Privacy Policy

1. Who we are

StudyBuddyAI ("we", "us", "our") is operated by Raz Cohen, an individual (a sole operator, not a company). We are the controller of the personal information described in this policy. You can reach us at support@getstudybuddyai.com.

If you have any questions about this policy or your personal information, contact us at support@getstudybuddyai.com.

Data protection contact: Raz Cohen, support@getstudybuddyai.com. No Data Protection Officer has been appointed because our processing does not meet the GDPR Article 37 triggers (no large-scale special-category processing or systematic monitoring). We are assessing whether an EU/UK Article 27 representative is required and will appoint one where it is — that obligation depends on the nature of our processing, not on operator size.

2. A note for parents and guardians

StudyBuddyAI is intended to be set up and managed by an adult parent or legal guardian. Children do not register, log in with their own email, or enter payment information.

The parent account holder provides the information about each child, decides which subjects and features the child can use, can pause a child's access at any time, and can review the child's activity from the parent dashboard.

Because the parent provides and controls the child's information, the parent is responsible for the accuracy of that information and for supervising the child's use of the service.

3. Information we collect

Information the parent provides

• Parent account details: name, email address, and a password (stored only in hashed form by our authentication provider).
• Consent records: the fact, time, and policy version of the parental consent and any marketing opt-in you give.
• Billing details: your subscription plan and the customer/subscription identifiers from our payment provider. Card and payment details are handled directly by our payment provider — we never receive or store full payment card numbers.
• Support communications: messages you send us and any access-request information you submit.

Information about each child (provided by the parent)

• Child profile: first name (or nickname), grade level, subjects, and optional interests, support needs, and a free-text learning note.
• Child login credentials: a parent-issued sign-in link and/or PIN, stored only in hashed/signed form.
• Study activity: study and homework sessions, the messages exchanged with the AI tutor, answers, scores, accuracy, and progress over time.
• AI-generated learning content: summaries and insights about a child's strengths and areas to work on, generated to help the parent.

Note: we do not collect a child's date of birth or precise age

We use grade level (not date of birth) to tailor the tutor. We do not ask children for their address, phone number, or other contact details, and we ask parents not to put sensitive personal information in free-text fields.

Information we collect automatically

• Technical and log data such as IP address, device/browser type, and pages or features used, collected by our hosting provider to operate and secure the service.
• Cookies and similar technologies — see our Cookie Policy. We do not run advertising or cross-site tracking, and any analytics cookies are set only if you opt in.

4. How we use information

• To provide the service: create accounts, authenticate parents and child sessions, run study and homework sessions, and generate AI tutoring responses.
• To personalise learning: calibrate the tutor to a child's grade, subjects, interests, and progress.
• To show parents progress: produce dashboards, summaries, and insights about a child's learning.
• To keep the service safe: apply content moderation to child input and AI output, prevent abuse, and investigate safety or security issues.
• To process payments and manage subscriptions through our payment provider.
• To communicate with you: send transactional messages (verification codes, invites, account and security notices) and, only if you opt in, occasional product or marketing emails.
• To comply with our legal obligations and enforce our Terms.

5. Legal bases (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR/UK GDPR:

• Performance of a contract — to provide the service you sign up for.
• Consent — for the processing of a child's information (given by the parent), for any non-essential cookies/analytics, and for marketing emails. You may withdraw consent at any time.
• Legitimate interests — to secure the service, prevent abuse, and improve reliability, balanced against your rights.
• Legal obligation — to comply with applicable law.

6. Parental consent and children's privacy

StudyBuddyAI is designed for use by children under the direction of a parent or guardian, and we treat children's data as sensitive.

Before a parent adds a child or the child uses the service, the parent must confirm that they are the child's parent or legal guardian and accept this Privacy Policy and our Terms. We record the time and policy version of that consent.

Consistent with COPPA, the parent provides consent for and controls the child's personal information and may review it, direct its deletion, or refuse its further collection or use (16 CFR 312.6). Where we rely on consent under the GDPR for a child, Article 8 requires that consent be given or authorised by the holder of parental responsibility, and we make reasonable efforts to verify it. A parent may exercise these rights at any time (see 'Your rights and choices').

We collect from a child only the information needed to provide the tutoring service, and we do not condition a child's participation on disclosing more than is reasonably necessary.

If you believe a child has provided us information without the appropriate parental consent, contact us at support@getstudybuddyai.com and we will delete it.

