Privacy Policy

StudyPrime (“we,” “us,” or “our”) operates the website studyprime.ai and the StudyPrime application (collectively, the “Service”). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have regarding your information.

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

StudyPrime is designed primarily for students and educators at K-12 institutions. We are committed to protecting student privacy and comply with applicable laws including the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA).

2.1 Account Information

When you register or sign in, we collect:

• Full name and email address (from Google OAuth or direct registration)
• Profile photo URL (from Google, if provided)
• School domain (derived from your email address)
• Account role (Student or Teacher, set during onboarding)

2.2 Content You Create or Upload

• Uploaded documents — PDFs, Word files, Excel files, and other materials you upload for AI analysis. The full text is extracted and stored to power features such as note generation, quizzes, and flashcards.
• Chat messages — questions and messages you send to the AI assistant, stored to maintain conversation history and context across sessions.
• Audio recordings — lecture recordings you submit for transcription.
• AI-generated content — study notes, summaries, flashcards, quizzes, podcasts, and other materials produced from your content.

2.3 Usage and Analytics Data

• Pages visited, features used, and interactions within the Service (via PostHog analytics)
• Study session duration and activity timestamps
• Device type, browser, and general geographic region (IP-based, country/state level only)
• Error logs and performance data

2.4 Payment Information

If you subscribe to a paid plan, payment is processed by Stripe. We do not store your credit card number, CVV, or full payment details. We receive a Stripe customer ID and subscription status from Stripe. Stripe's privacy policy governs the handling of your payment information.

2.5 Cookies and Local Storage

We use browser localStorage to remember your theme preference (light/dark). Our analytics provider (PostHog) may set cookies to track sessions and identify returning users. We do not use advertising cookies. You can clear cookies and localStorage at any time through your browser settings.

• Providing the Service — to authenticate you, store your documents and conversations, and deliver AI-generated study materials.
• AI processing — your uploaded content and messages are sent to OpenAI's API to generate responses and educational materials. This is the core function of the Service.
• Improving the Service — aggregated, anonymized usage data helps us understand which features are valuable and where to invest improvement efforts.
• Communications — to send transactional emails (password resets, subscription receipts). We do not send unsolicited marketing emails.
• Safety and integrity — to detect abuse, enforce our Terms of Service, and support academic integrity features (flagged messages visible to teachers).
• Legal compliance — to comply with applicable law, legal process, or governmental requests.

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes. We do not use your content to train AI models.

4.1 Service Providers

We share data with trusted third-party service providers that help us operate the Service:

• Supabase (supabase.com) — cloud database, authentication, and file storage. Your account data, documents, and conversations are stored on Supabase infrastructure hosted in the United States.
• OpenAI (openai.com) — AI language and transcription models. Your chat messages, document text, and audio transcripts are sent to OpenAI for processing. OpenAI's Privacy Policy and API data usage policies apply. OpenAI does not use API inputs to train its models by default.
• Stripe (stripe.com) — payment processing for paid subscriptions. Stripe handles all payment card data under PCI-DSS compliance.
• Google (google.com) — OAuth sign-in. We receive your name, email, and profile photo when you authenticate with Google.
• YouTube / Google — the YouTube Data API is used to search for and display video metadata when you use the Videos feature.
• Vercel (vercel.com) — website hosting and serverless infrastructure. Request logs may be retained by Vercel for operational purposes.
• PostHog (posthog.com) — product analytics. Anonymized usage events are sent to PostHog to help us understand feature usage.
• Upstash (upstash.com) — Redis-based rate limiting. Minimal request metadata (user ID, timestamp) is stored temporarily.

4.2 Within Educational Institutions

If you are a student, messages that the AI flags as potential academic integrity concerns (for example, requests for help with an active test or exam) may be visible to your assigned teacher or school administrator within the same institution. Teachers do not have access to your full conversation history — only flagged messages.

4.3 Legal Requirements

We may disclose your information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of StudyPrime, our users, or the public.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

StudyPrime is committed to protecting the privacy of students, including minors.

FERPA: For students at K-12 institutions, StudyPrime acts as a “school official” under FERPA when deployed pursuant to a school or district agreement. In that context, we access student education records only for legitimate educational purposes and do not disclose them to third parties without appropriate consent or a valid legal basis.

COPPA: StudyPrime may be used by students under 13 within a school or institutional context, where the school provides verifiable parental consent on behalf of students as permitted under COPPA. We do not knowingly allow children under 13 to create independent accounts outside of an institutional agreement. If you believe a child under 13 has provided personal information without proper consent, please contact us at support@studyprime.ai and we will delete that information promptly.

We retain your account data, documents, and conversations for as long as your account is active. When you delete your account (available in Settings → Danger Zone), we permanently delete:

• Your profile and account information
• All conversations and messages
• All uploaded files and extracted text
• All generated study materials (notes, flashcards, quizzes)

Deletion is processed immediately in our primary database. Backup copies may persist for up to 30 days before being overwritten. Stripe retains transaction records as required by financial regulations, independent of account deletion.

We implement industry-standard security measures to protect your information:

• All data in transit is encrypted via HTTPS/TLS
• Database access is protected by Row-Level Security (RLS) policies in Supabase, ensuring users can only access their own data
• API routes are authenticated and rate-limited
• Service role keys and API credentials are stored as environment secrets, never exposed in client-side code

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. Please use a strong, unique password and enable two-factor authentication on your Google account.

Depending on your jurisdiction, you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — delete your account and all associated data via Settings, or by contacting us
• Portability — request an export of your data in a machine-readable format
• Objection — object to certain processing activities
• Withdrawal of consent — where processing is based on consent, withdraw it at any time (this does not affect processing already performed)

To exercise any of these rights, contact us at support@studyprime.ai. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

Virginia residents have additional rights under the Virginia Consumer Data Protection Act (VCDPA), including the right to appeal a decision we make about your request.

StudyPrime is operated from the United States. If you are accessing the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

The Service may contain links to third-party websites or services (for example, YouTube videos). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or an in-app notice. Your continued use of the Service after any changes constitutes your acceptance of the revised policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@studyprime.ai
• Website: studyprime.ai
• Location: Woodbridge, Virginia, USA