Privacy policy

1. What data we collect

Account data: When you register, we collect your name, email address, and a hashed password. This is necessary to provide you with an account.

Uploaded documents: Files you upload are stored in our secure cloud storage (Supabase Storage) and used solely to generate your study materials. We store the file and its extracted text temporarily during processing.

AI-generated content: The study guides, summaries, and Q&A outputs generated from your documents are stored in your account so you can access them later.

Usage data: We record how many AI tokens are consumed during processing each month, so we can enforce plan limits and calculate costs. This includes the date and time of each processing job.

Payment data: If you subscribe to Pro, payment details are handled directly by Stripe. We do not store your card number or payment instrument details — we only store a Stripe customer identifier and subscription status.

Technical data: Standard web server logs may record your IP address, browser type, and pages visited. This data is used for security monitoring and debugging only.

2. How we use your data

We use your data to:

• Provide the StudyGuy service — processing your uploads and returning study guides
• Manage your account and subscription
• Enforce monthly usage limits and plan entitlements
• Process payments and handle billing enquiries
• Send transactional emails (account verification, receipts)
• Monitor and maintain the security and performance of our platform
• Comply with legal obligations

We do not use your data for advertising, profiling, or selling to third parties. We do not use your uploaded documents or AI outputs to train any AI model.

3. Legal bases for processing (UK/EU GDPR)

We rely on the following legal bases:

• Contract performance — processing your uploads and running your account is necessary to provide the service you signed up for
• Legitimate interests — security monitoring, fraud prevention, and service improvement
• Legal obligation — retaining transaction records as required by law

4. Third-party processors

We share data with the following third-party processors to operate the service. Each processor is bound by data processing agreements and appropriate safeguards.

Processor	Purpose	Data shared
Supabase	Database, authentication, and file storage	Account data, uploaded files, study guides, usage records
Anthropic	AI processing of uploaded document text	Extracted text from your uploaded documents (sent via API for processing only)
Stripe	Payment processing and subscription management	Name, email, billing address, payment method (handled directly by Stripe)
Resend	Transactional email delivery	Email address, email content (account verification, receipts)
Cloudflare	Hosting, CDN, and DDoS protection	IP address, browser metadata (passed through as proxy traffic)

Anthropic processes data in the United States. Where we transfer personal data outside the UK/EEA, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

5. Data retention

Uploaded files: Stored in Supabase Storage for as long as you hold an account. You may delete individual documents at any time from your dashboard.

Study guides: Stored until you delete them or close your account.

Usage records: Retained for 24 months for billing and dispute resolution purposes.

Account data: Retained until you delete your account. After deletion, your data is purged within 30 days from our systems. Some anonymised usage aggregates may be retained for longer for business analytics.

Payment records: Stripe retains payment records for up to 7 years as required by financial regulations.

6. Your rights

Under UK/EU GDPR, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your data. You can do this by using the "Delete my account" option in your account settings, or by contacting us
• Restriction — ask us to limit how we use your data in certain circumstances
• Portability — request your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@studyforge.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or your local supervisory authority if you are in the EU.

7. Account deletion

You can delete your account and all associated data at any time from your account settings page. Deletion removes your profile, uploaded documents, study guides, and usage records. This action is permanent and cannot be undone.

After account deletion, your data will be purged from our active systems within 30 days. Stripe may retain payment records independently for up to 7 years as required by law.

8. Cookies

StudyGuy uses session cookies set by Supabase to maintain your authenticated session. These cookies are strictly necessary for the service to function — you cannot opt out of them while using the service.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

9. Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), row-level security on our database, and access controls that limit which systems can read your data. However, no system is completely immune to security incidents.

If you become aware of any security issue with our service, please contact us at security@studyforge.ai.

10. Changes to this policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by displaying a notice within the service. The date at the top of this page indicates when the policy was last updated.

11. Contact

For any privacy-related questions or to exercise your rights:

Email: privacy@studyforge.ai

We aim to respond to all enquiries within 5 business days.