Privacy Policy

Last updated: 4 May 2026

1. Introduction

StudyViaAI Ltd ("we", "us", "our") operates the StudyViaAI platform at studyviaai.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains our lawful basis for each type of processing. Different processing activities rely on different lawful bases as set out in Section 4.

Data Controller: StudyViaAI Ltd

Contact: admin@studyviaai.com

Data Protection Officer: We have assessed that we are not required to appoint a Data Protection Officer under UK GDPR Article 37, as we do not engage in large-scale systematic monitoring or large-scale processing of special category data. For all data protection queries, contact admin@studyviaai.com.

2. Information We Collect

2.1 Information You Provide

Account Information: When you register, we collect your name, email address, date of birth, and password (stored securely using bcrypt hashing). You must verify your email address before accessing the Service.

Learning Data: Your learning goals (subject, target outcome, current level), curriculum preferences, quiz responses, confidence ratings, self-reflections, tutor conversations, notes (including highlighted text from AI responses), and study time logs.

Payment Information: If you upgrade to Premium or purchase credit bundles, payment is processed through Stripe. We store your Stripe customer ID and subscription ID but do not store your full card details — Stripe handles this securely in accordance with PCI DSS standards.

Voice Data: If you use voice input or Explain Out Loud, audio is sent to our server for transcription via the AI model infrastructure described in Section 6 and is not stored after processing. Voice session metadata (duration, number of turns, language, whether you switched to text) is logged for analytics.

Feedback and Error Reports: If you submit feedback (category, rating, message) or report an AI error (the AI response and your preceding prompt), this data is stored and reviewed by our team.

Referral Information: Your unique referral code and referral relationships.

Preferences: Tutor style (Socratic/direct/mixed), challenge level, session length, and language preference.

Uploaded Materials: If you upload lecture materials (PDF, PPTX) to generate a curriculum, we extract and store the text content from your files to create a personalised curriculum. The original uploaded files are not retained after text extraction is complete.

Mock Exam Data: When you generate or attempt a mock exam, we store the exam questions, your submitted answers, AI-generated grades and feedback, scores, and attempt timestamps. This data is linked to your curriculum and learning goals.

Content Safety Data: If your input is flagged by our content safety filters, we log the violation — including the category of violation (e.g. violence, self-harm, illegal activity, sexual content, hate speech, academic dishonesty, or off-topic professional advice), the input text that triggered the filter, the route where it occurred, and a timestamp. For high-stakes subjects (Medicine, Law, Pharmacology, Finance, Engineering, Psychology), we record whether you have acknowledged the academic-use-only safety interstitial for each learning goal.

Revision Notes Data: When you generate revision notes, we store the AI-generated notes content linked to your curriculum. This includes insights drawn from your Socratic tutoring conversation history to personalise the notes.

Purchase Consent Records: When you purchase a credit bundle, you are asked to confirm (via a checkbox at checkout) that you want your credits delivered immediately and that you understand this waives your 14-day cancellation right under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. We record the timestamp at which you gave this consent, the version of the consent wording you were shown, and the IP address from which you made the purchase. This record is kept as evidence that your consent was properly obtained.

2.2 Information Collected Automatically

Usage Data: Pages visited, features used, session duration, and interaction patterns. We track page views server-side with a persistent anonymous visitor ID stored in your browser's localStorage.

Session Data: App session start/end times, session duration, and heartbeat signals for engagement tracking.

Device Information: Browser type, operating system, device type, and language preference.

Learning Analytics: We collect and aggregate learning engagement metrics including study time per session, lesson completion rates, quiz accuracy, explanation practice scores, experience points (XP) earned, streak data, daily quest completion, and diagnostic assessment results.

Gamification Data: XP events, levels achieved (overall and per-goal), streaks, daily quest completion, Question of the Day responses, and Explain Out Loud scores.

Upgrade and Conversion Data: We track when upgrade prompts are shown, whether upgrade flows are started, abandoned, or completed, and exit survey responses when users cancel subscriptions. This helps us improve the user experience.

Funnel Analytics: We track key milestones in your learning journey (first explanation, first quiz, etc.) to understand how users engage with the platform. Each milestone is recorded once per user.

Cost Analytics: We track AI token usage and estimated costs per feature type (tutoring, curriculum generation, quizzes, voice, etc.) to manage our operational costs. This data is aggregated and does not include your personal conversations.

