Privacy Policy

Introduction

Thank you for choosing to be part of our community at Preparedness Innovations, Inc. (the “Company,” “Preppr.ai” or “Preppr,” “we,” “us,” or “our”). We are committed to protecting your personal information and respecting your privacy rights. This Privacy Policy explains how we collect, use, and safeguard your personal data when you visit our websites, www.preppr.ai and app.preppr.ai (collectively, the “Sites”), and when you interact with our services.

If you have questions about this Privacy Policy or our data handling practices, please contact us at connect@preppr.ai. Please discontinue the use of the Sites and our services if you do not agree with the terms in this Privacy Policy.

This Privacy Policy applies to all information collected through the Sites, as well as to any related services, sales, marketing, or events (collectively referred to in this Privacy Policy as the “Services”).

Please read this Privacy Policy carefully, as it will help you make informed decisions about how you share your personal information with us.

1. WHAT INFORMATION DO WE COLLECT?

Personal Information You Disclose to Us

In Short: We collect personal information that you provide directly, such as your name, email address, account type, address, billing information, and any content you share with Preppr.

We collect personal information that you voluntarily provide when you register, use, or interact with the Sites. The personal information we may collect includes:

·       Contact Data: Your first and last name, email address, and physical address, which we use to facilitate account creation, communications, and account management.

·       Account Type: Information about the type of account you choose, which helps us tailor your experience and deliver the appropriate services.

·       Billing Data: When you purchase a paid subscription, the billing information necessary to process your payment — such as your name, billing address, and subscription and transaction records. Payment-card details are collected and processed directly by our payment processor, Stripe, and are not stored by Preppr (see Section 5).

·       Content: We collect “Your Content,” “Output Content,” and “Contributor Content” as defined in our Terms of Service. This includes any content you create, submit, or transmit through the Services, such as text, documents, or other materials you upload, as well as the AI-generated output resulting from your use of the Services.

·       Sensitive Information: We do not process sensitive personal information (SPI), personally identifiable information (PII), or protected health information (PHI) unless expressly authorized in writing by Preppr, as outlined in our Terms of Service.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Information Automatically Collected

In Short: Certain information — such as IP address, browser, and device characteristics — is collected automatically when you visit the Sites.

When you visit or navigate the Sites, we automatically collect certain information. This information does not reveal your specific identity but may include device and usage information such as: IP address; browser and device characteristics; operating system; language preferences; referring URLs; device name; location; and date and time of access. This information is primarily used to ensure the security and proper operation of our Sites and to assist with internal analytics and reporting.

2. HOW DO WE USE YOUR INFORMATION?

In Short: We process your information to provide Preppr's services, ensure secure access, and meet our legal and business obligations.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

·       Provide and Manage Services [Contractual]: We use your information to create, store, and manage your account, facilitate secure access, and ensure that platform features function correctly.

·       Facilitate Account Creation and Login [Contractual]: We use your information to facilitate account setup and secure login.

·       To provide and facilitate delivery of Services [Business Purposes]: We process Your Content to generate and provide you with Output Content.

·       To facilitate user-to-user interaction [Business Purposes]: We process Contributor Content to make it available to the primary User(s) of the campaign to which the Contributor submitted it, in accordance with the licenses granted in our Terms of Service.

·       Enhance User Experience and Support [Business Purposes]: We may request feedback on your experience and provide support based on usage data to improve service quality.

·       Protect Our Services [Business Purposes/Legal Reasons]: We use data to monitor for misuse or unauthorized access, taking steps to secure the platform against risks.

·       Comply with Legal Obligations [Legal Reasons]: We may use your information as necessary to comply with legal requirements, such as responding to court orders or governmental inquiries.

·       Improve and Optimize Services [Business Purposes]: We analyze usage data to improve Preppr's functionality, inform new features, and identify usage trends.

3. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

In Short: We share information with the service providers that operate Preppr, and to comply with laws, protect rights, or fulfill business requirements.

We may share your information in the following circumstances:

·       Vendors, Consultants, and Other Service Providers (Subprocessors): We share information with the third-party service providers (subprocessors) that host our infrastructure, process payments, and power Preppr's features — including those listed in Section 5 (How Do We Store Data and Provide Features?). These providers process data on our behalf, only as needed to perform their services, and under contractual obligations consistent with this Policy.

·       Compliance with Laws: We may disclose your information as necessary to comply with applicable laws, governmental requests, judicial proceedings, court orders, or legal processes (including for national security or law enforcement requirements).

