Privacy Policy
Version 1.1. Effective from 10 October 2026.
If we make an important change to this policy, we will email you before it takes effect (clause 13).
0. The short version
This is what we do with your information, in plain words. The rest of this policy gives the full details.
- We collect what we need to run your account: your email address, a username, a name and your date of birth. Country, school, year group and exam date are optional.
- We record how you study: which subjects you are working on, which questions you answer, the answers you give and whether you got them right. We use this only to show your progress, to work out what to revise next and to help you revise.
- We never show adverts, never sell your information, and never share it with your school or an exam board.
- Nobody else on the site can see your profile or your work.
- If you buy a plan, Stripe handles your card, and Link (Sold through Link, LLC, a Stripe company) is the seller and sends your receipt. We never see your card number. If someone else pays for your plan, we hold that person's name, email address and billing details for the order.
- The AI study assistant uses your messages and your study progress to help you, and the answer marker marks what you type. We never send them your name, email address or account details. Clause 5 explains what is sent, what is kept and for how long.
- You can ask to see, correct or delete your information at any time by emailing help@examstudyaid.com. A parent or guardian can email us about your account too.
- If you are under 13, you cannot have an account.
1. Who is responsible for your data
We are ExamStudyAid OÜ, a private limited company (osaühing) under Estonian law, registry code 17537614 in the Estonian Commercial Register (Äriregister). Our registered address is Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn, Harju maakond, 10115, Estonia. You can email us at help@examstudyaid.com.
We decide how and why your personal data is used. Data protection law calls this being the "controller". In this policy "we", "us" and "our" mean ExamStudyAid OÜ, and "the service" means the website at examstudyaid.com and your account.
2. What we collect and where it comes from
To have an account you must give us an email address, a username and a password, and, during set-up, a name and your date of birth. Without them we cannot create or run the account. Everything else is optional.
Things you give us
- Account details: your email address, a username and your password. We store only a scrambled version of your password, never the password itself. We also record whether your email address has been verified.
- Profile details: a name (it does not have to be your full name) and your date of birth. Optional: your country, year group, school and exam date.
- Your study set-up: the exam boards and subjects you choose.
- Your choices: when you accepted the Terms of Service and this policy, and any other confirmation the service asks you for.
- Emails you send us.
Things we record when you use the service
- Learning data: the questions you answer, the answers you give, your marking results and your progress. See clause 2a.
- Security data: when you log in, or try to, we record your username, the internet address of your device, your browser and device details, the page you used and the time. For a failed login attempt we record the email address that was typed instead, so that we can spot repeated attempts.
- Technical logs: our servers keep logs that can include your username or account number, the pages and content you requested, and events about your subscription.
Things we receive from others
- From Stripe and Link, if a plan is bought for your account: a customer reference, a subscription reference, the status of the subscription and the date the current period ends, and the order details: the name, email address and billing address of the person who paid, the plan, the price and any tax paid, and the date. We send Stripe your account reference and the plan chosen, and nothing else. We never receive card details.
- From Google, if you sign in with a Google account: the profile details Google sends us, such as your name, email address, whether it is verified, a link to your profile picture and your language setting.
If you pay for someone else's plan
If you pay for a plan on another person's account, for example as a parent, Stripe or Link sends us your name, email address and billing address together with the order details. We use them to manage the plan, to handle cancellations and refunds and to keep the accounting records the law requires (clause 3). We keep them as described in clause 8, and you have the rights described in clause 9.
Things stored on your device
Your browser stores a few things on your device so that they are still there when you come back. They stay on your device and are not sent to us. You can clear them in your browser settings.
- your theme choice;
- your progress ticks on notes pages, and which flashcards you have marked as learned;
- where you left off in the notes and question pages.
While you are signed in, your browser also keeps a copy of your work on topic questions: your typed answers, drafts, graph and table work, and marks. The same work is saved in your account (clause 2a). The browser copy is removed when you log out, when a different account signs in on the same browser, and when one of our pages loads while nobody is signed in.
Things we do not collect
We do not track your location. We do not collect photos, uploads or voice. We do not receive card numbers. There are no messages between users on the service. We do not use advertising identifiers or advertising cookies.
