Privacy Policy

Prentice is a platform that helps people in the UK prepare for and find apprenticeships, with practice interviews run by working professionals (“mentors”). This policy covers prenticehq.com and everything you do while signed in, whether you’re a student or a mentor.

For data protection law, the “data controller” — the party responsible for your personal data — is:

• Dominic Tigreros-Bosini, trading as Prentice
• Contact for anything about your data: [email protected]
• If you need a postal address for a formal request, email us and we’ll provide one.

This is the complete list. If something isn’t here, we don’t collect it.

Your account

Students

Mentors

Everyone, when you use these features

Things we generate or observe

What we never collect

We do not ask for or store your school, your address, your phone number, your exam results, or your National Insurance number. We never see or store your card number — Stripe handles that on its own page. We do not use third-party advertising or tracking scripts, and we do not run cross-site trackers.

There are no public profiles on Prentice, and nobody can look you up. These are the only places another person sees something about you.

In a mock interview or assessment centre

• A mentor sees a student’s first name and chosen pathway, and nothing else — not your surname, email, age, or anything you’ve saved. And of course your face and voice, during the call.
• A student sees the mentor’s full name, job title and employer.
• In an assessment centre, the other students in the group see your first name and you on video during the group exercise.
• There is no messaging between students and mentors, and contact details are never shared.
• The recording can be watched and downloaded by the student. Our safety team watches it only if the session is reported, or if we have to for safety or legal reasons.

Live event chats

• Your full name appears next to every message you send. Not a nickname or a handle. That is deliberate: it is what keeps the room civil, because what you say is attached to who you are. A tag next to it shows if you’re a host, a mentor, or on a paid plan.
• Everyone watching that event can read it. There is no private messaging, and nobody can click your name to find out anything else about you.
• The chat is never shown on the stream itself and is never part of the recording we publish afterwards.
• We can hide a message and stop an account posting. If we do, the message is hidden from everyone but we keep our own record of it, so there is evidence of what happened if it is ever needed.

Live CV reviews

• Anyone watching sees your first name and your place in the queue.
• The event’s hosts see your full name and can open your CV.
• If your CV is reviewed, it is shown on the live stream, which is public and published afterwards. The host covers your personal details by hand before showing it, and that covered-up version isn’t saved anywhere. Please remove anything you wouldn’t want seen before you send it, just in case.

UK GDPR requires us to have a specific lawful reason for each use. Ours:

Where we rely on legitimate interests, we’ve weighed our interest against your privacy, and taken the more private option each time it was available: our analytics are first-party with no persistent device identifier, our device records hold hashes and a coarse location rather than your IP address, we keep a fingerprint of a mentor’s ID rather than the ID, and recordings are deleted after a week. You can object to any legitimate interests processing — see section 9.

Most of the people using Prentice are between 13 and 18. We designed the service around that, following the ICO’s Age Appropriate Design Code.

The minimum age is 13

That’s the age at which you can consent to online services yourself in the UK. We ask for your date of birth while you set up your account, and we check it. Mentors must be 18 or over.

If you’re under 13

We can’t give you an account yet, and we’re honest about what happens next. We keep a deliberately minimal record so the block actually works: your email address, and the date you turn 13. We do not keep your date of birth.

We keep that record until the day you turn 13, then delete it, and you’re welcome to sign up. We’re keeping a small amount of information about a child in order to keep them out of a service that isn’t for them yet — if we deleted everything, you could sign up again a minute later with a different birthday, and the protection would be worthless.

If we’ve blocked you by mistake, email [email protected] and we’ll fix it.

What we do because our users are young

• No advertising, no ad targeting, and no selling of data.
• No third-party tracking scripts. Our analytics are first-party and never leave our own database.
• No public profiles. Nothing you save or pick is visible to other users.
• No private messaging on Prentice, between anyone.
• Mock interviews only happen on our own video, with ID-checked mentors who see your first name only, and they are recorded so there is always a record of what happened.
• No nudges to share more than you need to, and no “dark patterns” that make the private option harder to choose.
• Prices are shown before you buy, and if you’re under 18 we ask you to confirm a parent or guardian agrees.

For parents and carers

If you’re a parent or guardian and want to know what we hold about your child, ask them to email us from their account address, or contact us at [email protected]. We’ll need to be reasonably sure who we’re talking to before sharing anything, and where the young person is old enough to decide for themselves we’ll usually involve them in the request. If your child bought a plan without your agreement, contact us and we’ll sort it out with you.

We do not sell your personal data and we never will. Apart from the other people described in section 3, we share it only with the suppliers below, who process it on our instructions and cannot use it for their own purposes.

Stripe and Didit also have their own legal duties — for example to prevent fraud and money laundering — and for those they decide for themselves what to keep, under their own privacy policies.

We may also disclose data if the law requires it, to protect someone from harm, or as part of investigating a safeguarding concern, which can include sharing a session recording with the police. If we ever transfer the business, we’d tell you before your data moved.

We use no advertising cookies and no analytics cookies, which is why you haven’t been asked to dismiss a cookie banner. Everything below is strictly necessary to make the site work or is stored only in your own browser.