PostHog Analytics (with consent): If you accept analytics cookies via our cookie consent banner, we collect product analytics through PostHog (hosted in the EU). This includes page views, navigation patterns, button clicks, and custom events (such as lesson started, quiz taken, curriculum created, and upgrade actions). PostHog does not collect voice recordings or transcriptions. Session replays may show learning interaction content visible on screen (such as chat messages, AI tutor responses, curriculum content, and quiz answers), but this data is only used for platform improvement and is never shared with third parties. Sensitive personal information (email addresses, dates of birth, passwords, and payment details) is automatically masked. Element text and input values are stripped from all analytics events (excluding session replays). If you decline analytics cookies, PostHog is not initialised, no analytics data is collected, and no session recordings are made.

Cookies: We use cookies for session management and authentication. See our Cookie Policy for full details.

2.3 Session Recording

When you consent to analytics cookies, we may record your interactions with the StudyViaAI platform using PostHog session replay. These recordings capture how you navigate the platform, including page views, mouse movements, clicks, scrolls, and content displayed on screen.

What is visible in recordings: Session recordings may include the content of your interactions with the AI tutor, including chat messages you send, AI tutor responses, learning goals, curriculum content, exam questions and answers, quiz results, and revision notes. This learning interaction data is visible in recordings because it is essential for us to understand how the tutoring experience works and where it can be improved.

What is masked (hidden) in recordings: The following sensitive personal information is automatically masked and never visible in session recordings: email addresses, dates of birth, passwords and password fields, and payment or billing information.

Who can view recordings: Session recordings are accessible only to authorised StudyViaAI team members. They are used solely for the purpose of improving the platform and are never shared with third parties, used for marketing, or used to identify individual users outside of product improvement purposes.

How to opt out: You can opt out of session recording at any time by rejecting analytics cookies through the Cookie Settings link in the website footer, or by contacting us at admin@studyviaai.com. If you opt out, no session recordings will be made of your activity.

Data location and retention: Session recordings are processed and stored by PostHog on EU-based servers (eu.i.posthog.com). Recordings are retained for 1 year and then automatically deleted.

3. How We Use Your Information

• To provide, personalise, and improve the AI tutoring experience
• To generate personalised curricula, quizzes, diagnostic assessments, book recommendations, daily challenges, revision notes, and mock exams with AI-powered grading
• To process uploaded lecture materials and extract text for curriculum generation
• To track your learning progress, mastery levels, and study habits
• To power gamification features (XP, levels, streaks, quests)
• To process payments and manage your subscription
• To manage daily prompt allowances and credit balances
• To send email verification and password reset emails
• To respond to your feedback and review error reports
• To analyse platform usage, learning outcomes, and engagement patterns for service improvement
• To monitor and manage AI costs and operational expenses
• To detect and prevent fraud, abuse, or violations of our Terms
• To monitor application errors and performance via Sentry (see Section 6)
• To enforce rate limits and usage quotas
• To operate content safety filters that screen user inputs and AI outputs for prohibited content
• To log and review content violations for platform safety and to take action against repeat offenders
• To display safety interstitials for high-stakes subjects (Medicine, Law, Pharmacology, Finance, Engineering, Psychology) and record user acknowledgement
• To suspend or restrict accounts that accumulate repeated content safety violations

4. Legal Basis for Processing (UK GDPR)

We process your personal data on the following legal bases:

• Contract (Article 6(1)(b)): Processing necessary to provide the Service you have signed up for (account management, AI tutoring, learning data storage, progress tracking, subscription management, payment processing, transactional emails including email verification and password reset).
• Legitimate Interests (Article 6(1)(f)): Fraud prevention, security monitoring (including Sentry error tracking), rate limiting, content safety filtering, cost management, detection of abuse, and service improvement analytics derived from aggregated usage data. Where we rely on legitimate interest, we have balanced our interest against your rights and freedoms and concluded the processing does not override them. You have the right to object to this processing (see Section 8).
• Consent (Article 6(1)(a)): PostHog product analytics and session replay are processed solely on the basis of your consent given through our cookie consent banner. If you decline analytics cookies, no such processing occurs. You may withdraw consent at any time by using the Cookie Settings link in the website footer, and this will not affect the lawfulness of processing based on consent before its withdrawal.
• Legal Obligation (Article 6(1)(c)): Retention of financial records for tax purposes under UK tax law, retention of purchase consent records under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the Companies Act 2006, response to lawful requests from authorities, and notification of personal data breaches to the Information Commissioner's Office where required.

