Privacy Policy

Last updated: 11 October 2026

1. Who is responsible

The data controller is [Legal name of the business], [Registered address, Italy], VAT no. [Partita IVA]. For anything about your data write to [Contact email].

2. What we collect and why

• Account: your email address, a scrambled (hashed) version of your password — we never see the password itself — and, if you sign in with Google, your Google account ID. Needed to give you an account (contract).
• Purchase: your email, billing country, the amount paid and the Stripe payment reference. Card details are handled only by Stripe; we never see or store them. Needed for the contract and to meet tax and accounting law.
• Study record: your answers, mistakes, quiz history, daily plans, vocabulary and settings. This is what makes the app work for you (contract).
• Exam result sheets you upload: we keep only the 30 questions, your answers, the exam date, the exam office and the result. Your name, date of birth, examiner and sheet number are discarded when the file is read.
• Photos of mistakes you upload: the image is sent to our AI provider to read the questions on it, then discarded. We keep only the questions it matched.
• Follow-up questions and problem reports you write in the app. Follow-up answers may be shown to other learners without your name, so please don’t include personal details.
• Technical logs (IP address, browser, errors) kept by our hosting provider for a short time to keep the service secure and working (legitimate interest).

We do not sell your data, show ads, or use advertising or analytics trackers. We do not make automated decisions with legal effects about you; the app’s study suggestions and pass-chance estimates are for your own use.

3. Who processes it for us

We use these providers, each bound by a data-processing agreement:

• Supabase — database, hosted in Zurich, Switzerland.
• Vercel — hosting; the app runs in Frankfurt, Germany.
• Stripe — payments and receipts.
• Google — sending account emails (Gmail) and, if you choose it, Google sign-in.
• Anthropic — the AI that writes explanations and reads uploaded photos. It receives question text and images, not your account details.

Some of these companies are based in the United States. Transfers outside the EU rely on an adequacy decision (Switzerland; the EU–US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.

4. How long we keep it

Account and study data: while your account exists; deleted within 30 days of a deletion request (and removed from backups when they expire). Purchase and invoice records: 10 years, as Italian accounting law requires.

5. Cookies and local storage

We use one essential cookie to keep you signed in, and your browser’s local storage for preferences and for answers waiting to be sent when you are offline. These are strictly necessary, so no cookie banner is needed. We use no tracking or advertising cookies.

6. Your rights

You can ask to see, correct, export or delete your data, to restrict or object to its use, by writing to [Contact email]. We reply within one month. You also have the right to complain to the Italian data-protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live.

7. Age

The service is for people aged 18 and over. We do not knowingly collect data from anyone younger.

8. Changes

If we change this policy in a way that matters, we will tell you by email or in the app before the change applies.