7. AI processing and third-party processors

To generate tutoring responses, we send the content you and your child enter — the child's messages to the tutor and the learning context that goes with them (such as first name, grade, subjects, interests, and recent progress) — to third-party AI providers for processing. AI requests are currently routed through OpenRouter to the underlying model providers. We send the minimum reasonably necessary for the feature to work.

Please read this plainly: the content entered into the Service, including a child's messages, is shared with these external AI providers and may be used by them under their own terms. We currently use free-tier AI models, and the providers behind those models may retain the content sent to them and use it for their own purposes, including to train and improve their AI models. We do not use your or your child's information to train our own models, but we do not control how these third-party providers use the content we send them. Because of this, please do not enter sensitive personal information or real identifying details (such as full names, contact details, or location) into messages to the tutor.

We may change AI providers in the future, or move to paid or no-training model tiers; if we do, we will update this policy to reflect the change.

We share personal information with the service providers below, who process it on our behalf under contract and only for the purposes described:

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

If we add or change a service provider (sub-processor) that processes a child's personal information in a material way, we will update the list above and, where appropriate, notify the parent account holder before the change takes effect so you can review it.

8. Safety and quality monitoring

To keep children safe and to debug problems, the service applies automated content moderation to what a child types and to what the AI returns.

In limited cases, an administrator may flag an account for closer observation (for example, to investigate a safety report or a bug). For a flagged account only, we may temporarily log the full content of AI requests and responses. These detailed logs are access-restricted and are purged on an ongoing basis as the service runs, so in normal operation they are not retained beyond about 30 days.

Ordinary study messages are stored as part of the child's session history so that parents can review them and so the tutor has context.

9. How long we keep information

• Account and child profile data: kept while your account is active.
• Study sessions, messages, and progress: kept while the account is active so parents can review history and the tutor can personalise; deleted when you delete the child or your account (subject to the cascade described below).
• Detailed safety/observation logs for flagged accounts: purged on an ongoing basis and, in normal operation, not retained beyond about 30 days.
• Billing records: retained as required for tax, accounting, and legal purposes.
• Backups: residual copies may persist in encrypted backups for a limited period after deletion before being overwritten.

When a parent deletes a child, we delete that child's profile and associated study data. When a parent deletes their account, we delete the account and all associated children and their data, except where we must retain limited records to meet legal obligations.

10. How we share information

We share personal information only as follows:

• With the service providers (processors) listed above, to operate the service.
• To comply with law, respond to lawful requests, or protect the rights, safety, and security of our users (especially children), the public, or us.
• In connection with a merger, acquisition, or sale of assets — in which case we will require the recipient to honour this policy, and we will notify you of any change in control of your information.

We do not sell personal information, and we do not share it for advertising.

11. International data transfers

We and our providers operate in several countries, so your information may be processed outside your home country, including in Singapore, the United States, the United Kingdom, and the European Union.

Where we transfer personal information internationally, we put in place appropriate safeguards under Article 46 of the GDPR — typically the European Commission's Standard Contractual Clauses (and the UK IDTA) — or, for recipients in the United States that are certified under the EU-US Data Privacy Framework, we rely on that framework.

12. Your rights and choices

Depending on where you live, you (and, for a child, the parent on the child's behalf) have rights over personal information, which may include the right to access, correct, delete, export/port, restrict or object to processing, and withdraw consent.

How to exercise your rights

You can edit much of your information directly in the app, and you can request deletion of your account from your settings. For any rights request — including access, a copy/export of your data, correction, or deletion — email us at support@getstudybuddyai.com. We will verify your request (for example, that you control the account) and respond within the time required by applicable law (generally within one month under GDPR (extendable by two further months), or 45 days under California law, extendable where permitted).

California (CCPA/CPRA)

California residents have the right to know, delete, and correct personal information, and to opt out of the 'sale' or 'sharing' of personal information. We do not sell or share personal information as those terms are defined, and we do not use or disclose sensitive personal information for purposes that require an opt-out. You may still exercise your choice via our 'Do Not Sell or Share My Personal Information' page. We will not discriminate against you for exercising your rights.

Complaints

If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection authority. We'd appreciate the chance to address your concern first.

13. Security

We use technical and organisational measures to protect personal information, including encryption in transit, hashing of passwords and child login credentials, access controls and row-level data isolation between families, and restricted administrative access.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the effective version shown at the top and, where appropriate, notify you or ask the parent to re-confirm consent.

15. Contact us

Questions, requests, or concerns: support@getstudybuddyai.com.