5. Automated Decision-Making

We use automated processing in the following contexts:

AI-generated grading and scoring: Your mock exam answers, spoken explanations (Explain Out Loud), quiz responses, and diagnostic assessments are graded automatically by AI. Predicted grades in the exam simulator are produced without human review.

Content safety filtering: Inputs you submit to the AI tutor, exam answers, feedback, and other free-text fields are screened automatically. If the filter classifies your input as violating our content policies, the request is blocked automatically.

Account restriction for content violations: Users who accumulate multiple content policy violations within a short period may be temporarily restricted automatically (typically a one-hour cooldown). Severe or sustained violations are escalated to human review before any permanent action is taken.

None of these automated processes produce legal effects concerning you (such as denial of credit, employment, or a legal right). The grading outcomes are educational in nature and have no legal standing. Automated account restrictions are time-limited and do not result in permanent termination without human review.

You have the right to request human review of any automated decision you believe has significantly affected you. To exercise this right, contact admin@studyviaai.com and describe the decision you wish reviewed. We will respond within one month.

6. Third-Party Services

We use the following third-party services to operate the platform. We maintain Data Processing Agreements with each of these processors where we have a direct relationship. Where we access a provider through an intermediary, our contractual relationship is with the intermediary, who acts as our processor and engages the underlying provider as its sub-processor. Copies of relevant DPAs are available upon request by contacting admin@studyviaai.com.

6.1 AI Processing (Replit AI Integrations — with OpenAI as sub-processor)

StudyViaAI's AI-powered features — including tutoring, curriculum generation, quizzes, diagnostics, speech-to-text transcription, text-to-speech, book recommendations, explanation scoring, daily challenges, revision notes generation, and mock exam question generation and grading — are delivered through large language models operated by OpenAI, LLC ("OpenAI"). StudyViaAI accesses these models through Replit, Inc. ("Replit") via Replit's AI Integrations service.

Under this arrangement:

• Replit acts as StudyViaAI's direct processor for AI processing. Replit manages the API credentials and routes each request to OpenAI on StudyViaAI's behalf.
• OpenAI acts as Replit's sub-processor. StudyViaAI does not have a direct contractual relationship with OpenAI for AI processing.
• Your inputs (prompts, chat messages, uploaded lecture text, voice transcripts, quiz answers, exam answers) and the AI-generated outputs are transmitted to and processed by OpenAI via Replit for the sole purpose of generating a response to you.
• Under Replit's Commercial Agreement with StudyViaAI, neither Replit nor OpenAI uses this content to train their general-purpose foundation models. Replit's use of the content is limited to delivering the Service and maintaining the Replit platform.
• Data location: United States (Replit's primary data region is Google Cloud Platform, US).
• Transfer safeguard: UK International Data Transfer Agreement (IDTA) and the UK Addendum to the EU Standard Contractual Clauses, incorporated into Replit's Data Processing Agreement. Replit's DPA requires equivalent protections at the sub-processor level.

Relevant documents: Replit Commercial Agreement (replit.com/commercial-agreement), Replit Data Processing Agreement (replit.com/dpa), Replit sub-processor list (replit.com/subprocessors).

Replit maintains an authoritative list of its own sub-processors and may update it from time to time in accordance with its DPA. If Replit materially changes the underlying AI provider for the Service, we will update this Privacy Policy to reflect that change.

6.2 Payments — Stripe

Stripe (Stripe Payments Europe, Limited): Processes all payments securely. We do not store card details. Data location: European Union and United States (for certain Stripe services). Transfer safeguard: Stripe is certified under the EU-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework, and additional transfers are covered by Standard Contractual Clauses. See Stripe's Privacy Policy at stripe.com/privacy.

6.3 Hosting and Platform — Replit

Replit (Replit, Inc.): In addition to the AI Integration described in Section 6.1, Replit hosts the StudyViaAI application and database. Personal data stored in the platform (including account information, learning data, and usage logs) is processed by Replit as our processor. Data location: United States (Google Cloud Platform). Transfer safeguard: UK IDTA / UK Addendum to EU SCCs incorporated into Replit's Data Processing Agreement (replit.com/dpa). See Replit's Privacy Policy at replit.com/privacy-policy.

