1Introduction
This Privacy Policy describes how Studova collects, uses and protects the personal data of users of its smart revision service (flashcards, quizzes, summaries, podcasts and spaced repetition), accessible via the website www.studova.ai, the web app app.studova.ai and the iOS and Android mobile apps (hereinafter the “Service”).
The data controller is Thunder Corp, publisher of the Studova Service (hereinafter “Studova” or “we”). We are committed to respecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR) and applicable law.
For any question about your data, you can write to us at contact@studova.ai.
2The data we collect
We only collect the data strictly necessary for the proper functioning of the Service, divided into two categories.
Data you provide to us
- Your name and email address when creating your account;
- Login information via Google or Apple, if you choose those options;
- The content you create or import (courses, PDFs, photos, notes, flashcards);
- Your preferences and account settings.
Data collected automatically
- Usage data (pages and features viewed, interactions);
- Progress data (scores, streaks, revision time);
- Technical information (device type, operating system, browser);
- IP address and approximate location data (country or region).
We never collect so-called “sensitive” data (health, opinions, origin, etc.) and only ask for what is strictly necessary.
3How we use your data
Your data is used to:
- provide, maintain and improve the Service;
- personalize your learning experience and optimize the spaced-repetition algorithm;
- manage your account, subscriptions and billing;
- send you communications about the Service and, with your consent, our news;
- ensure security and prevent fraud and abuse;
- comply with our legal and regulatory obligations.
We never use your data for purposes incompatible with those described here without first obtaining your consent.
4Legal bases for processing
In accordance with Article 6 of the GDPR, each processing activity relies on a legal basis:
- Performance of the contract: provision of the Service and management of your subscription;
- Your consent: non-essential cookies, marketing communications, login via a third-party service;
- Our legitimate interest: improvement of the Service, security and fraud prevention;
- Compliance with legal obligations: accounting, billing and responses to requests from authorities.
5Data sharing
We do not sell your personal data. We share it only with trusted third parties, strictly to the extent necessary:
- Technical providers: hosting and cloud infrastructure, audience-measurement tools;
- Payment providers: Stripe (web), Google Play billing (Android) and Apple's App Store (iOS);
- Authentication services: Google and Apple, if you use login via those services;
- Competent authorities: where required by law.
All our providers are bound by strict contractual confidentiality and data-protection obligations, and act only on our instructions.
6Transfers outside the European Union
Your data is hosted within the European Union. However, some of our providers (in particular payment or analytics providers) may process data outside the EU. In that case, we ensure that appropriate safeguards govern these transfers, such as the Standard Contractual Clauses approved by the European Commission or an adequacy decision.
7Retention period
Your data is retained for as long as your account is active. After your account is deleted:
- your personal data is deleted within 30 days;
- anonymized data may be retained for statistical purposes;
- certain data is retained longer where required by law (for example, billing data, for up to 10 years).
8Security of your data
We implement appropriate technical and organizational measures to protect your data:
- encryption of data in transit (HTTPS/TLS);
- encryption of sensitive data at rest;
- strict access controls and authentication;
- monitoring and intrusion detection;
- regular staff awareness training.
Despite all our efforts, no system is completely infallible. In the event of a data breach likely to result in a high risk to your rights, we will inform you as well as the CNIL, in accordance with the GDPR.
9Your rights
In accordance with the GDPR, you have the following rights:
- Right of access: obtain a copy of the data concerning you;
- Right to rectification: correct inaccurate data;
- Right to erasure: request the deletion of your data;
- Right to portability: receive your data in a structured, readable format;
- Right to object: object to certain processing;
- Right to restriction: restrict the processing of your data;
- Right to withdraw your consent at any time, without retroactive effect.
To exercise these rights, write to us at contact@studova.ai. We respond within one (1) month. Proof of identity may be requested in the event of reasonable doubt about your identity.
10Deletion of your account
You can delete your Studova account at any time, on your own initiative.
How to delete your account
- Open the Studova app (Android, iOS or web);
- Go to Settings → Account;
- Tap “Delete account” and confirm.
You can also send a request to contact@studova.ai from your account's email address.
Data deleted
Profile, learning paths, lessons, flashcards, progress (XP, streaks), account-linked subscriptions, consents and preferences.
Data retained temporarily
- Technical backups and server logs: up to a maximum of 90 days, then deletion or anonymization;
- Billing: legal and accounting data is retained as required by law (for example, up to 10 years for tax obligations).
Marketing data
You can unsubscribe from marketing emails without deleting your account, from Settings or the unsubscribe link included in every email.
11Cookies & trackers
We use cookies and trackers to operate the Service and improve your experience:
- Essential cookies: authentication, security and preferences — necessary for the Service to work;
- Audience-measurement cookies: to understand usage and improve the Service — subject to your consent.
You can accept, refuse or change your preferences at any time via our cookie-management banner or your browser settings.
12Protection of minors
Studova is aimed in particular at a school and student audience. In accordance with French law, a minor under fifteen (15) years of age cannot consent alone to the processing of their data: the consent of a holder of parental authority is then required.
If you are a parent or guardian and believe that your child has provided us with data without your consent, contact us at contact@studova.ai so that we can delete it.
13Changes to this policy
We may amend this Privacy Policy to reflect changes in the Service or in regulations. In the event of a substantial change, we will inform you by an appropriate means (in-Service notification or email). The date of the last update appears at the top of this page.
14Contact & complaint
For any question about this Policy or the exercise of your rights, contact us at contact@studova.ai.
You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French supervisory authority, via www.cnil.fr.
