Privacy Policy

1. Who we are

StudyBuddyAI ("we", "us", "our") is operated by Raz Cohen, an individual (a sole operator, not a company). We are the controller of the personal information described in this policy. You can reach us at support@getstudybuddyai.com.

Data protection contact: Raz Cohen, support@getstudybuddyai.com. No Data Protection Officer has been appointed because our processing does not meet the GDPR Article 37 triggers (no large-scale special-category processing or systematic monitoring). We are assessing whether an EU/UK Article 27 representative is required and will appoint one where it is — that obligation depends on the nature of our processing, not on operator size.

2. A note for parents and guardians

StudyBuddyAI is intended to be set up and managed by an adult parent or legal guardian. Children do not register, log in with their own email, or enter payment information.

The parent account holder provides the information about each child, chooses the subjects and topics the child can use, and can pause or remove the child. Homework, practice, and mini-chat are part of the account, not separate switches for one child. From the parent dashboard the parent can review homework and practice. Mini-chat is not shown there.

Because the parent provides and controls the child's information, the parent is responsible for the accuracy of that information and for supervising the child's use of the service.

3. Information we collect

Information the parent provides

• Parent account details: name, email address, and a password. Our authentication provider stores the password as a hash.
• Consent records: the fact, time, and policy version of the parental consent and any marketing opt-in you give.
• Billing details: your subscription plan and the customer/subscription identifiers from our payment provider. Card and payment details are handled directly by our payment provider — we never receive or store full payment card numbers.
• Support communications: messages you send us and any access-request information you submit.

Information about each child (provided by the parent)

• Child profile: first name (or nickname), grade level, subjects, and optional interests, support needs, and a free-text learning note.
• Child sign-in: a parent-issued link, stored so the parent can copy it again. The session cookie is signed.
• Study activity: study and homework sessions, the messages exchanged with the AI tutor, answers, scores, accuracy, and progress over time.
• AI-generated learning content: summaries and insights about a child's strengths and areas to work on, generated to help the parent.

Note: we do not collect a child's date of birth or precise age

We use grade level (not date of birth) to tailor the tutor. We do not ask children for their address, phone number, or other contact details, and we ask parents not to put sensitive personal information in free-text fields.

Information we collect automatically

• Technical and log data. Our hosting provider keeps its own logs. We also store the IP address in our database for about a day to prevent abuse, and for a flagged account we store the browser and path for up to 30 days.
• Cookies and similar technologies — see our Cookie Policy. We do not run advertising or cross-site tracking, and any analytics cookies are set only if you opt in.

4. How we use information

• To provide the service: create accounts, authenticate parents and child sessions, run study and homework sessions, and generate AI tutoring responses.
• To personalise learning: calibrate the tutor to a child's grade, subjects, interests, and progress.
• To show parents progress: produce dashboards, summaries, and insights about a child's learning.
• To keep the service safe: apply content moderation to child input and AI output, prevent abuse, and investigate safety or security issues.
• To process payments and manage subscriptions through our payment provider.
• To communicate with you: send transactional messages (verification codes, invites, account and security notices) and, only if you opt in, occasional product or marketing emails.
• To comply with our legal obligations and enforce our Terms.

5. Legal bases (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR/UK GDPR:

• Performance of a contract — to provide the service you sign up for.
• Consent — for the processing of a child's information (given by the parent), for the opt-in analytics tools named in the Cookie Policy, and for marketing emails. You may withdraw consent at any time. That consent does not cover the chat logs, quota records, or flagged activity described below.
• Legitimate interests — to secure the service, prevent abuse, and improve reliability, balanced against your rights.
• Legal obligation — to comply with applicable law.

6. Parental consent and children's privacy

StudyBuddyAI is designed for use by children under the direction of a parent or guardian, and we treat children's data as sensitive.

Before a parent adds a child or the child uses the service, the parent must confirm that they are the child's parent or legal guardian and accept this Privacy Policy and our Terms. We record the time and policy version of that consent.

The account holder confirms by checkbox that they are at least 18 and the parent or guardian. We store the time and the policy version of that confirmation. We do not check an identity document or a payment name, and adding a child does not ask again.

Consistent with COPPA, the parent provides consent for and controls the child's personal information and may review it, direct its deletion, or refuse its further collection or use (16 CFR 312.6). Where we rely on consent under the GDPR for a child, Article 8 requires that consent be given or authorised by the holder of parental responsibility. A parent may exercise these rights at any time (see 'Your rights and choices').

We collect from a child only the information needed to provide the tutoring service, and we do not condition a child's participation on disclosing more than is reasonably necessary.

If you believe a child has provided us information without the appropriate parental consent, contact us at support@getstudybuddyai.com and we will delete it.

7. AI processing and third-party processors

To generate tutoring responses, we send the content you and your child enter — the child's messages to the tutor and the learning context that goes with them (such as first name, subjects, interests, recent progress, support needs, and the learning note) — to third-party AI providers for processing. We send the minimum reasonably necessary for the feature to work.