You can clear browser storage at any time through your browser settings. Clearing the sign-in cookie will simply sign you out.

When you delete your account

Your profile, date of birth, saved employers and apprenticeships, bookings, scores and feedback, session recordings, AI practice history, CVs sent to events, plan and credits, notifications, device records, confirmation tokens, and analytics events are deleted. It is immediate and irreversible — there’s no grace period and no backup copy we can restore from, so please be sure. If you’re on a paid plan, it’s cancelled at the same moment.

A few things survive, and it’s worth being plain about each:

• Payment records. The amounts and dates of your payments stay in our books, with your account removed from them, and your customer record and invoices stay at Stripe. The law requires both for 6 years after the end of the tax year they belong to, and then we delete them, including your customer record at Stripe. Mentor earnings and payouts are the same.
• Safeguarding records. If a message you sent was reported, our copy of that report stays for the period above. Deleting your account cannot erase a record of something you said to someone else — that would make the report useless to the person who made it.
• A mentor’s sessions. If a mentor deletes their account, the sessions they ran stay in their students’ history, with the mentor removed, and those recordings are deleted on the normal 7 days clock.
• A removed mentor’s ID fingerprint, as above.
• Two bare counts with no user ID attached: that an account was deleted, and that someone was blocked for being under 13.

Under UK data protection law you have the rights below, free of charge. We respond within one month.

• Access. Get a copy of what we hold about you. Email us and we’ll send it.
• Correction. Fix anything wrong. Most details can be edited under Account; for anything else, email us and we’ll change it.
• Deletion.Have your data erased. You can do this yourself: Account → Profile → Delete account. If you have a session booked, you’ll be asked to cancel it first, because someone else is relying on it.
• Portability. Receive your data in a machine-readable format, or have us send it somewhere else.
• Restriction. Ask us to pause using your data while a dispute is sorted out.
• Objection. Object to anything we do on the basis of legitimate interests, including our analytics and optional emails.
• Withdraw consent. Where we rely on consent, withdraw it at any time.

To use any of these, email [email protected] from the address on your account. We may ask a question or two to check it’s really you — we’re not being awkward, we just won’t hand your data to someone pretending to be you.

AI feedback

AI video interview practice is scored by computers: Deepgram turns your answer into text, and Google’s Gemini writes the scores and feedback from that text alone — it never gets your name, your voice or your video. The feedback is for you. It isn’t shown to anyone else, and nothing about your account is ever decided from it.

The CV Builder’s AI review works the same way: Gemini reads the text of your CV with your contact details removed, and leaves comments for you. If you ask for a mentor review (Max), the mentor sees your first name and a copy of your CV without your contact details.

Automatic rules

A few things happen automatically, all of them rules set out in our Terms rather than judgements about you:

• If your date of birth says you’re under 13, the account is blocked until you’re old enough.
• After a session, we work out who joined from the call records. A no-show moves credits or pay, and a mentor no-show adds a strike.
• Three strikes in 90 days closes a mentor account. A mentor whose ID check fails, or whose document belongs to a removed mentor, can’t be approved.
• Unused monthly credits expire at the end of the month.

If one of these has gone wrong for you, tell us and a person will look at it.

No advertising

We use the career path and employers you choose to decide which apprenticeships to show you. That’s you telling us your preferences, not us inferring things about you from your behaviour, and you can change it whenever you like. We do not advertise on Prentice, we do not allow third parties to advertise to you here, and we do not build audience segments or share data for marketing.

• Everything travels over HTTPS, and your password is stored only as a hash. We can never see it.
• Our database enforces row-level security, so one account cannot read another’s data even if something else goes wrong.
• Sensitive tables — device records, confirmation tokens, analytics, payment records, ID fingerprints — are not reachable from the browser at all. Only our server can touch them.
• Session video rooms are private, open only at the session time, and only to the people booked into them. Recording download links are created on request and expire.
• Confirmation links and password resets are single-use and expire.
• You can sign out of every device at once from Account → Security.

No system is perfectly secure. If a breach ever puts you at risk, we’ll tell you, and we’ll report it to the ICO within 72 hours as the law requires.

We prefer UK and EU hosting, and choose it where our suppliers offer it — our email provider processes data in Ireland for that reason.

Some of our suppliers are based in the United States. Where personal data leaves the UK, we rely on the safeguards UK law recognises — either the UK extension to the EU–US Data Privacy Framework, or an International Data Transfer Agreement with the supplier. We don’t transfer data anywhere without one of those in place.

If you want to know exactly where a specific piece of your data is stored, email [email protected] and we’ll tell you.

When we change this policy we’ll update the date at the top. If a change materially affects you — new kinds of data, a new purpose, a new supplier receiving your information — we’ll email you before it takes effect, and we’ll explain it in plain language rather than pointing you at a diff.

For anything about your data, email [email protected]. For everything else, [email protected].

If we get it wrong, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113. Complaining to them doesn’t cost anything and you don’t have to come to us first.