6.4 Product Analytics — PostHog

PostHog (PostHog, Inc.): Product analytics and session replay. PostHog processes usage data (page views, clicks, feature interactions), device information (browser type, operating system, screen resolution), and session recordings (visual replay of user interactions with the platform). Data location: European Union (eu.i.posthog.com). No analytics data is transferred outside the EU. Lawful basis: Consent via cookie preferences. Analytics data is retained for 12 months; session recordings are retained for 1 year. See PostHog's Privacy Policy at posthog.com/privacy and PostHog's DPA at posthog.com/dpa.

6.5 Error Monitoring — Sentry

Sentry (Functional Software, Inc.): Monitors application errors and performance on both frontend and backend. Sentry may collect error details, browser/device information, and IP addresses to help us identify and fix issues. Data location: United States. Transfer safeguard: UK IDTA / UK Addendum to EU SCCs. Lawful basis: Legitimate interest (maintaining platform stability and security). See Sentry's Privacy Policy at sentry.io/privacy.

6.6 Transactional Email — Resend

Resend (Plus Five Five, Inc.): Sends transactional emails (email verification, password reset, subscription confirmations, payment notifications). Data location: United States. Transfer safeguard: UK IDTA / UK Addendum to EU SCCs incorporated into Resend's Data Processing Addendum. See Resend's Privacy Policy at resend.com/legal/privacy-policy.

6.7 Accounting — Xero

Xero (Xero (UK) Limited): Accounting and bookkeeping records for statutory tax compliance. Processes customer billing records and transaction history. Data location: United Kingdom, with backup processing in New Zealand. Transfer safeguard: UK IDTA for transfers to New Zealand. Lawful basis: Legal obligation (Companies Act 2006, HMRC tax requirements). See Xero's Privacy Notice at xero.com/uk/legal/privacy.

6.8 Meta Advertising (Facebook and Instagram)

We use Meta's advertising platform (Facebook and Instagram) to promote StudyViaAI to relevant audiences. When you click on a StudyViaAI advertisement on Facebook or Instagram, Meta passes us a click identifier (the fbclid URL parameter) which allows us to attribute your visit to a specific advertising campaign.

We do not currently use Meta Pixel or any other tracking technology from Meta on studyviaai.com. No Meta cookies are set on our website.

Lawful basis: Legitimate interest. We have assessed that the use of Meta's advertising platform is necessary for the growth of our business and that the privacy impact on individuals is minimal given we do not deploy tracking pixels on our website.

International transfers: Meta Platforms, Inc. is based in the United States. Transfers of personal data to Meta are governed by EU Standard Contractual Clauses, incorporated into Meta's standard advertising terms.

Your rights: You can opt out of behavioural advertising on Meta platforms at any time through your Meta account settings (facebook.com/ads/preferences), or industry-wide via youronlinechoices.com. You also retain all your rights under UK GDPR including the right to object to processing based on legitimate interest — please contact admin@studyviaai.com to exercise these rights.

7. Data Retention

Account Data: Retained for as long as your account is active. If you request account deletion, all data is permanently removed within 30 days.

Learning Data: Retained for the lifetime of your account to preserve your learning history and progress, except where you downgrade from Premium to Free. In that case, all learning goals other than your most recently accessed goal are permanently deleted at the end of your paid billing period. See Section 7 of our Terms and Conditions for full details.

Voice Recordings: Not stored. Audio is transcribed in real-time and discarded immediately after processing.

Payment Records: Transaction records are retained for 7 years as required by UK tax regulations.

Purchase Consent Records: Records of your consent to immediate delivery of credit bundles (including timestamp, consent wording version, and IP address) are retained for 6 years from the date of purchase, in line with UK statutory accounting retention requirements. These records are not deleted when you delete your account; instead, the link to your user identity is anonymised but the transactional record is preserved for statutory audit and evidentiary purposes.

Uploaded Materials: Original uploaded files (PDF, PPTX) are not stored. Text is extracted during processing and stored as part of the curriculum data for the lifetime of the associated learning goal.

Mock Exam Data: Generated exams, your answers, grades, and feedback are retained for the lifetime of the associated learning goal. When a goal is deleted, all associated exam data is permanently removed.

Revision Notes: Generated revision notes are retained for the lifetime of the associated learning goal. When a goal is deleted, its revision notes are permanently removed.

Analytics Data: PostHog analytics events are retained for 12 months. PostHog session recordings are retained for 1 year. Aggregated, irreversibly anonymised analytics (where no link to an individual user is retained) may be kept for up to 3 years for long-term product research.

