Privacy Policy

This Privacy Policy ("Policy") governs the collection, use, storage, and disclosure of personal information by My Depo Prep, LLC, an Ohio limited liability company ("My Depo Prep," "we," "us," or "our"), in connection with your access to and use of our website located at mydepoprep.com, go.mydepoprep.com, and app.mydepoprep.com (collectively, the "Website"), our deposition preparation training platform and related services (the "Platform"), and all associated services, features, content, and applications (collectively, the "Services").

1.1 Agreement to Terms. By accessing or using any part of our Services, you ("you," "your," "User," "Attorney," or "Client") expressly acknowledge that you have read, understood, and agree to be bound by this Policy and our Terms of Service, which are incorporated herein by reference. If you do not agree to this Policy, you must immediately discontinue use of our Services.

1.2 Capacity and Authority. By using our Services, you represent and warrant that: (a) you are at least 18 years of age and have the legal capacity to enter into binding contracts; (b) if you are using the Services on behalf of a law firm or legal organization, you have the authority to bind that entity to this Policy; (c) all information you provide is accurate, complete, and current; and (d) your use of the Services complies with all applicable federal, state, and local laws and regulations.

1.3 Modifications. We reserve the right, in our sole and absolute discretion, to modify, amend, or replace this Policy at any time. Material changes will be notified through email, platform notification, or posting on our Website. Your continued use of the Services following notice of changes constitutes acceptance of the modified Policy. It is your responsibility to review this Policy periodically.

1. Identifiers and onboarding data. You provide us information about yourself when you register for and/or use the Service. For example: age, gender, name, data on financial status (including your questions regarding financial mindset), email address.
2. Commercial information. When you make payments through the Service, you need to provide financial account data, such as your credit card number, to our third-party service providers that serve us as data and payments processors. We do not collect or store, or have access to full credit card number data, though we may receive some limited information, including credit card-related data (including a secure token reflecting your payment method), data about products or services purchased, date, time and amount of the purchase, the type of payment method used, limited digits of your card number.
3. Comments you provide with your requests. You may also provide us with some personal information using our "Contact us" forms or by sending emails on our email addresses (including by the means of our data processors referenced as Communication services providers in Section 4). This information may include any comments you log in when you send your inquiry.

Data we collect automatically:

2.1. Data about how you found us. We collect data about your referring URL (that is, the place on the Web where you were when you tapped on our ad).

2.2. Device and Location data. We collect data from your device. Examples of such data include: language settings, IP address, time zone, type and model of a device, device settings, operating system and its version.

2.3. Usage data. We record how you interact with our Service. For example, we log your taps/clicks on certain areas of the interface, the features, and content you interact with, how often you use the Service, how long you are in the Service, and your subscription orders. We also record the ads in our Website with which you interact (and the Internet links to which those adds lead).

2.4. Transaction data. When you make payments through the Service, you need to provide financial account data, such as your credit card number, to our third-party service providers. We do not collect or store full credit card number data, though we may receive credit card-related data, data about the transaction, including: date, time and amount of the transaction, the type of payment method used.

2.5. Cookies and similar tracking technologies. Our products employ technologies (cookies, SDKs, etc.) to process your data to enhance your user experience, optimize ads, and analyze traffic. These technologies are activated when you interact with our services, visit our website, use our apps, or enable certain features like chats. Disabling these technologies may affect the functionality of certain features, although our products will remain usable.

A cookie is a small text file that is stored on a user's computer for record-keeping purposes. Cookies can be either session cookies or persistent cookies. A session cookie expires when you close your browser and is used to make it easier for you to navigate our Service. A persistent cookie remains on your hard drive for an extended period of time. We also use tracking pixels that set cookies to assist with delivering online advertising.

Cookies are classified by origin:

• First party cookies are set by our websites under domain and sub-domains;
• Third party cookies are cookies used within our Services which are set by other organizations. These include cookies from external services which help us to protect our site and provide extra services (customer support portal, online web chat etc.).

Cookies are used, in particular, to automatically recognize you the next time you visit our Website. As a result, the information, which you have earlier entered in certain fields on the Website may automatically appear the next time when you use our Service. Cookie data will be stored on your device and most of the times only for a limited time period.

We respect your right to privacy and provide you with the option not to allow data processing that is not required for providing you the services you request.

