Privacy Policy

Last updated: June 16, 2026

This Privacy Policy explains what personal data Edusum (“we,” “us”) collects, why we collect it, who we share it with, and the choices and rights you have. It applies to our website and our practice application.

1. Data we collect

Account data: your email address, display name, and authentication metadata, managed through our authentication provider.
Study activity: the exams you follow, quiz attempts and answers, scores, flashcard and scenario progress, streaks, and readiness metrics.
AI interactions: the prompts and context you send to the AI tutor and the responses generated.
Billing data: purchase and transaction references (e.g. per-exam access and token packs). Payment-card details are handled by our payment processors, not by us.
Technical and usage data: device and browser information, IP address, and aggregated analytics about how the Service is used.

2. How we use your data

To provide, personalise, and improve the Service — including adaptive study and progress tracking.
To operate AI features by relaying your inputs to our AI providers and returning their output.
To process payments and prevent fraud or abuse.
To communicate service updates and, where you have opted in, product news.
To meet legal obligations and enforce our Terms.

Our legal bases (where GDPR applies) are performance of our contract with you, your consent (for example, marketing email and non-essential cookies), and our legitimate interests in operating and securing the Service.

3. Service providers we share data with

We share data only with processors that help us run the Service, under contracts that require them to protect it:

Supabase — database, authentication, and storage (hosting your account and study data).
Anthropic (Claude) and OpenAI — processing AI-tutor and content-generation requests.
Gumroad and Lemon Squeezy — payment processing as merchants of record.
Analytics and email providers — usage measurement and transactional/marketing email.
Hosting and infrastructure providers — to serve the websites and application.

We do not sell your personal data.

4. International transfers

Some of our providers process data in countries outside your own, including the United States. Where required, such transfers are protected by appropriate safeguards (for example, the EU Standard Contractual Clauses).

5. Data retention

We keep your personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records (such as transaction records) to meet legal obligations.

6. Cookies and analytics

We use essential cookies to keep you signed in and remember preferences such as your theme. We also use analytics to understand aggregate usage. You can control non-essential cookies through your browser settings and any cookie controls we provide.

7. Your rights

Depending on where you live (including under the EU/UK GDPR and the California CCPA), you have rights to:

Access the personal data we hold about you and receive a copy (portability).
Correct inaccurate data and complete incomplete data.
Delete your data (“right to be forgotten”), including by deleting your account from your profile settings.
Object to or restrict certain processing, and withdraw consent at any time.
Opt out of marketing email via the unsubscribe link or your settings.

To exercise these rights, contact us at support@edusum.com. You also have the right to lodge a complaint with your local data-protection authority.

8. Security

We use technical and organisational measures — including encryption in transit, access controls, and tenant data isolation — to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you of material incidents where required by law.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

10. Changes and contact

We may update this Policy from time to time; the “last updated” date above will change and we will notify you of material changes. Questions or requests can be sent to support@edusum.com.