2a. Your learning data and study profile
The whole point of the service is to show you what to revise next. To do that, the service records how you study. This is a form of profiling, limited to your own learning. Here is exactly what it involves.
What we record
- the exam boards and subjects you study;
- your exam date and your school, if you gave them;
- every question you answer, the option or the answer you gave, whether it was right, and when;
- for each topic question, your latest typed answer, any unmarked draft, and your graph and table work;
- every marking of a typed answer: the score, the mark-by-mark breakdown and the feedback the marker gave;
- the last study resource you opened, kept so that you can continue where you left off (only the latest one);
- the topics the service works out you need to revise, and your progress measures, both built from your answers.
What the service does with it
- shows you your progress, and shows your earlier answers again on any device: the options you chose on multiple-choice pages, and your saved answer, draft and latest mark when you open a topic question;
- chooses what to show you next and which topics to revise;
- gives the AI study assistant the context it needs to help you (clause 5).
What it never does
- It is never shared with your school, your teachers or an exam board, and never used for advertising.
- It is never shown to other users, and there are no leaderboards or rankings against other students.
- It is never used to make a decision about you that has a legal or similar effect. It does not give you an official grade and it does not unlock, block or price anything.
- It is limited to your own learning. The service does not build a picture of you beyond what these study features need.
Your controls
You can see your answers, results and progress in your account. You can ask us to reset or delete your learning data at any time by emailing help@examstudyaid.com; resetting it means the service starts again from scratch. We keep learning data for as long as you have an account, unless you ask us to delete or reset it.
3. Why we use your data, and the legal basis
The law requires us to have a reason, called a legal basis, for each way we use personal data. These are ours.
| What we use your data for | The data involved | Legal basis |
|---|---|---|
| Running your account and providing the service, including your progress and revision features | account, profile, study set-up, learning data | Our contract with you (the Terms of Service) |
| Taking payment and managing a paid plan | the subscription details we exchange with Stripe, and the order details Link sends us about the person who paid | Our contract with you; a legal obligation to keep accounting records |
| Keeping accounts and the service secure: limiting login attempts, blocking attacks, investigating misuse | security data, technical logs | Our legitimate interest in protecting the service and its users. This affects you only if someone tries to misuse the service or your account |
| Sending you service emails: verification, password resets, account and subscription notices | email address | Our contract with you |
| Answering your emails and complaints | your emails | Our contract with you, and a legal obligation to handle complaints |
| Improving the study content using statistics about how questions are answered, without identifying you | learning data, in aggregate | Our legitimate interest in making the content better. We use the statistics only, not your individual record |
| Providing the AI study assistant and AI marking | your messages, answers, study set-up and progress data, without any identifier | Our contract with you: the AI features are part of the service you asked for |
| Checking each message to the assistant for signs that you may be at risk, so that the assistant shows a safety message instead of answering as if it were a normal study question | the text of your message | Our legitimate interest in keeping users safe, in particular younger users, and, where a message suggests immediate danger, protecting your vital interests. The check is a safety filter: it keeps no record of what it found |
| Keeping records that the law requires, and answering lawful requests from authorities | account and payment records | A legal obligation |
| Marketing emails | your email address | Your consent. We do not send marketing emails at present. If we start, we will ask you first, and we never send marketing to anyone under 18 |
We never use your data for advertising, and we never sell it.
4. Children and young people
You must be 13 or older to create an account. If you are under 13, you may not register. We delete any account we find belongs to someone under 13. If you are under 18, you need a parent or guardian's permission to use the service, and they should know about the Terms of Service. The person who pays for a paid plan must be 18 or older.
During set-up we ask for your date of birth. We use it only to apply this rule, and we never show it to anyone else. If your date of birth shows that you are under 13, we delete the account at once. We keep only the security record of the login (your username, internet address and browser details), which is deleted after 90 days; our backups and logs are cleared on their normal schedule (clause 8).
Because many of our users are at school, the service shows no advertising, has no public profiles and no messaging between users, sends no marketing emails to anyone under 18, and does no profiling beyond the study features in clause 2a.