·       Vital Interests and Legal Rights: We may share information if we believe it's necessary to investigate, prevent, or act on violations of our policies, fraud, threats to safety, or illegal activities.

·       Contributors and Users: The Services are designed to facilitate collaboration. If you are a “Contributor” (as defined in our Terms of Service), your “Contributor Content” will be shared with the User(s) associated with the campaign(s) you are contributing to. By submitting Contributor Content, you consent to this sharing as part of the Service's function.

·       With Your Consent: We may disclose your personal information for any other purpose with your explicit consent.

4. HOW DO WE HANDLE YOUR LOGINS?

In Short: Preppr manages login information securely through Amazon Cognito, providing account authentication and access management.

Preppr uses Amazon Cognito to manage login credentials, ensuring secure storage and processing of authentication details. When you register or log in to preppr.ai or app.preppr.ai, your login credentials (such as email and password) are encrypted and securely handled by Cognito, enhancing account security by managing authentication to ensure only you have access to your Preppr account.

5. HOW DO WE STORE DATA AND PROVIDE FEATURES?

In Short: We use secure cloud infrastructure and integrate third-party service providers (subprocessors) to store your data, process payments, and deliver Preppr's features.

Preppr uses Amazon Web Services (AWS) for secure data storage, processing, and hosting, and Stripe to process payments and billing. To deliver Preppr's AI and content features, we integrate third-party model and content providers — some model requests are routed through OpenRouter, a model-routing gateway, while others connect directly to the provider (including a direct Anthropic connection and AWS Bedrock). Data and content shared with Preppr for these features are processed by the providers under their own privacy and data-retention policies:

Infrastructure and payments

Amazon Web Services (AWS): AWS provides the infrastructure Preppr uses for data storage, processing, hosting, and identity management — including Amazon S3 (file and document storage), Amazon Cognito (user identity and authentication), and AWS Amplify and AWS App Runner (application hosting and compute). AWS is compliant with stringent privacy and security standards, including data encryption at rest and in transit, comprehensive audit logging, and granular access controls, and maintains independent certifications including SOC 1/2/3 and ISO 27001/27017/27018. For a full overview of AWS's privacy practices, please review their policy.

AWS Bedrock: Preppr uses AWS Bedrock to process Knowledge Base documents — generating text embeddings (Amazon Titan Embed Text v2) for semantic search and using a Claude model (Claude Haiku) for contextual enrichment of document chunks and profile categorization. Bedrock-hosted models run within AWS; data sent to them is not shared with the underlying model vendors and is not used to train their models.

Stripe: Preppr uses Stripe to process payments and manage subscriptions and billing. Payment-card and billing information you provide is handled by Stripe, which is certified as a PCI Service Provider Level 1 — the most stringent level of certification available in the payments industry — and produces annual SOC 1 Type II, SOC 2 Type II, and SOC 3 reports. Stripe encrypts card numbers at rest with AES-256 (with decryption keys stored on separate infrastructure) and requires TLS 1.2 or higher for data in transit. Stripe processes this data under its own privacy policy and data processing agreement. For further details, please refer to Stripe's privacy policy.

AI model providers

OpenRouter: Preppr routes some of its large-language-model requests through OpenRouter, a model-routing gateway that forwards each request to the model provider the user or system selects. Other requests connect directly to the provider (for example, directly to Anthropic, or to OpenAI for text embeddings). By default, prompt logging is not enabled — OpenRouter states that it does not store inputs after categorizing them and does not associate them with any specific user or organizational account — and OpenRouter states that it has opted out of model training with the models it routes to wherever possible. A Data Processing Agreement is available for organizations. For further details, please refer to OpenRouter's Terms of Service (https://openrouter.ai/terms) and Privacy Policy (https://openrouter.ai/privacy).

Anthropic (Claude): Preppr uses Anthropic's Claude models — including Claude Opus 4.7, Claude Sonnet 4.6, and Claude Haiku 4.5, and other models as needed — as its primary models for advanced reasoning, question-answering, text generation, and analysis. For API users such as Preppr, Anthropic automatically deletes inputs and outputs on their backend within 30 days of receipt or generation, except where zero-data-retention agreements are in place or retention is required for Usage Policy enforcement or legal compliance. Anthropic does not use API data for training unless there is a specific agreement stating otherwise.

