← Back to home

Privacy Policy

Last updated: 24 September 2026

1. Introduction

CA Prep ("we", "us", "our") is committed to protecting the privacy of our users. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have under applicable data protection laws, including the Ghana Data Protection Act, 2012 (Act 843).

2. Data We Collect

We collect the following categories of data:

  • Account data — email address and hashed password (managed by our own authentication service). We do not store your plaintext password.
  • Subscription data — payment records processed via Paystack. We receive transaction references and subscription status; we never see or store your full card number or bank details.
  • Usage data — topics studied, questions answered, mock exam results, video views, and streak counts. This data powers your progress dashboard.
  • Technical data — IP address (used temporarily for rate limiting), browser type, device type, and operating system. This data is not stored permanently.
  • Cookies — we use one essential signed session cookie to keep you logged in. This is strictly necessary for the platform to function and cannot be disabled without breaking the service.

3. How We Use Your Data

  • To create and manage your account and subscription.
  • To deliver the educational content you have purchased (lessons, questions, videos, formula sheets).
  • To track your study progress and display it on your dashboard.
  • To enforce access controls — ensuring only entitled users can view paid content.
  • To protect the platform against abuse, brute-force attacks, and unauthorized access (rate limiting, content protection).
  • To send you important service-related notices (e.g. subscription expiry, security alerts).

4. Data Sharing

We do not sell your personal data. We share data only with the following trusted service providers, strictly to the extent necessary:

  • Aethelos Base — hosts our database, authentication records, and file storage.
  • Paystack — processes payments. Their privacy policy governs the payment data they collect directly.
  • Vercel — hosts the web application and provides edge infrastructure.

All service providers process data under contractual obligations and are prohibited from using your data for their own purposes.

5. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, we will remove your personal data within 30 days, except where we are required to retain records for legal or regulatory purposes (e.g. payment records for tax compliance).

Rate-limiting data (IP addresses) is held in server memory and is automatically evicted after 5 minutes of inactivity. It is never written to persistent storage.

6. Security Measures

We implement industry-standard technical and organizational measures to protect your data:

  • All data in transit is encrypted via HTTPS with HSTS preload.
  • Video content is served through time-limited signed URLs (15-minute expiry) and is never publicly accessible.
  • Database access is governed by Row-Level Security (RLS) policies — the application can only read/write data the authenticated user is entitled to.
  • Payment processing is handled exclusively by Paystack (PCI DSS compliant). We never handle raw card data.
  • Content protection mechanisms deter unauthorized copying, downloading, and redistribution of educational materials.
  • Rate limiting prevents brute-force attacks on authentication endpoints.
  • Security headers (CSP, X-Frame-Options, Permissions-Policy) defend against XSS, clickjacking, and injection attacks.

7. Your Rights

Under the Ghana Data Protection Act, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data ("right to be forgotten").
  • Object to or restrict processing in certain circumstances.
  • Withdraw consent where processing is based on consent.

To exercise any of these rights, please contact us using the details below.

8. Children's Privacy

CA Prep is designed for adult learners preparing for ICAG professional examinations. We do not knowingly collect data from children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the platform (e.g. a notice on the dashboard or an email). Continued use of the service after changes are posted constitutes acceptance of the revised policy.

10. Contact

For privacy-related enquiries or to exercise your rights, contact us at:

support@caprep.app