Do Not Sell or Share My Personal Information

1. Summary — we do not sell or share

StudyBuddyAI does not sell personal information for money or other valuable consideration, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA.

We do not operate any advertising technology, we do not run cross-site or cross-app tracking, and we do not sell, rent, or trade personal information to data brokers or other third parties.

Because we do not sell or share, your opt-out is effectively already honoured for every user, by default. You do not need to do anything. You may still send us a request to confirm this or to exercise your other California privacy rights (see below).

2. What “sell” and “share” mean under California law

California law defines these terms in a specific, technical way:

• “Sell” / “sale” means disclosing personal information to a third party in exchange for money or other valuable consideration.
• “Share” / “sharing” means disclosing personal information to a third party for cross-context behavioural advertising (advertising targeted to a consumer based on personal information obtained from their activity across businesses, websites, or apps), whether or not money changes hands.

Importantly, disclosing personal information to a service provider or processor that handles it on our behalf, under a written contract and only to operate the service, is not a “sale” or a “share” under California law. The next section explains the only kind of disclosure we make.

3. What we actually do — service providers only

The only third parties we disclose personal information to are our service providers (also called processors): companies that host our infrastructure, process payments, route AI requests, and send transactional email. They are contractually bound to use the information only to provide their service to us, and they may not sell it, share it for advertising, or use it for their own purposes.

Examples of these service providers include our database/hosting provider (Supabase), our application hosting and content-delivery provider (Vercel), our AI model-routing provider (OpenRouter), our payment processor and merchant of record (Paddle), our transactional email provider (Resend), our DNS and inbound-email routing provider (Cloudflare), our support-inbox provider (Google/Gmail), and our email-delivery sub-processor (Amazon SES).

These relationships are service-provider relationships, not sales or shares. For the full list of service providers, the data each one receives, and links to their privacy policies, see the “AI processing and third-party processors” section of our Privacy Policy at /privacy.

4. Your California privacy rights

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to know — to request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom it is disclosed.
• Right to delete — to request that we delete personal information we collected from you, subject to legal exceptions.
• Right to correct — to request that we correct inaccurate personal information we hold about you.
• Right to opt out of the sale or sharing of personal information — though, as explained above, we do not sell or share, so there is nothing to opt out of.
• Right to limit the use and disclosure of sensitive personal information — we do not use or disclose sensitive personal information for purposes that would trigger this right (we use it only to provide the service and as otherwise permitted without an opt-out).
• Right to non-discrimination — we will not deny you service, charge you a different price, or provide a different level of quality because you exercised any of these rights.

5. How to exercise your opt-out or submit a request

Because we do not sell or share personal information, your opt-out is already honoured by default and no action is needed on your part.

If you would still like written confirmation, or you want to exercise any of your other California rights (to know, delete, or correct), email us at support@getstudybuddyai.com with your request. We will verify that you are the person the information relates to (for example, that you control the account) before acting, and we will respond within the time required by California law (generally 45 days, extendable where permitted).

Global Privacy Control (GPC): we honour opt-out preference signals such as the Global Privacy Control where they apply. Because we do not sell or share personal information, there is no sale or share for such a signal to stop — but we treat any GPC signal as a valid opt-out request and there is nothing further you need to do.

6. Authorized agents

You may use an authorized agent to submit a request on your behalf. We may ask the agent for proof that you gave them signed permission to act for you, and we may ask you to verify your own identity directly with us or to confirm that you authorised the agent. Send authorized-agent requests to support@getstudybuddyai.com.

7. Children

StudyBuddyAI is set up and managed by a parent or legal guardian, and a child's information is provided and controlled by the parent. Under COPPA, an operator must obtain verifiable parental consent before disclosing a child's personal information to third parties (and, under the 2025 amended Rule, separate consent before sharing it for purposes such as targeted advertising). Separately, under California's CCPA/CPRA we may not sell or share the personal information of a consumer under 16 without affirmative opt-in consent. We do not sell or share any user's personal information, including any child's.

A parent exercises a child's California privacy rights on the child's behalf using the same contact method described above.

8. Contact us

Questions or requests about this notice: support@getstudybuddyai.com.

For more detail on how we collect, use, and protect personal information, see our Privacy Policy at /privacy.