Please read this plainly: the content entered into the Service, including a child's messages, is shared with these external AI providers and may be used by them under their own terms. The providers behind those models may retain the content sent to them and use it for their own purposes, including to train and improve their AI models. We do not use your or your child's information to train our own models, but we do not control how these third-party providers use the content we send them. Because of this, please do not enter sensitive personal information or real identifying details (such as full names, contact details, or location) into messages to the tutor.

We may change AI providers in the future; if we do, we will update this policy to reflect the change.

We share personal information with the service providers below, who process it on our behalf under contract and only for the purposes described:

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

If we add or change a service provider (sub-processor) that processes a child's personal information in a material way, we will update the list above and, where appropriate, notify the parent account holder before the change takes effect so you can review it.

8. Safety and quality monitoring

The checker runs on study chat, mini-chat, homework replies, and generated practice questions. A typed practice answer and the practice-target reasons are not checked. If the checker errors or returns nothing usable, a typed message is allowed through. A model reply is held back when the checker throws, and is allowed through when the checker returns nothing usable. No filter is perfect, and parental supervision remains necessary.

A child's messages and the model's replies are stored for about 30 days for every account. The learning profile and the parent's note stay hidden unless the account is flagged. The flag does not decide whether the conversation is stored. Those copies are removed by a daily job after about 30 days.

Session history that a parent can open covers homework and practice. Mini-chat is not shown to the parent. It remains in that 30-day operator log only.

9. How long we keep information

• Account and child profile data: kept while your account is active.
• Study sessions, homework, and practice that a parent can review: kept while the child is on the account, and deleted when you delete the child or your account.
• Stored messages and model replies, and flagged page views, clicks, browser, and path: kept for about 30 days while the child remains, and deleted by the same daily job. Deleting the child deletes that child's copies sooner.
• Staff notes: kept until the note or the account is deleted. Chat is not pasted into the note.
• Token and cost rows: kept as quota records. They have no message text. If the child is deleted, the row stays with no child attached.
• Anonymous daily counts: kept. They have no user attached.
• Our subscription rows: deleted with the account. Paddle keeps the tax invoice.
• Unfinished signups: deleted after 7 days when payment never completes an account.
• Backups: residual copies may persist in encrypted backups for a limited period after deletion before being overwritten.

When a parent deletes a child, we delete that child's profile, study data, stored messages, and flagged activity. Thirty days is the longest those message copies last while the child is still on the account.

When a parent deletes their account, we cancel the Paddle subscription so billing stops, and we delete our own subscription rows. Paddle keeps the tax record. We also delete the account and its children. Short leftovers can remain: up to a day of abuse-prevention keys, an admin audit entry of the change, and an unfinished signup until a 7-day delete. An unfinished signup that never becomes an account is deleted after 7 days.

10. How we share information

We share personal information only as follows:

• With the service providers (processors) listed above, to operate the service.
• To comply with law, respond to lawful requests, or protect the rights, safety, and security of our users (especially children), the public, or us.
• In connection with a merger, acquisition, or sale of assets — in which case we will require the recipient to honour this policy, and we will notify you of any change in control of your information.

We do not sell personal information, and we do not share it for advertising.

11. International data transfers

We and our providers operate in several countries, so your information may be processed outside your home country, including in Singapore, the United States, the United Kingdom, and the European Union.

Where we transfer personal information internationally, we put in place appropriate safeguards under Article 46 of the GDPR — typically the European Commission's Standard Contractual Clauses (and the UK IDTA) — or, for recipients in the United States that are certified under the EU-US Data Privacy Framework, we rely on that framework.

12. Your rights and choices

Depending on where you live, you (and, for a child, the parent on the child's behalf) have rights over personal information, which may include the right to access, correct, delete, export/port, restrict or object to processing, and withdraw consent.

How to exercise your rights

You can edit much of your information directly in the app, and you can request deletion of your account from your settings. For any rights request — including access, a copy/export of your data, correction, or deletion — email us at support@getstudybuddyai.com. We will verify your request (for example, that you control the account) and respond within the time required by applicable law (generally within one month under GDPR (extendable by two further months), or 45 days under California law, extendable where permitted).

California (CCPA/CPRA)

California residents have the right to know, delete, and correct personal information, and to opt out of the 'sale' or 'sharing' of personal information. We do not sell or share personal information as those terms are defined, and we do not use or disclose sensitive personal information for purposes that require an opt-out. You may still exercise your choice via our 'Do Not Sell or Share My Personal Information' page. We will not discriminate against you for exercising your rights.

Complaints

If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority. We'd appreciate the chance to address your concern first.

13. Security

We use technical and organisational measures to protect personal information, including encryption in transit, hashing of passwords, a signed child session cookie, access controls and row-level data isolation between families, and restricted administrative access.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the effective version shown at the top and, where appropriate, notify you or ask the parent to re-confirm consent.

15. Contact us

Questions, requests, or concerns: support@getstudybuddyai.com.