allow them (see “Optional analytics in the app”). If you sign in with Google, Google sends us your name, email address and profile picture; we do not receive access to your Google account. For the free artwork check, which runs without an account, we process the file you submit, the report produced from it and technical request data such as your IP address, used for rate limiting and abuse prevention. Payment card data is collected and stored by our payment processor Stripe only; it never reaches Prepta’s systems.

Why we process it and on what basis

To provide the service you signed up for and to bill it (performance of a contract); to meet tax and accounting obligations (legal obligation); and to keep the service secure, prevent abuse and understand how the website and the product are used so we can improve them (legitimate interest). Optional analytics and session replay in the app run only with your consent, which you can withdraw at any time. We do not use your data for advertising and we do not sell it.

How submitted artwork is handled

Customer artwork is processed to produce a preflight result and, where enabled, a repaired output file. Originals are kept unchanged and every automatic change is recorded. Processing runs on our own infrastructure in the European Union. No AI provider currently receives your artwork; if we enable an optional AI-assisted step that does, the provider is added to the processor list below first. Location metadata embedded in images is never stored. Files are not used to train models.

Payments and billing data

Subscriptions are processed by Stripe. We share with Stripe the billing contact, address, VAT ID and subscription details needed to charge, invoice and comply with tax rules. Stripe acts as its own controller for payment data; invoices and payment methods are managed through Stripe’s billing portal.

Website analytics

On prepta.app — the website, the free checks and shared reports — Prepta measures visits with PostHog (EU cloud, Frankfurt) without cookies, and no identifier follows you from one day to the next. We do not store or read identifiers on your device for this measurement. The script may briefly test whether browser storage is available using a fixed value that is immediately removed. The legal basis is our legitimate interest in knowing which pages and steps people use, so we can improve the site; you can object at any time (see below). There is no session recording, no automatic capture of clicks and nothing you type is recorded; website analytics never identifies you and is never linked to an account, even if you sign up later. The events are kept for at most 13 months. For each page view and step, PostHog receives:

  • the page you open and the page you came from — addresses are sent without tokens or query values, apart from campaign tags and plain page settings such as a selected plan — how long and how far you read it, and steps such as starting a free check, a report coming back or clicking a sign-up button;
  • your browser, operating system and device type, but not their versions, your screen size, language or time zone;
  • your IP address and your browser’s user agent, which PostHog’s servers combine with our domain and a random value that changes every day into a code that counts visitors and visits. The IP address and user agent are then discarded and never stored, no location is derived from them, and the daily value is deleted after a few days, so the code can neither be traced back to you nor linked to your visits on other days.

Your right to object to website analytics

You can object to website analytics at any time (Article 21 GDPR). Because it recognises no one, Prepta cannot find your past visits in it; you can stop future measurement in this browser with the button below. Our server then sets one cookie, prepta_web_analytics_opt_out, which no script on the page can read or change; it is renewed while you use the website and kept until one year after your last visit. Before the analytics script may load, each page asks our server whether this cookie is set; while it is, the script does not load. You can also object by email to privacy@prepta.app. Turning off website analytics changes nothing about account events or your choice in the app.

Optional analytics in the app

Inside the Prepta app, once you are signed in, Prepta asks whether you allow optional usage analytics and privacy-masked session replay. Nothing loads before you choose; if you decline, nothing is recorded in your browser and only your choice is kept. If you allow it, Prepta uses PostHog (EU cloud, Frankfurt), on the basis of your consent, to see where the app is unclear and to improve it. Analytics events are kept for at most 13 months and session recordings for at most 30 days. PostHog then records:

  • the app pages you open and how long you stay; your browser with its version, language and time zone, your operating system, device type and screen size; PostHog receives your IP address, discards it and derives no location from it;
  • a recording of the app’s screen: its layout, its own labels and buttons, and where you click, scroll and pause. Everything else is masked in your browser before it is sent: file names, customer names, findings and report contents become placeholder characters, everything you type is hidden, and artwork, previews, images and drawings are not recorded at all — nor are network requests or console output;
  • a random identifier in a cookie whose name begins with ph_, which expires with your choice and at the latest after six months, and data for the current visit in your browser’s session storage. PostHog links what it records to your account by its internal ID, never by your name, email address or workspace name; website analytics is never linked to it.

Your choice in the app

Your choice is stored for six months in a first-party cookie named prepta_product_analytics, which holds only “granted” or “denied” and the date it expires and is sent only with the app’s pages (/app); after that you are asked again. The cookie is needed to respect your choice, so it is set whether you allow or decline. You can change your mind at any time under “Analytics settings” in the app’s account menu. Withdrawing stops the analytics and the recording at once and removes the PostHog identifier and its data from your browser; it does not affect the lawfulness of what was recorded before. To have that deleted too, email privacy@prepta.app. Declining or withdrawing concerns only this optional analytics: it does not turn off website analytics, which you can object to separately (see above), and it is not an objection to account events.

