Privacy Policy

We wrote this summary for students. The full policy follows.

• We use what you paste or upload only to make your study materials, save them for you and run Aripsy.
• We don't sell your data, we don't show ads and we don't use your notes to train AI models.
• Audio files and scanned pages are turned into text on your own device.
• Analytics cookies, session recordings and Google Analytics only run if you choose Accept All. Change this any time with the Change cookie settings button at the top of this page.
• You can see, correct, download or delete your data. Deleting your account deletes your saved study sets.
• If you're under 13, please don't use Aripsy. If you're under 18, talk to a parent or carer about the study apps you use.
• Questions? Email support@aripsy.com. You can also complain to the UK Information Commissioner's Office (ICO).

Aripsy (aripsy.com) is responsible for your personal data as the "controller". You can reach us about anything in this policy at support@aripsy.com.

When you buy a plan, Paddle.com Market Limited sells it to you as our reseller ("merchant of record"). Paddle is a separate controller for the payment and tax information it collects, under its own privacy notice at paddle.com/legal/privacy.

• Account details: your email address, a sign-in identifier, and your name and profile picture if you sign in with Google. Date of birth is optional.
• Study set-up: your goal, level, exam board, subjects and exam date, if you add them.
• Study material: text you paste; text taken from PDF, PowerPoint and Word files you upload; images of pages or figures when you ask Aripsy to describe document visuals; and transcripts made from audio files.
• What Aripsy creates for you: notes, flashcards, questions, answers you submit for checking and the feedback on them, tutor questions, collections, share links, flashcard review history and study activity.
• Billing: your plan, subscription status, and Paddle customer and subscription IDs. Paddle collects your payment details. We never see your full card number.
• Messages and email: messages you send us, your email preferences and consent records, and whether our emails were delivered.
• Technical data: IP address, browser and device type, pages visited, approximate country, error logs, usage counts we use for plan limits and abuse prevention, and per-account usage records (the days you used Aripsy, the features you used, and AI requests with token counts, never your study text). We keep these for up to 24 months; when you delete your account they are deleted or unlinked from you.
• Connected apps: if you connect an AI assistant to Aripsy, the authorisation you gave and the study packs it creates.
• Analytics data, only as described in section 9.

Turning audio into text, and reading text from scanned PDF pages, happens in your browser. Those audio files and page images are not uploaded to us. Only the resulting text is sent, when you choose to generate study material.

UK and EU data protection law requires a legal basis for each use. Ours are:

• To provide Aripsy (create, save and share study materials; run your account and plan limits; send sign-in, receipt and service emails): performing our contract with you.
• To keep Aripsy safe and working (rate limits, abuse and fraud prevention, security logs, fixing errors): our legitimate interests.
• To measure and improve Aripsy with usage records, aggregated statistics and AI quality measures such as response times and token counts (these don't include your study text): our legitimate interests.
• Analytics cookies, heatmaps, session recordings and Google Analytics: your consent.
• Product updates and study-tip emails: your consent. You can unsubscribe in any email or in Settings.
• Reminders about a checkout you started but did not finish, sent to the email on your account: our legitimate interest in completing a purchase you began (the "soft opt-in" rule in UK PECR regulation 22(3)). We tell you at checkout, send at most two reminders, and every one has an unsubscribe link; opting out of product updates stops them too.
• Keeping records for tax, accounting and legal claims: legal obligation and our legitimate interests.

Our legitimate interests are running a safe, reliable study service and understanding how people use it. We balance them against your rights and take extra care because many of our users are young. You can object at any time (section 11).

You need an email address to create an account. Everything else is optional, though some features won't work without it.

When you generate study materials, we send the relevant study text, and any images you choose to analyse, to our AI providers, Anthropic (Claude) and SiliconFlow. They process this to return the result. Aripsy does not train AI models on your study content. Please don't include sensitive personal information you don't need for studying, such as health details or other people's information.

Aripsy uses AI to generate study materials and to estimate marks for practice answers. These are study aids only. They have no legal or similarly significant effect on you, and you are free to ignore them.