A parent or guardian can contact us at help@examstudyaid.com about their child's account, including to ask what we hold and to ask for it to be deleted. We may ask for proof that they are the parent or guardian.
Some countries set a higher minimum age, or require a parent to give consent in a particular way. If that applies where you live, you may use the service only with that consent.
5. AI processing
The AI study assistant and the answer marker. The assistant is software we run ourselves on Render's servers. To do its work it sends parts of your data to Mistral AI, which returns the text or the result. The table shows what Mistral AI receives for each task.
| What the AI does | Provider | What is sent |
|---|---|---|
| Works out what you asked for, and checks the message for signs that you may be at risk | Mistral AI (Mistral AI SAS, 15 rue des Halles, 75001 Paris, France) | the text of your message, and nothing else |
| Finds the notes that answer your question | Mistral AI | the text of your message, and nothing else |
| Explains a topic | Mistral AI | your message; the passages from our notes it needs; your exam board, subject and programme; your exam date and the number of days until it; the codes of your three weakest topics; and the mistakes the service has seen you make more than once |
| Words the assistant's advice (which topics to revise, your plan or schedule) | Mistral AI | the advice itself, which can include topic names, the assistant's estimate of how well you know each topic and how much evidence that rests on, your exam date, session lengths and progress figures |
| Marks a written answer | Mistral AI | the text of your answer, the subject, our question, our reference answer and our mark scheme |
In this table, "your message" includes up to four of your earlier messages from the same conversation, which are sent along so that the assistant can follow it.
What we never send. Your name, email address, username, account number, date of birth, age, country or school, or any identifier that links a request to your account. Mistral AI cannot tell who you are unless you put personal details in a message or an answer.
What the assistant keeps. The assistant keeps nothing between messages. During a quiz it holds the questions and your answers in memory until the quiz ends, or for at most an hour. Its technical logs never contain what you wrote or what the assistant replied.
What we keep in your account. We do not keep your conversations with the assistant: your question is not stored, and the reply is held only until it has been delivered to you. Your answers and marking results are part of your learning data (clause 2a) and stay in your account for as long as you have it, unless you ask us to delete or reset them. Only you and, when you ask for support, the people who run the service can read them. We do not use them to train AI models.
The provider's side. Retention and training settings are made on our account with Mistral AI, not in each request. Zero data retention is enabled on our account, so Mistral AI keeps nothing after it has produced its reply. It does not use your data to train its models. It acts as our processor under its data processing addendum. Its privacy notice: https://legal.mistral.ai/terms/privacy-policy.
No automated decisions. The AI features give you explanations, feedback and suggestions. They do not decide anything about you that has a legal or similar effect: they do not give official grades, and they do not unlock, block or price anything.
Transfers. See clause 7.
6. Who we share data with
We share personal data only with the companies that help us run the service, and only for the purposes in this policy.
| Who | What they do for us | What they receive | Where they are based |
|---|---|---|---|
| Stripe (Stripe Payments Europe, Ltd.) and Link (Sold through Link, LLC, a Stripe company) | Runs the checkout page and the billing portal and takes the payment. Link is the seller of record: it sells you the plan, issues your receipt, and handles refunds and payment support. For the sale, and for fraud prevention, security and legal purposes, Stripe and Link decide how your payment data is used and are separate controllers. Privacy notices: https://stripe.com/privacy and https://link.com/privacy | From us: your account reference and the plan chosen. From you: whatever you enter on the checkout page, in the billing portal or in your Link account | Ireland; United States |
| Render (Render Services, Inc.) | Hosts the site, its database and its short-lived cache and rate-limit store (Render Key Value) | All the data we hold; the cache holds your account number or internet address as a counter, for a short time | A United States company; our servers and data are in Frankfurt, Germany |
| Cloudflare (Cloudflare, Inc.) | Stores and serves our study content files and images, and helps protect the site from automated attacks, including a human check (Cloudflare Turnstile) on our email sign-up and login forms. Cloudflare also uses what the human check collects to improve it; for that, it decides how the data is used and is a separate controller. Privacy notice for the human check: https://www.cloudflare.com/turnstile-privacy-policy/ | Your device's internet address and technical details of the requests your browser makes. On the email sign-up and login forms, the human check also runs small tests in your browser and reads details of your browser and connection. It does not read what you type into the form | United States |
| Brevo (Sendinblue SAS, trading as Brevo) | Sends our emails | Your email address and the content of the email | France |
| Google (Google Ireland Limited for users in the EEA and UK; Google LLC for others) | Sign-in, only if you choose to sign in with Google; responsible for its own services as a separate controller | The sign-in exchange | Ireland; United States |
| Mistral AI (Mistral AI SAS) | Runs the AI models behind the study assistant and the answer marker: understanding your messages and the safety check, searching our notes, the assistant's explanations and advice, and answer marking (clause 5) | Your messages and answers, note passages, your exam board, subject, programme and exam date, your weakest topics, repeated mistakes and progress figures, and our marking material, with no identifier | France |
| Our development contractor | Builds and maintains the site | No personal data | |
| Public authorities | Only where the law requires us to share data | What the law requires | |
| A company that takes over our business | If our business is sold or moves to a new operating company (Terms of Service, clause 18) | Account and subscription records, under the same terms as this policy |
Access to personal data inside our company is limited to the people who run the service.