Google (Gemini): Preppr incorporates Google's Gemini models for various analytical and generative tasks, primarily as a fallback to the Claude family. Because Preppr uses Paid Services, Google does not use prompts or responses to improve its products, and processes data in accordance with the Data Processing Addendum for Products Where Google Is a Data Processor. For abuse-monitoring purposes, Google retains prompts, contextual information, and outputs for fifty-five (55) days. Gemini for Google Cloud is compliant with ISO 27001, ISO 27017, ISO 27018, ISO 27701, SOC 1, SOC 2, and SOC 3 certifications, and all data is encrypted at rest and in transit.

OpenAI: Preppr uses OpenAI to generate text embeddings for session-document semantic search, and OpenAI's models (such as GPT-4o and GPT-4.1) are available as a user-selectable model in the Exercise Designer. OpenAI automatically deletes inputs and outputs on their backend within 30 days for API users unless otherwise agreed or required for policy enforcement or legal compliance, does not use API business data to train its models by default, employs AES-256 encryption at rest and TLS 1.2+ in transit, and adheres to SOC 2 Type 2 standards.

Additional user-elected models: In the Exercise Designer, users may optionally select additional model families — Meta (Llama), Mistral AI, and Amazon (Nova) — which are accessed via OpenRouter. These providers process content only when a user elects the corresponding model; if not selected, no Client Data is sent to them. Mistral AI is based in the European Union; the others are U.S.-based.

Shared security measures

All AI providers implement enterprise-grade security measures, including industry-standard encryption for data at rest and in transit; strict role-based access controls; SOC 2 compliance and various ISO certifications; comprehensive audit logging; and independent third-party security assessments. Across all AI models, Preppr ensures limited retention, purpose limitation, no unauthorized training of models on customer data (unless explicitly agreed), secure encrypted transmission, and compliance with applicable data protection regulations.

Additional content providers

DeepGram: For audio data processed via DeepGram — which powers Preppr's voice features (speech-to-text and text-to-speech) — data and transcripts are retained temporarily to facilitate service delivery and improvement. Data usage for model training requires explicit customer consent. For further details, please refer to Deepgram's privacy policy.

Unstructured.io: For documents you upload during a live session or exercise (session documents), Preppr uses Unstructured.io's tools to parse and extract their content, in line with Unstructured.io's privacy practices. (Persistent Knowledge Base documents are processed within Preppr's own infrastructure rather than by Unstructured.io.) For further details, please refer to Unstructured.io's privacy policy.

AskNews/DeepNews: Preppr Intelligence is powered by an AskNews and DeepNews API integration, which is itself powered by Claude and other frontier models as needed. AskNews provides access to structured news data through APIs that enable advanced search for disaster-related information, and the DeepNews component performs deep research into news archives to support monitoring of geopolitical risk and event forecasting. This enhances Preppr's disaster-preparedness capabilities through real-time information monitoring, sentiment analysis, and geo-contextualized insights, while maintaining data isolation and privacy standards consistent with the rest of the application stack. AskNews does not store user data or content.

6. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in the United States and other countries.

Our servers, hosted by Amazon Web Services (AWS), are primarily located in the United States. Your information may be transferred to, stored, and processed in the United States and in other countries by Preppr and by the third-party service providers listed in Section 5. Where your information is transferred from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses described in Section 11.

[Verify with legal: confirm the actual processing locations of each listed subprocessor before publishing.]

7. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short: We are not responsible for the safety of information shared with third-party providers who are not affiliated with Preppr.

The Sites may include links to independent third-party websites and services not governed by this Policy. Preppr does not oversee, approve, or take responsibility for the accuracy or safety of external websites. You should independently review the privacy policies of any third-party providers.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as you have an active account, and for a 365-day retention period after suspension, except where longer retention is required or permitted.

·       Active Accounts: Personal information and Your Content are retained while your account remains active.

·       Suspended Accounts: Upon suspension, your data is retained for three hundred sixty-five (365) days to permit reactivation; after this period it is permanently deleted from our active systems.

·       Service-Improvement Data: Output Content and Contributor Content are retained indefinitely under an irrevocable license to improve our Services.

·       Backups: Where no legitimate business need exists, data is deleted or anonymized; otherwise it is securely isolated until deletion is possible.

·       Pilot Data Exception: Pilot Data is retained indefinitely and is excluded from standard deletion procedures (see Section 14).

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We employ security protocols to protect your personal information.

