Privacy Policy

01

Who controls the processing

02

Data that may be processed

Depending on the features you use, Studyh may process:

• Account and authentication: account identifiers, email, authentication information and data needed to maintain access.
• Materials and study history: uploaded or created materials, kits, flashcards, questions, summaries, mind maps, sessions, answers, performance signals and history.
• Payments and transactions: selected plan, payment status, transaction identifiers, receipts and information needed for billing, reconciliation and support. Full card details are handled by the applicable payment provider.
• Support: messages, attachments, contact details and information you choose to include in a request.
• Logs and security: IP address, device, browser, access times, errors and signals needed for security, abuse prevention and incident investigation.
• Analytics and cookies: events, metrics and identifiers from cookies or similar technologies when the relevant tool is enabled.
• Local browser data: information kept in localStorage, such as sessions, maps and synchronization data. This can exist in addition to the copy associated with your account.
• AI and audio content: text, files, answers or other material submitted for AI generation or evaluation. In Feynman mode, a voice recording may be processed online for transcription and the transcript may be used in the study flow.

Do not send sensitive data or another person's information without authorization. Studyh does not request sensitive data for ordinary use.

03

Purposes and indicative legal bases

The bases below are indicative. The applicable basis may depend on the context, the feature used and the law in force.

• Account and service delivery: create and maintain your account, authenticate, host study data, synchronize and provide contracted features — performance of a contract.
• Billing and legal obligations: process payments, provide receipts, reconcile transactions and comply with obligations — performance of a contract and legal obligation.
• Security, fraud prevention and logs: protect the platform, prevent abuse, detect fraud and defend rights — legitimate interest and/or legal obligation.
• Analytics and non-essential communications: measure use, test improvements or send non-essential messages — consent where required.
• Support and privacy requests: answer questions, handle requests and keep service records — performance of a contract or legitimate interest.

04

Retention and deletion

• Materials and study history: kept while the account is active. After a valid deletion request, Studyh starts deletion within 30 days, except where retention is needed for a legal obligation, security or the exercise or defense of rights.
• LocalStorage: Studyh does not automatically clear browser storage; you must clear it in each browser and device where you used the service.
• Payments and transactions: kept as needed for legal and accounting obligations, fraud prevention and the exercise or defense of rights.
• Support and privacy requests: kept as needed to answer, audit support and exercise or defend rights.
• External providers: may apply their own retention periods and rules. Studyh does not promise a third party's retention period.

05

Sharing and providers

Studyh may share the data needed to provide the service with the following contracted providers and configured tools:

• Supabase: authentication, application database and storage.
• Stripe: card payments.
• AbacatePay: PIX payments.
• PostHog: analytics, when configured.
• Resend: transactional email.
• Deepgram: online audio transcription.
• Provedor externo de processamento de IA: content generation and evaluation when you use AI features.

Content needed to generate or evaluate a response is sent to an external AI processing provider's API only to perform that request. Studyh stores the materials and results needed to provide account history and synchronization. You should also consult the provider's policy to understand the processing and retention that apply to that transmission. Studyh does not use your materials to train its own model. An external provider may have its own rules about retention or model improvement; this policy does not promise zero retention, anonymity or the absence of third-party training.

Data may also be shared when needed to comply with law, respond to competent authorities, prevent fraud, protect people or exercise and defend rights. Studyh does not sell personal data.

06

International transfers

Some providers may process or store data outside Brazil. Studyh will apply the safeguards required for the relevant transfer and will update this policy or use an appropriate channel when material changes need to be communicated. This page does not assert a specific transfer mechanism without reviewing the concrete arrangement.

07

Cookies, analytics and local storage

• Cookies and similar technologies may be used for authentication, security and essential operation.
• PostHog is used for analytics only when the required environment configuration is enabled; Studyh does not claim that a consent manager is implemented in every environment.
• Similar technologies may remember preferences, measure events or maintain sessions, depending on the service configuration.
• localStorage may keep sessions, maps and synchronization information in your browser. You can clear it in your browser settings.

08

Children and teenagers

Studyh is not directed to children under 13. Minors should use the service with the supervision and authorization of a parent or legal guardian. Do not send sensitive data. If you identify a minor's data or need to request its deletion, contact contact@studyh.tech.

09

Your rights and how to request them

Where applicable, you may request confirmation and access, correction, deletion subject to legal exceptions, portability, information about sharing, and opposition or withdrawal of consent where applicable.

Send your request to contact@studyh.tech. Include your account email or identifier, a detailed request and proportional identity confirmation to prevent improper access. Studyh will respond within the applicable legal deadline. A request may be limited or refused when required by law or needed for security, fraud prevention or the exercise or defense of rights.

10

Security and incidents

Studyh uses technical and administrative measures compatible with the service, such as authentication, access controls, route protection and event monitoring. No system is completely secure. If you suspect unauthorized access, a vulnerability or an incident, contact contact@studyh.tech promptly with the details you can share. We will assess the case and take the measures and communications required by applicable law.

11

Changes and contact

Studyh may update this policy to reflect changes to the service, providers or law. The current version will be published on this page and material changes may be communicated through an appropriate channel.

Privacy, LGPD, security or data questions: contact@studyh.tech.