StudyBuddy Privacy Policy

Effective date: October 14, 2026

This Privacy Policy explains how StudyBuddy ("StudyBuddy", "we", "us") collects, uses, shares and protects your information when you use studybuddy.vc and any related applications (the "Service"). StudyBuddy is operated by Carlos Lopez, with address at Carretera México - Toluca 1535, Ciudad de México, Mexico, who is the party responsible for your personal data. You can contact us at [email protected].

By using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

1. Information we collect

Information you provide

Requests from professors. If you are a professor or represent an institution and request a pilot group from our page for professors, we collect your name, email, institution, the subject you teach or your role, and the message you write. We use that data only to answer your request and set up the pilot with you.

If we write to you without you contacting us first. If you are a professor and receive an email from us, we got your name and institutional email from publicly available sources, such as your university's directory. We use them only to invite you to learn about StudyBuddy. If you don't want us to write to you, reply and we'll stop.

Information collected automatically

Session recordings on the website. On the website we use PostHog to reconstruct how a page was used: where the cursor moved, where clicks happened and what the screen was showing at that moment. What you type into fields, such as your password, is recorded hidden. On the screens where a professor sees their students, all text is recorded hidden: their names, emails and progress are not stored. We use these recordings only to find errors and improve the Service. The iPhone app does not record sessions.

Guest sessions

You can try the Service without creating an account. Guest sessions use a temporary account that is automatically deleted approximately 24 hours after creation, together with its documents and study data, unless you convert it into a full account.

2. How we use your information

Purposes necessary to provide the Service:

Optional purposes (not necessary to provide the Service):

You may oppose the optional purposes at any time by writing to [email protected], without this affecting your ability to use the Service. We do not sell your personal information.

3. AI processing of your content

To generate questions, flashcards, explanations and related study materials, the text (and, on eligible plans, images) of the documents you upload is sent to third party artificial intelligence providers, currently including OpenAI, which process it on our behalf to return the generated materials. YouTube links you submit are sent to a transcript provider to obtain the video transcript.

We use these providers under agreements that restrict their use of your content to providing the service to us. According to their published policies, content submitted through their business APIs is not used to train their models by default. We do not use your documents to train AI models of our own.

Generated study materials are produced by AI and may contain errors. See our Terms of Service for the related disclaimers.

4. Who we share information with

We share information only with service providers that help us operate StudyBuddy, and only what each one needs:

We may also disclose information if required by law, to protect our rights, to prevent fraud or abuse, or as part of a business transfer (such as a merger or acquisition), in which case this Policy would continue to apply to your information.

If you join a professor's group. Joining a group is voluntary. If you join:
1. Your professor sees, inside StudyBuddy, your name, your email, the date you joined and your practice on that group's material: when you last practiced, how many questions you've answered, how you're doing on each topic and, in some cases, which questions you missed.
2. Your professor can send you reminders to practice, by email or notification.
3. Your professor receives summaries of the group's progress, by email and inside StudyBuddy. Some are prepared with artificial intelligence, through providers that work on our behalf. They are informational: StudyBuddy does not grade you.
4. Your professor does not see your personal documents, what you study outside the group, or your payment information.
Sharing this data with your professor is a transfer you accept when you join the group. Your professor agrees to use it only to support your study in that class and not to share it. You can leave the group whenever you want from Settings, with the "Leave" button: from that moment your professor stops seeing you. Your professor can also remove you from the group. If you are under 18, you need the authorization of your mother, father or guardian to join a group. Your rights over this data, and how to exercise them, are in section 9 of this Policy.

5. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to operate the Service (for example, keeping you signed in), plus analytics and advertising measurement technologies as described above. You can control cookies through your browser settings; disabling essential cookies may prevent the Service from working. Where required by the laws of your region, we will request your consent for non essential technologies.

6. Data retention

7. Deleting your account

You may request deletion of your account at any time by contacting [email protected], and, where available, through the account deletion option inside the Service. Deletion permanently removes your account and your personal data, including your documents and study history, subject to Section 8 below and to records we must keep by law (such as transaction records). Deleting your account cancels any active subscription billed through our website (Stripe) immediately. Subscriptions billed through Apple cannot be cancelled by us: you must cancel them yourself in your Apple ID subscription settings, or Apple will continue to charge you. Our payment processors (Stripe and Apple) retain the records they hold on their side under their own privacy policies; deleting your StudyBuddy account does not delete those records. For fraud prevention, the email address of a deleted account cannot be used to register again for 30 days.

8. Fraud prevention records

To prevent abuse of free usage limits (for example, deleting and recreating accounts to obtain new free credits), after an account is deleted we may retain a minimal fraud prevention record consisting of hashed identifiers (such as a hash of the email address and the device fingerprint) together with usage counters, the date of deletion and the plan the account had when it was deleted. If we are unable to notify Apple of the disconnection at the moment of deletion, the authentication token described in Section 1 may be retained temporarily until the notification succeeds, and is deleted no later than 90 days after the account deletion. These records cannot be used to identify you in the ordinary course and are used solely to enforce usage limits, prevent fraud and comply with legal obligations. We consider this our legitimate interest, and where applicable law requires a different basis we rely on that basis.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

Revoking consent and limiting use or disclosure. Where processing is based on your consent, you may revoke it at any time, without retroactive effect, by writing to [email protected]. Through the same address you may request that we limit the use or disclosure of your data for optional purposes such as analytics or advertising measurement, and you can control cookies from your browser as described in Section 5. If you are in Mexico and are not satisfied with our response, you may file a complaint with the data protection authority (currently the Secretaría Anticorrupción y Buen Gobierno).

To exercise any right, contact [email protected]. We may need to verify your identity before acting on a request.

10. International transfers

Our service providers process data in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers, such as our providers' standard contractual clauses and equivalent mechanisms.

11. Security

We use technical and organizational measures appropriate to the nature of the data, including encryption in transit, hashed passwords, access controls and isolation of payment processing with Stripe. No system is completely secure, and we cannot guarantee absolute security.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you are under the age required by your jurisdiction to consent to data processing, you may only use the Service with the consent of a parent or guardian. If you believe a child has provided us personal data, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. Non material changes (such as clarifications, corrections or the replacement of a provider with an equivalent one) take effect upon posting, with the "Effective date" above updated. If we make material changes (such as new purposes, new categories of data, or new third parties receiving your data), we will notify you through the Service or by email before they take effect and, where the law requires it, we will request your consent again.

14. Contact

For any question about this Policy or your data, write to [email protected].