Privacy Policy
Last updated: 24 July 2026 · aigovernance.study · Terms of Use · Refund Policy
1. Who we are
AI Governance Study ("we", "us") is operated by Study AI Ltd, a company registered in England and Wales (company number 17348590, registered office 167-169 Great Portland Street, London, W1W 5PF). We are the data controller for the personal data described in this policy. Contact: support@aigovernance.study.
2. What we collect, and why
| Data | Why we collect it | Legal basis (UK GDPR) |
|---|---|---|
| Your email address and a hashed password | To create and secure your account and sign you in | Contract |
| Your study progress (topics read, practice and flashcard results, exam scores) | To run the app and sync your progress across your devices | Contract |
| Purchase records for access passes (what you bought, when, and a transaction reference — never your card details) | To grant and manage your access, and to meet tax and accounting obligations | Contract; legal obligation |
| Emails we send you (account confirmation, password reset) and their delivery status | Account security and service operation | Contract; legitimate interests |
| Sign-up context: the country your connection comes from and, where present, the site or campaign link that referred you | Recorded once at sign-up so we can understand, in aggregate, where our users come from; deleted with your account | Legitimate interests |
That is the full list. We do not collect precise location data, contacts, advertising identifiers, or behavioural analytics profiles. We do not sell or share personal data with anyone for advertising, and we send no marketing email unless you have expressly opted in to it.
3. Payments
Purchases are processed by Paddle, acting as merchant of record — Paddle is the seller of record for your transaction and handles your payment details under its own privacy policy. We never see or store your card number. We receive only confirmation that a purchase occurred, the pass purchased, and the email associated with it.
4. Who processes data on our behalf
| Provider | Role |
|---|---|
| Supabase | Database and authentication (your account and progress data, protected by row-level security so only your account can read your rows) |
| Cloudflare | Web hosting (Cloudflare Pages), DNS, and email routing for our domain |
| Resend | Delivery of transactional email (confirmation, password reset) |
These providers act under contracts that restrict their use of your data to providing their service to us. Some may process data outside the UK/EEA; where they do, transfers are protected by recognised safeguards such as the UK Addendum / EU Standard Contractual Clauses.
5. Cookies and local storage
We use no advertising or tracking cookies and no third-party analytics. The app stores your session token and study progress in your browser's local storage — strictly necessary for the app to function (staying signed in, working offline). Clearing your browser data removes it.
6. How long we keep data
- Account and progress data: until you delete it or your account.
- Purchase and entitlement records: for as long as required for tax, accounting and legal purposes (typically 6 years in the UK).
- Email delivery logs: kept briefly by our email provider for deliverability and abuse prevention, then deleted.
7. Your rights
Under UK GDPR you can ask us to access, correct, delete, restrict, or port your personal data, and you can object to processing based on legitimate interests. Two of these you can do instantly yourself:
- Reset your study progress: in the app, Account → Reset progress. This clears your progress and keeps your account.
- Delete your account entirely: in the app, Account → Delete account. This removes your sign-in, your progress and any access pass, immediately and permanently. Full instructions are on the account deletion page.
- Everything else (a copy of your data, corrections): email support@aigovernance.study — we respond within one month.
One limit on erasure: if you have bought an access pass, we must keep the transaction record for tax and accounting purposes (typically 6 years in the UK). Deleting your account removes the link between those records and you, leaving the transaction without your identity attached, rather than deleting the accounting record itself.
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
8. Children
The service is designed for working professionals preparing for a professional certification and is not directed at children under 16. We do not knowingly collect data from them.
9. Changes to this policy
If we make material changes, we'll update this page and its date, and for significant changes notify you by email or an in-app notice before they take effect.