Privacy Policy

1. Who we are and our role

PathShalaAi is the operator of the Service and acts as the data controller for the personal data we collect and process about you through the Service. Where Paddle processes payments on our behalf, Paddle acts as Merchant of Record and an independent controller for the personal data it collects to complete your purchase.

2. Personal data we collect

• Account data: name, email address, password (in hashed form), university, role, profile picture.
• Workspace content: classrooms you create or join, materials you upload, notes, flashcards, quizzes, and messages exchanged with the AI tutor.
• Usage data: pages viewed, features used, study activity, device and browser information, IP address, and approximate location.
• Communications: emails, support tickets, and newsletter subscriptions.

3. How we use your data and our legal basis

• To provide the Service — creating your account, powering classrooms, study tools and the AI tutor. Legal basis: performance of a contract.
• To keep the Service secure — preventing fraud, abuse, and unauthorized access. Legal basis: legitimate interests.
• To improve the Service — analytics on how features are used so we can make them better. Legal basis: legitimate interests.
• To send transactional and product emails — for example sign-in links, receipts, and important changes. Legal basis: performance of a contract / legal obligation.
• To send marketing emails or newsletters — only where you have asked to receive them. Legal basis: consent (which you can withdraw at any time).
• To comply with the law — for example tax, accounting, and responses to lawful requests. Legal basis: legal obligation.

4. Sharing your data

Content you post inside a classroom is visible to other members of that classroom. Beyond that, we only share personal data with:

• Service providers / subprocessors we rely on to run the Service — for hosting, database, storage, email delivery, and AI inference.
• Paddle.com, our Merchant of Record, for processing payments, managing subscriptions, calculating taxes, and issuing invoices and refunds.
• Professional advisers such as lawyers and accountants, where necessary.
• Authorities where we are required to do so by law.

We do not sell your personal data.

5. International transfers

Our service providers may be located outside your country. When personal data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

6. Data retention

We keep personal data only for as long as needed for the purposes described above:

• Account and workspace content: kept while your account is active and deleted within 30 days after you delete your account, unless we need to retain it for legal reasons.
• Payment and billing records: retained by Paddle and by us for up to 7 years to comply with tax and accounting obligations.
• Support communications: retained for up to 2 years after the conversation closes.
• Server and security logs: retained for up to 12 months.

7. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data ("right to erasure");
• request that we restrict or object to certain processing;
• receive a portable copy of the data you provided to us ("data portability");
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data protection authority.

You can exercise most of these rights from inside the workspace, or by contacting us using the details below. We aim to respond within one month.

8. Security

We use industry-standard safeguards to protect your data, including encryption in transit, row-level access controls in our database, and protection against leaked passwords. No system is fully secure, but we work continuously to keep your data safe.

9. Cookies

We use essential cookies and similar technologies to keep you signed in and to remember your preferences. Where we use analytics, we do so to understand how the Service is used and to improve it. You can manage cookies through your browser settings.

10. Children

The Service is intended for university-level students and is not directed at children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal data from children below that age.

11. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes we will notify you through the Service or by email.

12. Contact us

For any questions about this Privacy Policy or to exercise your rights, contact PathShalaAi through the support options inside the workspace.