How StudyCue handles your data

Who we are

StudyCue is operated by Eric Aytekin, a sole trader based in England & Wales. We are the data controller for the information described below. You can reach us at hello.studycue@gmail.com.

What we collect

• Account. Your email address, display name, year group, exam subjects and boards, exam dates, and any preferences you set in settings.
• Study content. Topics you mark, decks and flashcards you create or generate, grades you log, practice attempts, essays submitted to the marker, chat messages with the AI tutor, and short summaries the AI writes about your progress.
• Usage. AI run logs (prompt length, tokens, cost), product analytics events, error reports, and the endpoint of any browser push subscription you opt in to.
• Billing. Your Stripe customer ID and subscription tier. We do not store payment card details — those live with Stripe.
• Cookies. Authentication cookies set by Supabase (httpOnly), a small set of attribution cookies (e.g. studycue_utm_source) if you arrive via a tracked link, and an OAuth state cookie if you connect Google Calendar.

How we use it

To authenticate you, generate and adapt your study plan, run AI features, save progress across devices, send you transactional email and (if you opt in) push notifications, take payment for paid plans, monitor and protect the service against abuse, and improve the product.

Lawful bases (UK GDPR)

We rely on (a) contract — running the service you signed up for; (b) legitimate interests — keeping the service secure, debugging, lightweight product analytics, and handling support requests you send us; and (c) consent — for push notifications. You can withdraw consent at any time without affecting prior processing.

Third-party processors

We share the minimum data needed to operate the service with these processors:

• Supabase — authentication, Postgres database, and file storage (EU / US).
• Google (Gemini API) — the AI provider behind our tutor, plan generation, flashcard generation, and essay marking. Prompts and the curriculum context we attach are sent to Google to produce responses. Per Google's API terms, this data is not used to train Google's general models (EU / US).
• Stripe — payment processing, subscriptions, and webhook handling for paid plans (US / UK).
• Sentry — error and performance monitoring (EU / US).
• PostHog — product analytics and LLM trace observability (EU).
• Upstash Redis — rate limiting and lightweight caching (EU / US).
• Resend — transactional email delivery (EU).
• web-push / browser push services — Apple, Google, and Mozilla push relays deliver any push notifications you opt in to.

International transfers

Some processors (Supabase, Google, Stripe, Sentry) may process your data outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

Retention

We keep your account and study data while your account is active. When you delete your account from settings, we remove your authentication record and the dependent study data within 30 days. Some operational logs (e.g. error reports, payment records) are retained for a longer, limited period for legal or accounting reasons.

Your rights

Under UK GDPR you have the right to access, rectify, erase, or port your data; to restrict or object to certain processing; to withdraw consent; and to lodge a complaint with the Information Commissioner's Office at ico.org.uk. To exercise any right, email us at hello.studycue@gmail.com and we will respond within one month.

Children

StudyCue is intended for students aged 13 and over. We do not knowingly collect data from anyone under 13. If you believe we have, please contact us and we will remove the account.

Changes

If we make a material change to this policy we will update the date below and, where the change is significant, surface it in-app before it takes effect.