PrepEdge™
Sign inGet started

Privacy Policy

Last updated: September 29, 2026

Draft — under legal review.

PrepEdge ("we", "us") provides AI-powered interview and resume preparation for enterprise technology sales and pre-sales professionals. This policy explains what personal data we collect, why, who we share it with, and your rights.

1. Who we are

PrepEdge is operated by Nicolai Imset, based in Norway. Contact: support@imseta.com.

2. What data we collect

  • Account data — name, email address, hashed password, plan and credit balance.
  • Content you submit — your CV/resume, job descriptions you paste or link, typed interview answers, roleplay transcripts, cover letters, and notes entered into role briefs, checklists, and debriefs.
  • AI-generated output — role briefs, tailored resumes, cue cards, scorecards, and coaching feedback generated from the above.
  • Usage and billing data — feature usage, AI cost/token logs, and credit-pack purchase records (via Stripe).
  • Feedback and messages you send us — feedback and ratings you submit in the product, and emails you send to one of our addresses.

3. Why we process your data, and our legal basis

  • Provide the core service (generate briefs, tailor resumes, run roleplay) — account and content data. Legal basis: performance of a contract (Art 6(1)(b))*.
  • Process payments for credit packs — billing data (via Stripe). Legal basis: performance of a contract (Art 6(1)(b)).
  • Improve and secure the service, detect abuse — usage and cost logs. Legal basis: legitimate interest (Art 6(1)(f))*.
  • Send account, billing, and security emails — email address. Legal basis: performance of a contract / legitimate interest*.

* This legal-basis mapping is still under legal review.

4. Artificial intelligence processing

To generate role briefs, resume tailoring, cover letters, and roleplay scoring, the content you submit — your CV text, job descriptions, and typed interview answers — is sent to the Anthropic Claude API (Anthropic PBC, San Francisco, USA), which acts as our sub-processor. Under Anthropic's commercial API terms, data submitted via the API is not used to train Anthropic's models. Anthropic processes and retains this data under its own current commercial data retention policy (see Anthropic's data retention policy), which may change from time to time.

This transfer to the United States is covered by a transfer mechanism that is still under legal review (Data Privacy Framework certification or Standard Contractual Clauses).

AI-generated outputs (briefs, tailored bullets, scores, coaching) are probabilistic and may be inaccurate or incomplete. You are responsible for reviewing any output before relying on it or sharing it with a third party, such as a recruiter or interviewer.

5. Who we share data with (sub-processors)

We use the following sub-processors to run PrepEdge. None of them use your data for their own purposes beyond providing their service to us.

  • Anthropic (Claude API) — AI generation. Receives CV text, job descriptions, and typed answers. Region: USA — transfer mechanism under legal review, see §6.
  • Neon — database hosting (PostgreSQL). Receives all account and content data. Region: EU.
  • Railway — backend application hosting. Receives all account and content data, in transit and at rest. Region: EU.
  • Vercel — frontend hosting. Receives no content data — static assets and browser-side requests only. Region: global CDN, static assets only.
  • Stripe — payment processing for credit packs. We never see or store your card details. Region: EU (Ireland) — contracts via Stripe Payments Europe, Limited.
  • Resend — transactional email (password reset, account emails). Receives your email address and name. Region: USA — transfer mechanism under legal review.

6. International data transfers

Transfers to our non-EEA sub-processors — Anthropic and Resend — are covered by a mechanism (Data Privacy Framework and/or Standard Contractual Clauses, per sub-processor) that is still under legal review. Our other sub-processors (Neon, Railway, Stripe) are EU-based.

7. How long we keep your data

We retain your account, uploaded content, and AI-generated outputs for a period that is currently under legal review, or until you request deletion — whichever is earlier.

Financial records — transaction records (credit purchases, Stripe payment data) are retained for 5 years as required by Norwegian accounting law (bokføringsloven). After account deletion, these records are anonymised: your name and contact details are removed, but transaction amounts and dates are retained for legal compliance. Whether this anonymisation is sufficient to satisfy erasure requirements is still under legal review.

Usage and cost logs — retained for a period currently under legal review for billing accuracy and abuse detection, then deleted or anonymised.

When you delete your account — your account is closed straight away and you can no longer sign in. 30 days later we permanently delete what you created in PrepEdge: your CVs and every earlier version of them, tailored resumes, cover letters, role briefs, roleplay sessions and their transcripts, cue cards, checklists, debriefs, and products. At the same time we remove your name, email address and password from your account record. We keep a record that the account existed and was deleted, because our systems use it to carry out the deletion. Deletion cannot be undone.

Some things are kept after that, on purpose:

  • Feedback you sent us — the message and any rating stay, but they are no longer linked to your account or your email address. If you named yourself in the message, contact us and we will remove it.
  • Emails you sent to one of our addresses — these are kept in our support inbox, because they are stored by sender address rather than by account. Ask us and we will delete them.
  • Usage and cost logs — kept for our cost records, but no longer linked to your account.
  • Financial records — kept for 5 years, as described above.

Whether the 30-day delay and the records we keep are acceptable is still under legal review.

8. Your rights

Under GDPR, you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate data. Most account and profile fields are editable directly in Account settings.
  • Erasure — delete your account and the content you created, at Account → Delete account. Your account is closed straight away and your content is permanently deleted 30 days later. §7 lists what is kept after that, and why.
  • Data portability — request an export of your data in a machine-readable format.
  • Object or restrict — object to processing based on legitimate interest, or ask us to restrict processing in certain circumstances.
  • Complain — lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) or the supervisory authority in your own EU/EEA country.

To exercise any of these rights, use the in-product tools where available, or contact us at support@imseta.com. We will respond within 30 days.

9. Sensitive information in your CV

Your CV may include information you've chosen to disclose that qualifies as special-category data under GDPR Article 9 — for example, details revealing health conditions, disability, religion, or similar. We do not ask for this information and do not analyse or extract it specifically; we process only what you choose to include. We recommend you do not include information in your CV that isn't necessary for the roles you're applying to.

Before you upload or replace a CV, we ask for your explicit consent (GDPR Article 9(2)(a)) to process any such information it contains, using a checkbox on the upload screen. We record when you gave that consent and which wording you agreed to. You can withdraw it at any time by deleting your account or by contacting support@imseta.com; withdrawing does not affect processing that took place before.

The consent wording, and whether consent is the right basis for this processing, are still under legal review.

10. Cookies

PrepEdge sets no cookies and uses no analytics, advertising, performance-measurement or cross-site tracking service of any kind. We do not record which pages you visit or which features you use. Three things are stored in your browser, all of them needed to run the service you asked for: your sign-in token, kept in local storage so you stay signed in between visits; a note that you dismissed a particular on-screen warning, so it does not reappear for the rest of the visit; and a one-off marker used to recover the page after a failed asset load. The last two are cleared when you close the tab, and signing out removes the first.

11. Changes to this policy

We will post any material changes to this policy on this page and, where the change is significant, notify you by email.

12. Contact

Questions about this policy or your data: support@imseta.com.