Privacy Policy

Last Updated: 26 October 2026

This policy explains what personal data StudyLab.app ("StudyLab", "we", "us") collects, why, who processes it for us, how long we keep it, and your rights. We wrote it in plain language. If anything is unclear, write to [email protected].

1. Who we are

StudyLab is the controller of your personal data. For anything about your data, contact [email protected].

2. What we collect

  • Account data: your name, email address and password (stored only as a secure hash), and your settings, including whether you want news emails.
  • Study data: the notes you add (PDF files or pasted text) and the text we read from them; your exam type, subject and date; the questions, quizzes, flashcards and study plans made from your notes; your answers, scores and progress per topic.
  • Guest data: if you start a mock exam without an account, we keep it under a guest record, linked to your browser by a cookie, until you save it to an account or it expires.
  • Payment data: Stripe handles your card details; we never see or store them. We keep what we need to give you what you paid for: your Stripe customer ID, what you bought, the amount, the dates, and refunds.
  • Messages: support requests, feedback you send through the feedback button (with any attachment), and emails you send us.
  • Email records: which news emails we sent you, your unsubscribe and resubscribe choices, and delivery reports from our email provider (delivered, bounced, marked as spam).
  • Technical data: your IP address, browser type and the pages you request, in our server logs and in the analytics described in section 8. We use your IP address to limit abuse, for example how many free exams one connection can start in a day.

3. Why we use it, and on what legal basis

  • To provide StudyLab (your account, mock exams, quizzes, flashcards, study plans and the Exam Pass): this is needed to perform our contract with you (GDPR Art. 6(1)(b)).
  • To take payments and keep tax records: contract, and our legal obligations under tax law (Art. 6(1)(c)).
  • Account emails (password resets, purchase confirmations, and notices about important changes to StudyLab or these terms): contract, and our legitimate interest in keeping you informed about your account (Art. 6(1)(f)). These are sent whatever your news setting is.
  • News and offers by email (new features, and offers for StudyLab services like the ones you use): our legitimate interest in telling existing users about StudyLab (Art. 6(1)(f)), and for email the rule that lets a business write to its own users about similar services. You can refuse when you sign up, and object at any time after that, for free: use the unsubscribe link in any news email, or switch news emails off on your profile page.
  • Support and feedback: our legitimate interest in answering you and improving StudyLab.
  • Security and reliability (abuse limits, error monitoring, backups): our legitimate interest in keeping StudyLab safe and working.
  • Analytics: see section 8.

We do not sell your data, we do not show ads, and we do not use your notes to train AI models.

4. How AI is used on your notes

Text is read from your notes on our own server, including text recognition (OCR) for scanned pages. To write questions, flashcards and topic lists, we send the text of your notes to an AI provider through its API: Anthropic (Claude, United States). We may also use OpenAI (United States). Both are based in the United States; we do not send your notes to providers in China. The provider returns the questions; we store them in your account. No decision with legal or similarly significant effects is made about you automatically.

5. Who processes your data for us

These providers process personal data on our behalf, only for the purposes above:

  • Hetzner (Germany): hosts our servers, located in Helsinki, Finland.
  • Cloudflare (United States): delivers and protects the website, forwards email sent to our address, and stores our encrypted backups in the EU.
  • Stripe (Ireland and United States): payments.
  • Mailgun (United States): sends our emails and reports their delivery.
  • Anthropic and OpenAI (United States): AI processing of your notes, as described in section 4.
  • Google (United States): the mailbox our support email arrives in.
  • Telegram: sends us alerts about new feedback and system errors. A feedback alert includes your name, email address and message.

We also share data when the law requires it, for example with tax or other public authorities.

6. Transfers outside the EU

Some providers above are in the United States. For them we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards.

7. How long we keep it

  • Your account: until you ask us to delete it.
  • Notes on a free account: deleted after 90 days without any activity (no login, upload or quiz).
  • Notes for an exam: kept until at least 30 days after the exam date, then deleted once the account is inactive as above.
  • Guest exams not saved to an account: deleted 14 days after they were started.
  • Payment and tax records: as long as tax law requires, which in Italy is 10 years.
  • Email delivery reports: 90 days.
  • Backups: up to about one month.
  • Server logs: about two weeks.
  • Support and feedback messages: as long as we need them to handle your request.

8. Cookies and analytics

We use these cookies to make StudyLab work:

  • studylab_session and XSRF-TOKEN: keep you logged in and protect forms. They expire after 2 hours without activity.
  • remember_web_…: keeps you logged in if you tick "Remember me".
  • studylab_guest: links a mock exam to your browser before you have an account. Expires after 14 days.

To understand how the site is used, we count visits with Umami, which runs on our own server and sets no cookies. We use no advertising or tracking cookies. Fonts and scripts are served from our own server. Apart from Cloudflare, which delivers our pages, your browser contacts no other company while you use StudyLab, until you choose to pay on Stripe's checkout page.

9. Your rights

Under the GDPR you can ask us to:

  • give you a copy of your data, including in a portable format;
  • correct data that is wrong;
  • delete your data;
  • restrict how we use it;
  • stop using it where we rely on legitimate interests. For news emails we always stop.

Write to [email protected]. We answer within one month. You can also complain to a data protection authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).

10. Age

StudyLab is for students aged 14 and over. If you are younger than 14, do not use StudyLab or give us your data.

11. Security

Data travels over encrypted connections (TLS). Passwords are stored only as secure hashes. Backups are encrypted before they leave our server. Access to our systems is limited and protected.

12. Changes to this policy

When we change this policy in a way that matters, we tell you by email before the change applies, and we update the date at the top of this page.