Preppr implements a combination of technical and organizational safeguards to defend against unauthorized access, alteration, or disclosure. These measures include data encryption (in transit and at rest using industry-standard protocols such as TLS 1.3 and AES-256), access restrictions, periodic security evaluations, and protected storage, with user data isolated and segregated between accounts. However, no security framework is entirely foolproof, and we cannot guarantee absolute security.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

Preppr does not intentionally gather information from individuals under eighteen years old. By accessing the Sites, you represent that you are at least eighteen, or that you are a parent or guardian consenting to a minor's use. If we learn that we have inadvertently collected information from a minor without parental approval, the associated account will be deactivated and the information will be promptly removed.

11. YOUR PRIVACY RIGHTS (EEA AND CALIFORNIA RESIDENTS)

GDPR Compliance for EEA Residents

Preppr is committed to GDPR principles for EEA residents' data, specifically:

·       Lawful Processing: We process data per GDPR Article 6, ensuring data use aligns with contractual needs, legal obligations, consent, or legitimate business interests.

·       Data Minimization: We collect only information necessary to fulfill Privacy Policy purposes.

·       Data Integrity and Confidentiality: We apply technical measures to ensure data confidentiality and integrity.

·       International Data Transfers: For data transfers outside the EEA, we use Standard Contractual Clauses (SCCs) and GDPR-compliant safeguards.

California Consumer Privacy Act (CCPA) for California Residents

California residents are entitled under the CCPA and California's “Shine the Light” law to:

·       Know and Access: Details about the personal information we collect, including categories and purposes.

·       Delete Personal Information: Request deletion, except where retention is legally required.

·       Non-Discrimination: Exercise privacy rights without facing discrimination.

Account Information

In Short: You may review or update your account information, and you may suspend or request immediate deletion of your account. These deletion rights do not apply to data collected during Pilot Activities.

If you would at any time like to review or change the information in your account, you can log in to your account settings and update your user account.

You may suspend your account at any time through your account settings. Suspending your account initiates the 365-day Retention Period described in Section 8, after which your personal information and “Your Content” will be automatically deleted from our active systems.

You also have the right to request the immediate deletion of your personal information and “Your Content,” as defined in our Terms of Service. You may submit this request in writing to connect@preppr.ai. Upon your request, we will delete your account, personal information, and “Your Content” from our active databases. However, we may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and/or comply with applicable legal requirements. As noted in Section 8, we retain “Output Content,” “Contributor Content,” and other derivative data to improve our Services.

Exception for Pilot Data: The deletion rights described in this section (both automatic and by request) do not apply to “Pilot Data” (as defined in our Terms of Service and described in Section 14). Preppr retains all Pilot Data indefinitely.

12. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We may use cookies, web beacons, tracking pixels, and other tracking technologies on our Sites. Cookies are small text files stored on your device. We use cookies for analytics (understanding user behavior for site improvement), personalization (customizing content), security (securing your account), and site management (maintaining functionality and navigation). Most browsers accept cookies by default, but you can adjust your settings to remove or reject cookies. Rejecting cookies may affect functionality.

13. DO WE MAKE UPDATES TO THIS POLICY?

Yes, we may update this Privacy Policy as necessary to comply with relevant laws or improve transparency. The latest version will be indicated by the Last Updated date and will be effective immediately upon posting.

14. PILOT ACTIVITIES

In Short: If you participate in a pilot or beta program, your data may be used for broader purposes, including publications, and is not subject to standard deletion requests.

If you participate in a “Pilot Activity,” “Beta,” “Preview,” or other evaluation program (“Pilot Services”) as defined in our Terms of Service, you agree that any data you submit or that is generated in connection with your participation (“Pilot Data”) is subject to different terms. By participating, you acknowledge and agree that:

·       Broad Use: Your Pilot Data (including “Your Content,” “Output Content,” and “Contributor Content”) may be used by Preppr for testing, evaluation, research, product development, marketing, and publication. This process may include manual or human review of your data.

·       Public Use: If Preppr uses Pilot Data for external publication or marketing, it will do so in an aggregated or anonymized form that does not personally identify you.

·       Exemption from Deletion: Pilot Data is not subject to the deletion rights or procedures described in Section 8 or Section 11. Preppr retains all Pilot Data indefinitely as per the license granted in our Terms of Service, even after your account is suspended or terminated.

All Pilot Data will otherwise be handled securely and in accordance with the confidentiality and security provisions of this Privacy Policy.

15. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have any questions, comments, or concerns about this Privacy Policy, please contact us by email at connect@preppr.ai or by mail at:

Preparedness Innovations, Inc.
232 Stagecoach Blvd
Evergreen, CO 80439
United States