We do not knowingly collect or process personal data from persons under 18 years of age. If you learn that anyone younger than 18 has provided us with personal data, please contact us through support@mydepoprep.com.

The Terms of Service is a legally binding contract which is the basis for data processing.

See lawful basis in Section 3 above for additional information.

We share information with third parties that help us operate, provide, improve, integrate, customize, support, and market our Service. We may share some sets of personal data, in particular, for purposes indicated in Section 3 of this Privacy Policy.

The types of third parties we share information with include, in particular:

Service Providers

We share personal data with third parties that we hire to provide services or perform business functions on our behalf, based on our instructions. We share your personal information with the following types of service providers:

• Hosting and infrastructure (Vercel). Vercel provides the hosting, content delivery, and serverless infrastructure that runs our Website and Platform.
• Database and authentication (Supabase). Supabase hosts our application database (invite and matter metadata and the audit log) and manages account authentication (including passkeys and password fallback). Client and attorney video recordings are not stored in our database — only structural metadata (identifier, status, the question, scheduled-deletion time). No transcripts or recording content are stored.
• Video hosting and playback (Cloudflare Stream). Client video answers and attorney-recorded videos are uploaded directly from the browser to Cloudflare Stream and played back only through short-lived (1-hour), server-authorized signed URLs scoped to the owning attorney. The application server never receives or stores the video bytes; Cloudflare encrypts them at rest.
• Payment processing (Stripe). Stripe processes purchases of client invites. We do not store full payment card numbers; card data is provided directly to Stripe.
• Transactional email delivery (Postmark). Postmark delivers transactional emails such as account verification, deposition invitations, and security notifications.
• Error monitoring and diagnostics (Sentry). Sentry collects application error reports and performance diagnostics to help us detect, troubleshoot, and fix technical issues.

Law Enforcement Agencies and Other Public Authorities

We may use and disclose personal data to enforce our Terms and Conditions, to protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others, and to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, or in other cases provided for by law.

Third Parties as Part of a Merger or Acquisition

As we develop our business, we may buy or sell assets or business offerings. Customers' information is generally one of the transferred business assets in these types of transactions. We may also share such information with any affiliated entity (e.g. parent company or subsidiary) and may transfer such information in the course of a corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

The right to data portability. If you wish to receive your personal data in a machine-readable format, you can send respective request through support@mydepoprep.com.

To exercise any of the available to you privacy rights, please send a request through support@mydepoprep.com.

To contact us, you may send an e-mail directly to support@mydepoprep.com.

For a description of the third-party service providers with whom we share personal information, and the purposes of that sharing, see Section 5 (Information Sharing) above.

For information about the cookies and similar tracking technologies we use, how they are classified, and the period for which cookie data is stored, see Section 2.5 (Cookies and similar tracking technologies) above. For information about controlling cookies and personalized advertising, see Section 10 (Your Privacy Rights) below.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include encryption in transit (TLS) and at rest, scoped access controls, firm-level data isolation enforced at the database with Row-Level Security, and ongoing monitoring of our systems. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

Client video recordings receive heightened protection: they are stored on Cloudflare Stream, encrypted at rest, and accessible only through short-lived signed URLs scoped to the owning attorney, with every playback-token issuance written to an append-only audit log. No video content, transcript, or recording is ever sent to any artificial-intelligence or large-language-model service.

We will store your personal data for as long as it is reasonably necessary for achieving the purposes set forth in this Privacy Policy (including providing the Service to you), which includes (but is not limited to) the period during which you have an account with the App. We will also retain and use your personal data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. For example, under certain accounting and tax laws we are required to store Commercial Information for long periods of time to comply with laws we are subject to. Therefore, even if you submit a data deletion request, a small portion of the data that relates to our compliance obligations will be stored even after the request is satisfied.

We apply data minimization, holding the least data necessary for the shortest time that serves the client's deposition preparation. The most sensitive data — client video recordings — is the most aggressively minimized. Specific retention periods are:

• Client video answers (a client's recorded responses): deleted 24 hours after the deposition date, with a 14-day fallback if no date is set.
• Client welcome / attorney-recorded videos: deleted 7 days after the deposition date.
• Audit logs: 90 days.
• Rate-limit records: 7 days.
• Client training-progress (tracking) events: 1 year.
• Invites and matter metadata (client name, email, matter reference, deposition details): retained for the engagement and removable on request.
• Billing records (charges, receipts, Stripe references; no card numbers): retained per financial-record norms (approximately 7 years).
• Attestations (signed attorney and client acknowledgments): retained as the legal record of consent and review.