7. Data outside the EEA and the UK
We are based in Estonia. Some of the companies in clause 6 are in the United States or use servers there. When personal data goes to them, the law requires a safeguard. We rely on these:
- The EU-US Data Privacy Framework. US companies certified under this framework are treated as giving adequate protection. It also covers transfers from the UK through its UK extension.
- Standard contractual clauses. A contract approved by the European Commission (and its UK equivalent) that binds the receiving company to protect your data. You can ask us for a copy.
The safeguard for each company:
- Render: our data is stored on Render's servers in Frankfurt, Germany, but Render is a United States company. It is certified under the EU-US Data Privacy Framework, including its UK extension, and its data processing agreement also contains standard contractual clauses
- Cloudflare: certified under the EU-US Data Privacy Framework, including its UK extension; its data processing addendum also contains standard contractual clauses
- Google: the EU-US Data Privacy Framework (Google LLC is certified)
- Stripe and Link: our contract is with Stripe Payments Europe, Ltd. in Ireland; its group's own safeguards apply under Stripe's data processing agreement, including standard contractual clauses, and its US parent, Stripe, Inc., is certified under the EU-US Data Privacy Framework. As the seller, Link (Sold through Link, LLC) is a separate controller and receives what you enter on the checkout page directly from you; what we send, your account reference and plan, goes under the same safeguards as our contract with Stripe
- Brevo: no safeguard is needed, because it is based in France, inside the EEA
- Mistral AI: no safeguard is needed for Mistral AI itself, because it is based in France, inside the EEA. Where Mistral AI uses a sub-processor outside the EEA, its data processing addendum applies standard contractual clauses
8. How long we keep data
| Data | How long we keep it |
|---|---|
| Account and profile details, your study set-up, and your subscription record | as long as you have an account; deleted within one month of a deletion request |
| Details received from Google sign-in | The same as your account details |
| Learning data (clause 2a), including your answers and marking results | as long as you have an account, unless you ask us to delete or reset them |
| Records of your acceptances and confirmations | as long as you have an account. The box ticked before paying is kept with the order, as part of the payment and accounting records; if the payment never goes through, it is deleted after 30 days |
| A quiz in progress with the AI assistant | In memory only, until the quiz ends or for at most an hour |
| Order details about the person who paid for a plan | as long as the plan exists, and then as part of the payment and accounting records below |
| Payment and accounting records | 7 years, as accounting law requires |
| Security data (login attempts) | 90 days |
| Technical logs | up to 90 days |
| Login sessions | until you close your browser after a password login; otherwise up to 2 weeks |
| Backups of our database | up to 30 days |
| Emails you send us | up to 2 years after we last dealt with your message |
| Things stored on your device (clause 2) | until you clear them in your browser; the copy of your topic-question work is removed when you log out |
What deletion removes. When you ask us to delete your account, we delete your account and profile details, your study set-up, your learning data and your subscription record, and we remove you from our backups when they expire. We keep only what the law requires us to keep, such as accounting records, and security data until its retention period ends. Stripe and Link keep their own records of your payments under their own policies; you can ask Link to delete its record of your orders by deleting your Link account, as its privacy centre at https://link.com/privacy-center explains. Things stored on your device stay there until you clear them, except the copy of your topic-question work, which is removed when you log out.
