PrepEdge™
Sign inGet started

Privacy Policy

Last updated: September 11, 2026

Draft — under legal review.

PrepEdge ("we", "us") provides AI-powered interview and resume preparation for enterprise technology sales and pre-sales professionals. This policy explains what personal data we collect, why, who we share it with, and your rights.

1. Who we are

PrepEdge is operated by Nicolai Imset, based in Norway. Contact: support@imseta.com.

2. What data we collect

  • Account data — name, email address, hashed password, plan and credit balance.
  • Content you submit — your CV/resume, job descriptions you paste or link, typed interview answers, roleplay transcripts, cover letters, and notes entered into role briefs, checklists, and debriefs.
  • AI-generated output — role briefs, tailored resumes, cue cards, scorecards, and coaching feedback generated from the above.
  • Usage and billing data — feature usage, AI cost/token logs, and credit-pack purchase records (via Stripe).

3. Why we process your data, and our legal basis

  • Provide the core service (generate briefs, tailor resumes, run roleplay) — account and content data. Legal basis: performance of a contract (Art 6(1)(b))*.
  • Process payments for credit packs — billing data (via Stripe). Legal basis: performance of a contract (Art 6(1)(b)).
  • Improve and secure the service, detect abuse — usage and cost logs. Legal basis: legitimate interest (Art 6(1)(f))*.
  • Send account, billing, and security emails — email address. Legal basis: performance of a contract / legitimate interest*.

* This legal-basis mapping is still under legal review.

4. Artificial intelligence processing

To generate role briefs, resume tailoring, cover letters, and roleplay scoring, the content you submit — your CV text, job descriptions, and typed interview answers — is sent to the Anthropic Claude API (Anthropic PBC, San Francisco, USA), which acts as our sub-processor. Under Anthropic's commercial API terms, data submitted via the API is not used to train Anthropic's models. Anthropic processes and retains this data under its own current commercial data retention policy (see Anthropic's data retention policy), which may change from time to time.

This transfer to the United States is covered by a transfer mechanism that is still under legal review (Data Privacy Framework certification or Standard Contractual Clauses).

AI-generated outputs (briefs, tailored bullets, scores, coaching) are probabilistic and may be inaccurate or incomplete. You are responsible for reviewing any output before relying on it or sharing it with a third party, such as a recruiter or interviewer.

5. Who we share data with (sub-processors)

We use the following sub-processors to run PrepEdge. None of them use your data for their own purposes beyond providing their service to us.

  • Anthropic (Claude API) — AI generation. Receives CV text, job descriptions, and typed answers. Region: USA — transfer mechanism under legal review, see §6.
  • Neon — database hosting (PostgreSQL). Receives all account and content data. Region: EU.
  • Railway — backend application hosting. Receives all account and content data, in transit and at rest. Region: EU.
  • Vercel — frontend hosting. Receives no content data — static assets and browser-side requests only. Region: global CDN, static assets only.
  • Stripe — payment processing for credit packs. We never see or store your card details. Region: EU (Ireland) — contracts via Stripe Payments Europe, Limited.
  • Resend — transactional email (password reset, account emails). Receives your email address and name. Region: USA — transfer mechanism under legal review.

6. International data transfers

Transfers to our non-EEA sub-processors — Anthropic and Resend — are covered by a mechanism (Data Privacy Framework and/or Standard Contractual Clauses, per sub-processor) that is still under legal review. Our other sub-processors (Neon, Railway, Stripe) are EU-based.

7. How long we keep your data

We retain your account, uploaded content, and AI-generated outputs for a period that is currently under legal review, or until you request deletion — whichever is earlier.

Financial records — transaction records (credit purchases, Stripe payment data) are retained for 5 years as required by Norwegian accounting law (bokføringsloven). After account deletion, these records are anonymised: your name and contact details are removed, but transaction amounts and dates are retained for legal compliance. Whether this anonymisation is sufficient to satisfy erasure requirements is still under legal review.

Usage and cost logs — retained for a period currently under legal review for billing accuracy and abuse detection, then deleted or anonymised.

8. Your rights

Under GDPR, you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate data. Most account and profile fields are editable directly in Account settings.
  • Erasure — delete your account and all associated content. Available directly at Account → Delete account, effective immediately (except the anonymised financial records described in §7).
  • Data portability — request an export of your data in a machine-readable format.
  • Object or restrict — object to processing based on legitimate interest, or ask us to restrict processing in certain circumstances.
  • Complain — lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) or the supervisory authority in your own EU/EEA country.

To exercise any of these rights, use the in-product tools where available, or contact us at support@imseta.com. We will respond within 30 days.

9. Sensitive information in your CV

Your CV may include information you've chosen to disclose that qualifies as special-category data under GDPR Article 9 — for example, details revealing health conditions, disability, religion, or similar. We do not ask for this information and do not analyse or extract it specifically; we process only what you choose to include. We recommend you do not include information in your CV that isn't necessary for the roles you're applying to.

Whether explicit consent — for example, a checkbox at upload — is required for this processing is still under legal review.

10. Cookies

PrepEdge sets no cookies and uses no analytics, advertising, performance-measurement or cross-site tracking service of any kind. We do not record which pages you visit or which features you use. Three things are stored in your browser, all of them needed to run the service you asked for: your sign-in token, kept in local storage so you stay signed in between visits; a note that you dismissed a particular on-screen warning, so it does not reappear for the rest of the visit; and a one-off marker used to recover the page after a failed asset load. The last two are cleared when you close the tab, and signing out removes the first.

11. Changes to this policy

We will post any material changes to this policy on this page and, where the change is significant, notify you by email.

12. Contact

Questions about this policy or your data: support@imseta.com.