Privacy Policy

1. Who we are

StudySpot ("StudySpot", "we", "us") is the data controller for the personal data described in this policy. That means we decide how and why your data is processed when you use the StudySpot website, apps and browser extension (the "Service").

2. What we collect and why

• Account data — email address, display name, avatar color, theme and language preferences. Used to create and manage your account (legal basis: performance of our contract with you).
• Study data — your workspace (exams, topics, plans, folders), progress (XP, streaks, study time, confidence) and the materials you upload (notes, PDFs, images, lecture recordings, videos). Used to provide the Service and sync across your devices (legal basis: contract performance).
• Usage and device data — basic technical information such as IP address, browser type and diagnostics. Used to keep the Service secure, prevent fraud and improve the product (legal basis: legitimate interests).
• Support messages — if you contact us, we keep the conversation to help you (legal basis: legitimate interests).

Payment data (card details, billing address, tax information) is collected and processed directly by our Merchant of Record, Paddle — we never see or store your full card number.

3. AI processing

When you use AI features, the relevant content (for example an uploaded document or lecture transcript) is sent to our AI provider to generate the result you asked for. It is used only to provide that feature, not to train public models.

4. Local storage and cookies

We use essential browser storage (local storage and similar technologies) so the app works — for example to keep you signed in, remember your theme and language, and hold uploads and progress when you're signed out. We do not use advertising or marketing cookies. You can clear this data at any time through your browser settings; doing so signs you out and removes locally stored study data.

5. Who we share data with

• Service providers that host and operate StudySpot (cloud hosting, database, AI processing), each under appropriate safeguards.
• Paddle, our Merchant of Record, for the sale of paid plans, subscription management, payments, tax compliance and invoicing.
• Professional advisers (legal, accounting) where needed.
• Authorities where required by law.

We never sell your personal data.

6. International transfers

Some of our service providers process data outside your country. Where data leaves the UK/EEA, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

7. Retention

We keep your data while your account is active. When you delete your account, we delete or anonymize your personal data, except where the law requires us to keep it longer (for example, transaction records kept by Paddle for tax purposes).

8. Your rights

Depending on where you live, you may have the right to:

• Access, correct or export your data (much of this is available directly in your account pages).
• Delete your account and associated data.
• Restrict or object to certain processing, and withdraw consent where processing is based on consent.
• Complain to your local data-protection authority.

To exercise any of these rights, contact us through the options on the website. We respond within one month.

9. Security

We use appropriate technical and organizational measures — including encryption in transit and access controls — to protect your data. No system is perfectly secure, but we work to keep it that way.

10. Children

The Service is not directed at children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their data.

11. Changes and contact

We may update this policy and will post the new version here. Questions or requests about your data? Reach us through the contact options on the website.