Error Reports and Feedback: Retained for as long as needed to address the reported issue, and no longer than the lifetime of your account.

Content Violation Records: Records of content safety violations (violation category, flagged input, timestamp, route) are retained for the lifetime of your account. These records are used to identify repeat offenders and enforce our content policies. Upon account deletion, all violation records are permanently removed.

Safety Interstitial Acknowledgements: Records of whether you have acknowledged the safety interstitial for high-stakes subject goals are retained for the lifetime of the associated learning goal.

Account Restriction Records: If your account is suspended due to content violations, the restriction record (reason, admin notes, timestamps) is retained for the lifetime of your account or until the restriction is lifted.

Session Data: The login session cookie (sid) has a fixed expiry of 7 days from the time of login. After expiry, you will need to log in again.

8. Your Rights (UK GDPR)

Under the UK GDPR, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your account and all associated data. We provide full account deletion through our admin team, which permanently removes all your data across all tables in a single transaction.
• Right to Restriction: Request that we limit how we process your data.
• Right to Data Portability: Request your data in a structured, machine-readable format. You can export your curriculum and revision notes as PDF documents via the Export feature.
• Right to Object: Object to processing based on legitimate interests, including direct marketing, profiling, and analytics that rely on legitimate interest.
• Right to Withdraw Consent: Where processing is based on consent (such as PostHog analytics and session replay), you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Rights Related to Automated Decision-Making: Request human review of any automated decision that significantly affects you (see Section 5).
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

To exercise any of these rights, contact us at admin@studyviaai.com. We will respond within one month as required by law. We may extend this period by up to two further months where requests are complex or numerous, and we will inform you of any extension.

9. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Passwords are hashed using bcrypt before storage
• All data is transmitted over HTTPS/TLS encryption
• Session authentication uses secure, HTTP-only cookies
• Payment processing is handled by PCI DSS-compliant Stripe
• Admin access requires separate authentication with restricted credentials
• Rate limiting protects against brute force and abuse
• Account suspension capabilities for compromised accounts
• Application errors are monitored via Sentry for rapid response to security incidents
• Automated content safety filters screen all user inputs before AI processing, using a fail-closed approach — if the filter encounters an internal error, the request is blocked rather than allowed through
• AI-generated outputs are checked for safety before being displayed to users
• Sensitive personal data (email addresses, dates of birth) is encrypted at rest using AES-256 encryption

Data Breach Notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. Where the breach poses such a risk, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, as required by Article 33 of the UK GDPR.

10. International Transfers

Some of our third-party processors are based outside the United Kingdom. Where your personal data is transferred internationally, we ensure that appropriate safeguards are in place to protect it, in compliance with Chapter V of the UK GDPR:

• Replit (United States) — hosting and AI Integration: UK IDTA / UK Addendum to EU Standard Contractual Clauses incorporated into Replit's Data Processing Agreement. This covers both the hosting relationship (Section 6.3) and the AI Integration relationship (Section 6.1), including onward transfer to Replit's sub-processors such as OpenAI.
• Stripe (European Union and United States): Certified under the EU-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework; Standard Contractual Clauses for other transfers.
• PostHog (European Union only): No transfer outside the EU/UK. Data is processed on EU-based servers at eu.i.posthog.com.
• Sentry (United States): UK IDTA / UK Addendum to EU Standard Contractual Clauses.
• Resend (United States): UK IDTA / UK Addendum to EU Standard Contractual Clauses incorporated into Resend's Data Processing Addendum.
• Xero (New Zealand, backup only): UK IDTA for transfers to New Zealand.
• Meta Platforms, Inc. (United States) — Facebook and Instagram advertising: EU Standard Contractual Clauses incorporated into Meta's advertising terms. Click identifiers from ad attribution only; no Meta Pixel deployed on studyviaai.com.

Copies of the relevant Standard Contractual Clauses or equivalent safeguards are available on request from admin@studyviaai.com.

11. Children's Privacy

The Service is intended exclusively for individuals aged 18 years or older. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a minor, we will take immediate steps to delete the account and all associated data. If you believe a minor has provided us with personal data, please contact us immediately at admin@studyviaai.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or through a notice on the Service. We encourage you to review this policy periodically. The "Last updated" date at the top indicates when the policy was last revised.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact us at:

Email: admin@studyviaai.com

Website: studyviaai.com

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.