9. Your rights and how to complain
You have the right to:
- see the personal data we hold about you, and get a copy;
- correct it if it is wrong;
- delete it (the "right to be forgotten"), subject to what the law requires us to keep;
- restrict how we use it in some situations;
- receive the data you gave us in a machine-readable form, and have it sent to another service where that is technically possible;
- object to our use of your data where we rely on a legitimate interest;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, including deleting your account or getting a copy of your data, email help@examstudyaid.com from the email address on your account. We may ask you to confirm your identity. We reply within one month. There is no charge. A parent or guardian may use these rights for a child; we may ask for proof of the relationship.
Complaints. If you are unhappy with how we handle your data, complain to us first at help@examstudyaid.com. We acknowledge every complaint, look into it, and reply in plain language, in a way that is suitable for your age. You can also complain to a data protection authority:
- In Estonia, our lead authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee, info@aki.ee.
- If you are in the United Kingdom: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, www.ico.org.uk.
- If you are elsewhere in the EEA, you can complain to the data protection authority in your own country.
10. If you live outside the EEA and the UK
We apply the rules in this policy to everyone, wherever they live. The law where you live may give you additional rights, for example a right to complain to your own data protection regulator or a right to specific information. If so, email help@examstudyaid.com and tell us where you live, and we will apply the rights your law gives you.
11. Security
- The service is only available over an encrypted connection.
- Passwords are stored in scrambled form; we cannot read them.
- Login attempts are limited, and repeated failures from the same address are blocked for a while.
- Card details are entered on Stripe's page and never reach us.
- Access to personal data is limited to the people who run the service and protected by their own credentials.
- Our providers in clause 6 run their own security programmes and are bound by contract to protect your data.
No system is perfectly secure. If we ever discover a breach that puts you at risk, we will tell you and the relevant authority as the law requires.
12. Cookies and browser storage
Cookies are small files a website stores in your browser. We use only the cookies the service needs to work and stay secure. We do not use analytics, advertising or tracking cookies. The only cookies another company sets on our site are the two Cloudflare security cookies in the table, and only while its protection against automated attacks is switched on. Because of this we do not show a cookie banner.
| Cookie | Set by | What it does | Category | How long it lasts |
|---|---|---|---|---|
| sessionid | us | Keeps you logged in and remembers your steps during sign-in and checkout | Strictly necessary | until you close your browser after a password login; otherwise up to 2 weeks |
| csrftoken | us | Protects forms against forgery attacks. It is set on your first visit | Strictly necessary | about 1 year |
| messages | us | Shows you a one-off status message after an action, such as "password changed" | Strictly necessary | until you close your browser |
| __cf_bm | Cloudflare, only while its protection against automated attacks is switched on | Helps tell real visitors from automated traffic | Strictly necessary | 30 minutes after your last activity |
| cf_clearance | Cloudflare, only while that protection is switched on | Records that your browser passed Cloudflare's security check | Strictly necessary | up to 1 year |
Browser storage. Our own scripts also store a few things on your device that are not cookies. Clause 2 lists them and says how long they stay.
Other companies' pages. Stripe's checkout page and billing portal, and your Link account, are on those companies' own websites. They set their own cookies there, including cookies used to prevent payment fraud, under their own cookie policies. We do not load Stripe's scripts on our own pages.
Your choices. You can block or delete cookies in your browser settings. If you block the strictly necessary cookies, you will not be able to log in or pay.
13. Changes to this policy and contact
We may change this policy when the service or the law changes. If a change is important, we email you before it takes effect. The version number and effective date at the top tell you which version applies. We keep earlier versions and will send you one if you ask.
Questions about this policy or your data: help@examstudyaid.com. Post: ExamStudyAid OÜ, Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn, Harju maakond, 10115, Estonia.