We don't sell or rent personal data, and we don't share it for advertising. We use these service providers, which act on our instructions:

• Supabase: accounts, database and file storage
• Anthropic: AI generation (Claude models; US)
• SiliconFlow: AI generation
• Vercel: website hosting and, with your consent, performance measurement (United States and global network)
• Paddle: payments, tax and invoices, as merchant of record (United Kingdom)
• Resend: sign-in and service emails (United States)
• Brevo: product and study-tip emails you opted into (European Union)
• PostHog: product analytics and, with your consent, cookies and session recordings (United States)
• Google: Sign in with Google, and Google Analytics if you allow analytics (United States)
• Ahrefs: cookie-free, aggregated website statistics

Some providers process data outside the UK, including in the United States and the European Union. When personal data leaves the UK, we rely on UK adequacy regulations (for example for the EU and for US companies certified under the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Addendum and standard contractual clauses in our providers' data processing terms. Contact us for more detail.

We may also share data when the law requires it, to protect people's safety or our legal rights, with apps you choose to connect, or with a buyer if Aripsy is sold (we would tell you first).

• Always on, because Aripsy needs them: sign-in session cookies, security protections and the record of your privacy choice.
• Also set on your first visit, without asking: a small first-party cookie that remembers which link or page brought you here (campaign, landing page, referring site, date) and, if you came from a friend's link, their referral code. Each lasts 30 days and is read when you sign up, to record where your account came from and apply any referral reward. The cookie itself goes to no one else; the resulting source (for example "search" or "referral") is stored in your usage records and sent to PostHog only if you chose Accept All.
• Preferences, such as language and settings, are stored in your browser.
• Only if you choose Accept All: PostHog analytics cookies, heatmaps and session recordings, and Google Analytics. Session recordings mask form inputs, but study content shown on screen may be recorded.
• If you choose Essential Only: Google Analytics and Vercel analytics don't run, and PostHog only records anonymous page and feature usage in cookie-free mode, without storing an identifier on your device. Until you make a choice, no analytics cookies are set. Ahrefs always runs cookie-free.
• Session recordings are always switched off on shared study pages.
• You can change your choice at any time with the Change cookie settings button at the top of this page.

• Account and saved study sets: while your account is open, until you delete them. Your plan controls how much past history is shown.
• Share links: Free links expire after up to 7 days and Pro links after up to 30 days. Expired links are then deleted.
• Usage and rate-limit records: only as long as needed to apply plan limits and prevent abuse.
• Per-account usage records: up to 24 months, then deleted; unlinked from you as soon as you delete your account.
• Email consent records: as long as we need to show you agreed, and for a reasonable time after you withdraw.
• Billing records: Paddle keeps them as tax law requires. We keep your subscription status while your account exists.
• Analytics: as long as useful to improve Aripsy, then deleted or made anonymous.
• When you delete your account, we delete your data from our live systems straight away and ask our email and analytics providers to delete it within 30 days. Copies in encrypted backups are overwritten on a rolling basis.

You have the right to access your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. Withdrawing consent doesn't affect what we did before.

You can edit your details and delete your account in Settings, export study sets from the app, and email support@aripsy.com for anything else. We reply within one month, free of charge, and may need to confirm it's you.

If you're unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU, you can contact your local data protection authority.

• Aripsy is not for children under 13. If we learn that a child under 13 has an account, we will delete it.
• For everyone under 18 we use privacy-friendly defaults: no ads, no advertising profiles, analytics cookies off unless you choose Accept All, no precise location, and study sets private unless you create a share link.
• Parents and carers can contact us to ask about, or delete, their child's data.
• The short version at the top of this policy is written for younger readers.

We use encryption in transit (HTTPS), access controls, authentication and regular security reviews. No online service is completely secure. If a breach puts you at high risk, we will tell you without undue delay.

When we change this policy, we update the date above. For important changes, we tell you by email or in the app before they take effect.

Contact: support@aripsy.com