Privacy
Privacy policy
Last updated: September 23, 2026
This is a translation. In case of discrepancy, the French version prevails. Politique de confidentialité
StudAI is a study app for students. This page explains which data we process, why, for how long, who it is shared with and how to exercise your rights. It describes what the app actually does, not a generic template.
1. Who is responsible for your data
The data controller is StudAI, Cotonou, Bénin.
For any question about your data or to exercise your rights: aristofanedev@gmail.com, or the Exercise your rights form.
2. The legal framework
StudAI is built in Benin and complies with the Benin Digital Code (Law No. 2017-20 of April 20, 2018, Book V, on the protection of personal data). When you use StudAI from the European Union, the General Data Protection Regulation (GDPR) applies as well. For each processing activity, we state its purpose and its legal basis below.
3. The data, its purposes and how long we keep it
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: email or phone number, first name, password hash (Argon2, never the password in clear), verification and password change dates | Create your account, sign you in, secure access | Performance of the service you ask for (contract) | As long as your account exists |
| Study profile: field of study, level, goal (optional) | Complete your profile and set your daily goal | Contract. You can leave these fields empty | As long as your account exists |
| Reviews: decks, cards, answer history, XP, streak, freezes, review and notification preferences | Bring each card back at the right time, sync your devices | Contract | As long as your account exists |
| Imported documents: PDF or DOCX file, text extracted page by page, conversations with the assistant | Answer your questions citing the page, suggest cards | Contract; explicit consent for sending excerpts to the AI (section 6) | Until you delete the document or your account |
| "I am 18 and I agree" statement: age and consent to sending excerpts to DeepSeek (its date, never your date of birth) | Comply with the terms of the AI service, which exclude minors, and keep proof of your consent | Contract and explicit consent | As long as your account exists |
| AI usage counters: type of request, volume, date. Neither your question nor the answer | Apply the daily quota, keep costs under control | Legitimate interest | As long as your account exists |
| Connected devices: device name and platform, sign-in dates, session token hash | Show you your devices, sign out a lost phone | Contract and legitimate interest (security) | 60 days without use, or until you sign out |
| Push notification token | Send you the "New opportunities" alerts, at most once a week | Consent: the option is off by default | Until you turn the option off or sign out |
| Subscription: plan, activation and expiry dates | Give access to the features of your plan | Contract | As long as your account exists |
| Verification codes sent by email | Confirm your address, reset your password | Contract | Valid for 15 minutes |
| Contact form: name, email, subject, message, IP address | Reply to you; the IP address is only used to limit automated submissions | Legitimate interest | 12 months |
| Requests about your data (Exercise your rights form) | Handle your request and be able to prove it was handled | Legal obligation | 3 years after the request is closed |
| Technical server logs (errors, document analyses) | Run and secure the service | Legitimate interest | Limited in size and overwritten automatically |
Backups. The database is backed up every day and each backup is kept for 14 days. Deleted data therefore disappears from the backups at most 14 days after its deletion.
What stays on your phone. Your profile photo, your review reminders and, if you use StudAI without an account, all your decks and reviews stay on your device and are sent to no server.
Required data. The identifier and the password are needed to create an account. Without them, you can still use StudAI without an account, on a single phone. The rest of the information is optional.
4. What we don't do
- No ads, no selling or renting of your data.
- No profiling and no automated decision that would affect you. Computing a card's next review date only serves to organize your reviews.
- No direct marketing. If we ever did any, it would be with your prior consent, and you could object to it for free at any time.
- No cookies or trackers on this site, and no audience measurement tool in the app.
- We don't ask you for any sensitive data. Avoid importing documents that contain personal information, about you or about others, such as a medical record or identity documents.
5. Who receives your data
Only the members of the StudAI team who need it have access. We also use the following providers, who act on our instructions:
- Hosting. Server, database and imported files.
- DeepSeek (Hangzhou DeepSeek Artificial Intelligence, China): produces the assistant's answers and the suggested cards. It receives the document's name, the relevant excerpts, your question and the latest exchanges of the conversation. It receives neither your name, nor your identifier, nor your account, and never the whole document at once.
- Google Firebase Cloud Messaging (Google, United States): delivers the "New opportunities" alerts. It receives your device's token and the text of the notification, never your courses or your reviews.
- Our email delivery service: it sends the verification codes to your address.
Review reminders and the "streak at risk" alert are scheduled by your phone itself: nothing goes through our servers or through Google.
We only disclose your data to an authority when the law requires us to, upon a written and reasoned request.
6. Transfers outside Benin and the European Union
DeepSeek (China). China has not been recognized as offering an equivalent level of protection, neither by the APDP nor by the European Union. These transfers therefore rely on your explicit consent, in accordance with Article 392 of the Benin Digital Code and Article 49 of the GDPR. The app asks for it before your first question or card generation. Be aware that in China, the authorities may demand access to the data stored by a company. If you don't want a course to go to DeepSeek, don't import it: the decks you write yourself and your reviews never need it. You can withdraw your consent at any time by no longer using the assistant and deleting your documents.
Google (United States). Google frames these transfers with the European Commission's standard contractual clauses and its certification under the EU–US Data Privacy Framework.
7. Security
- Passwords hashed with Argon2, exchanges encrypted with HTTPS.
- 15-minute access tokens and a refresh token that changes on every use: a stolen token quickly stops working.
- Sign-in attempts and code sending are limited. Changing your password signs out your other devices.
- Your files are stored per account and deleted with it.
If a data breach posed a risk to your rights, we would notify the competent protection authority and, if the risk is high, the people concerned, within the time limits set by law.
8. Your rights
Regarding the data about you, you can at any time:
- access it and get a copy;
- have it corrected or completed;
- have it deleted;
- object to a processing activity on legitimate grounds, or withdraw your consent, without affecting what was done before;
- get it back in a machine-readable format (portability);
- ask for a processing activity to be restricted while a dispute is being examined.
After a death, the heirs can ask us to update the data or close the account.
How to do it:
- In the app, right away: edit your profile, delete a document or a conversation, sign out a device, turn off notifications, or "Supprimer le compte" (Delete account). This last action permanently erases your account, your decks, your cards, your history, your documents and their files, your conversations and your sessions.
- Without the app: the Exercise your rights form, or an email to aristofanedev@gmail.com.
It's free. We answer within 30 days. This time limit may be extended if the request is complex, in which case we let you know within the first month. To protect your account, we may ask you to confirm your identity, for example by writing to us from your account's address.
9. Minors
If you are under 16, the consent of a parent or legal guardian is required to create an account (Article 446 of the Benin Digital Code; Article 8 of the GDPR). Without an account, you can use StudAI on your phone without sending anything to our servers. The AI assistant is reserved for users 18 and over. Your decks and reviews remain available whatever your age.
10. Complaints
If you believe your rights are not being respected, write to us first: we always look for a solution. You can also go directly to the protection authority:
- In Benin: the Autorité de Protection des Données à caractère Personnel (APDP), Rue 6.076 Aïdjèdo, 01 BP 04837 Cotonou, contact@apdp.bj, apdp.bj.
- In the European Union: the authority of your country of residence (in France, the CNIL). List of authorities: edpb.europa.eu.
11. Changes
If this policy changes, the date at the top of the page is updated. Any significant change is announced in the app before it applies.
12. Contact us
aristofanedev@gmail.com, the Exercise your rights form or the contact form.