Deletion of client video recordings is verified — a recording is marked deleted only after our video subprocessor confirms the asset is gone, and the deletion is retried on failure. For a fuller description of our data-handling posture, see our Data Retention page.

To be in control of your personal data, you have the following rights:

Accessing / reviewing / updating / correcting your personal data. You may request a copy of your personal data and request us to update/correct your personal data collected during your use of the Service through support@mydepoprep.com. Attorneys can also export their invite and receipt history as a CSV file directly from the app at any time; each export is recorded in our audit log.

Deleting your personal data. You can request erasure of your personal data by sending us an email through support@mydepoprep.com. When you request deletion of your personal data, we will use reasonable efforts to honor your request. In some cases we may be legally required to keep some of the data for a certain time; in such event, we will fulfill your request after we have complied with our obligations.

Objecting to or restricting the use of your personal data. You can ask us to stop using your personal data or limit our use. For example:

Email marketing: we provide you with the ability to unsubscribe from email marketing communication by following the unsubscribe link in every email or by contacting our support team.

E-privacy settings: we also bring EU privacy features to customers worldwide and allow you to influence the tracking decision on a granular per purpose level (this is available by interacting with the e-Privacy settings section that is usually located in the footer, menu, or profile sections of our products).

If you are based in the EEA, you have the right to lodge a complaint with supervisory authority. We would love you to contact us directly, so we could address your concerns. Nevertheless, you have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU Member State where you reside, work or where the alleged infringement has taken place.

How to opt out or influence personalized advertising

IOS: On your iPhone or iPad, go to "Settings," then "Privacy" and tap "Advertising" to select "Personalized Ads". In addition, you can reset your advertising identifier (this also may help you to see less of personalized ads) in the same section.

Android: To opt-out of ads on an Android device, simply open the Google Settings app on your mobile phone, tap "Ads" and enable "Opt out of interest-based ads". In addition, you can reset your advertising identifier in the same section (this also may help you to see less of personalized ads).

macOS: On your MacBook, you can disable personalized ads: go to System Preferences > Security & Privacy > Privacy, select Apple Advertising, and deselect Personalized Ads.

Windows: On your laptop running Windows 10, you shall select Start > Settings > Privacy and then turn off the setting for Let apps use advertising ID to make ads more interesting to you based on your app activity. If you have other Windows version, please follow the steps here.

To learn even more about how to affect advertising choices on various devices, please look at the information available here. In addition, you may get useful information and opt out of some interest-based advertising, by visiting the following links:

• Network Advertising Initiative – http://optout.networkadvertising.org/
• Digital Advertising Alliance – http://optout.aboutads.info/
• Digital Advertising Alliance (Canada) – http://youradchoices.ca/choices
• Digital Advertising Alliance (EU) – http://www.youronlinechoices.com/

We value your right to influence the ads that you see, thus we are letting you know what service providers we use for this purpose and how some of them allow you to control your ad preferences.

We use Meta pixel on the Service. Meta pixel is a code placed on the Service collecting data that helps us track conversions from Meta Ads, build targeted audience and remarket to people who have taken some actions on the Service (for example, made a purchase).

We may transfer personal data to countries other than the country in which the data was originally collected in order to provide the Service set forth in the Terms and Conditions and for purposes indicated in this Privacy Policy. If these countries do not have the same data protection laws as the country in which you initially provided the information, we deploy special safeguards.

In particular, if we transfer personal data originating from the EEA to countries with not adequate level of data protection, we use one of the following legal bases: (i) Standard Contractual Clauses approved by the European Commission (details available here), or (ii) the European Commission adequacy decisions about certain countries (details available here).

We do not allow children to use any MDP Service. We do not knowingly collect or process personal data from persons under 18 years of age. If you learn that anyone younger than 18 has provided us with personal data, please contact us through support@mydepoprep.com.

From time to time we update this Privacy Policy. When we make material changes, we will notify active firm accounts by email. We may consolidate changes and send a single, periodic notice covering all updates made during that period, rather than a separate notice for each change. Your continued use of the Services after we provide notice constitutes your acceptance of the updated Policy.