Account events

Separately from website analytics and from the optional analytics in the app, the application records a short list of account events on our servers, such as signing up, starting a trial, a job becoming ready or a subscription starting, with internal IDs, the plan and counts only. They reach PostHog without any cookie or browser identifier, on the basis of our legitimate interest in understanding how the product is used, and never contain artwork, file names or report contents. They do not depend on your choice in the app; if you allow analytics there, they belong to the same PostHog person as your app analytics, and they are never linked to website analytics. The events are kept for at most 25 months; when you delete your account, Prepta has PostHog delete the person linked to it, that person’s events and their session recordings.

Your right to object to account events

You can object to account events at any time (Article 21 GDPR) by emailing privacy@prepta.app; Prepta then stops sending account events about you to PostHog, and nothing else about the service changes. Choosing “No thanks” in the app concerns the optional analytics only and is not such an objection, and neither is turning off website analytics.

Necessary cookies

Prepta also sets a few first-party cookies that the site and the app need in order to work. They are set without asking because each serves only something you asked for, and none of them is used for analytics or shared with anyone:

  • NEXT_LOCALE — the language of the site and the app; set on your first visit and when you switch language; kept for one year.
  • __Secure-better-auth.session_token — keeps you signed in; kept for seven days, renewed while you use the app, deleted when you sign out.
  • __Secure-better-auth.session_data — a signed copy of your session so pages load without a database lookup; kept for five minutes.
  • __Secure-better-auth.state — protects a sign-in with Google against forgery; kept for five minutes, only while you sign in with Google.
  • prepta_product_analytics — your choice for optional analytics in the app (see above); only on the app’s pages (/app); kept for six months.
  • prepta_analytics_consent — the earlier, single analytics choice for the site and the app (October 2026); if it holds a refusal, the app respects it; deleted when you choose again, otherwise it expires within six months.
  • prepta_web_analytics_opt_out — set by our server only if you turn off website analytics in this browser (see above); not readable by scripts; kept until one year after your last visit.
  • sidebar_state — whether the app’s side menu is open or closed; set when you change it; kept for seven days.
  • prepta_free_check — takes a free check you chose to fix in Prepta into your new account; kept until that link expires, at most seven days.

Retention and deletion

Free artwork check: the file is deleted as soon as the report exists and at the latest 60 minutes after upload. The report keeps the file name and the findings and measurements, which can quote document properties or short passages of text from the file, but never the artwork itself. It stays available at its link for 30 days; after that the report and every other record of the check are deleted, and only usage counts that identify neither the file nor you remain. Workspace data: artwork, repaired versions, previews and reports stay in your workspace until you delete the workspace. An owner can delete a workspace at any time from Settings; everything in it, including stored files, is deleted within 30 days. Workspaces that have had no subscription and no activity for twelve months may be deleted after at least 30 days’ notice to the owner. Account data: your name, email address and sign-in details are deleted when you delete your account; jobs you created in a workspace that continues to exist keep an anonymised reference. Billing records are kept for as long as tax and accounting law requires, independent of workspace deletion. Operational logs are kept for at most 30 days. Analytics: website analytics and app analytics events are kept for at most 13 months, session recordings for at most 30 days and account events for at most 25 months; Prepta has older events deleted every month, and deleting your account deletes the events and recordings linked to it earlier.

Processors and sub-processors

We use the following providers. Data is stored and processed in the European Union unless stated otherwise. We update this list before adding a provider.

  • Vercel — hosting of the website and application; functions run in Frankfurt
  • Neon — database, Frankfurt
  • Cloudflare R2 — file storage, EU jurisdiction
  • Railway — processing worker, EU region
  • Stripe — payments; independent controller, see above
  • PostHog — analytics, EU cloud (Frankfurt): website analytics without cookies, account events, and analytics and session replay in the app only with your consent
  • Resend — transactional email (address confirmation, team invitations): recipient addresses, the messages and their delivery logs are stored in the United States, whichever region a message is sent from; artwork is never sent by email
  • Google — sign-in with Google, only if you use it

Transfers outside the EU

Some of these providers are US companies. Where data is transferred outside the European Union, the transfer is covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Resend stores transactional email data in the United States under its data processing addendum, which incorporates the Standard Contractual Clauses; the Data Privacy Framework is an additional safeguard.

Security

Data is encrypted in transit. Stored files and database contents are encrypted at rest by the providers above. Each workspace’s data is separated by its own storage prefix and access rules, and access by our team is limited to what operating and supporting the service requires. Every automatic change to a file is recorded so it can be reviewed and reversed.

Your rights

You can ask for access to your personal data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. To object to website analytics, use the button under “Your right to object to website analytics” or email privacy@prepta.app. To object to the account events Prepta sends to PostHog (see “Your right to object to account events”), email privacy@prepta.app: Prepta then stops sending them for you, and nothing else about the service changes. Files and reports can be exported from the workspace; deletion is done by deleting your account or workspace. For everything else, email privacy@prepta.app; we answer within one month. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be. If your data appears in artwork a print business uploaded, contact that business; we assist them in answering you.

Changes to this policy

When our providers or practices change, we update this page and the date at the top. Material changes affecting paid workspaces are announced with the same notice as changes to the terms.

Contact

Prepta, Eekhoutstraat 2 bus A201, 8850 Ardooie, Belgium · privacy@prepta.app · +32 479 03 08 56