Privacy Policy
Last updated: 22 September 2026 · aigovernance.study · Terms of Use · Refund Policy
1. Who we are
AI Governance Study ("we", "us") is operated by Study AI Ltd, a company registered in England and Wales (company number 17348590, registered office 167-169 Great Portland Street, London, W1W 5PF). We are the data controller for the personal data described in this policy. Contact: support@aigovernance.study.
2. What we collect, and why
| Data | Why we collect it | Legal basis (UK GDPR) |
|---|---|---|
| Your email address and a hashed password — or, if you choose "Continue with Google", the email address of your Google account and Google's confirmation that it is yours (we receive no other Google data and never your Google password) | To create and secure your account and sign you in | Contract |
| Your study progress (topics read, practice and flashcard results, exam scores) | To run the app and sync your progress across your devices | Contract |
| Your exam date, if you set one, and when you set it | To count down to it in the app, and to email you a study plan the day after you set it and reminders a week and a day before. Turn these off under Account → Exam reminders, or with the link in any of them | Contract; legitimate interests |
| Your free-tier record: when your free access started and ends, and your diagnostic exam result (score, answers, breakdown by section) | To run the free tier and show you your diagnostic result; deleted with your account | Contract |
| Purchase records for access passes and the weekly plan (what you bought, when, a transaction reference, and for the weekly plan its status and next billing date — never your card details) | To grant and manage your access, let you cancel or resume the weekly plan, and meet tax and accounting obligations | Contract; legal obligation |
| Emails we send you (account confirmation, password reset, service notices about your account or the terms) and their delivery status | Account security and service operation | Contract; legitimate interests |
| Messages you send us through Contact support in the app (your message, your account email, when it was sent) | To answer you; kept in our support mailbox | Contract; legitimate interests |
| Sign-up context: the country your connection comes from, the page on our site you first arrived at and, where present, the site or campaign link that referred you | Recorded once at sign-up so we can understand, in aggregate, where our users come from; deleted with your account. (Your browser notes the first-arrival page and referrer on your first visit — see section 5 — and it reaches us only if you then create an account.) | Legitimate interests |
| A record of your agreement to our terms (date and version) and of your choice about email offers | To show what you agreed to, and to make sure study tips and offers stop the moment you say so; deleted with your account | Legal obligation; legitimate interests |
That is the full list. We do not collect precise location data, contacts, advertising identifiers, or behavioural analytics profiles. We do not sell or share personal data with anyone for advertising.
Study tips and offers by email. Because you signed up for the course, we may occasionally email you about the course itself — new features, study tips, and offers on the weekly plan or a pass. This relies on the "soft opt-in" for existing customers under the UK's Privacy and Electronic Communications Regulations, and on our legitimate interest in telling people who study with us about the service. You can refuse when you sign up, turn it off at any time under Account → Tips and offers, or use the link at the foot of any such email, and we stop at once. Messages about your account, purchases and the terms are separate and always sent.
3. Payments
Purchases are processed by Paddle, acting as merchant of record — Paddle is the seller of record for your transaction and handles your payment details under its own privacy policy. We never see or store your card number. For the weekly plan, Paddle also takes each renewal and tells us whether the subscription is running, cancelled, or past due, and when the next charge is due. We receive only confirmation that a purchase occurred, the plan or pass purchased, and the email associated with it.
4. Who processes data on our behalf
| Provider | Role |
|---|---|
| Supabase | Database and authentication (your account and progress data, protected by row-level security so only your account can read your rows) |
| Cloudflare | Web hosting (Cloudflare Pages), DNS, email routing for our domain, and Cloudflare Web Analytics — page-view counts that use no cookies, do not identify you, and do not track you across sites |
| "Continue with Google" sign-in, only if you choose it; Google's own privacy policy applies to your Google account | |
| Resend | Delivery of transactional email (confirmation, password reset, service notices, exam reminders), your support messages to us, and — only if you opted in — study tips and offers |
| Paddle | Payments and subscriptions, as merchant of record (section 3) |
These providers act under contracts that restrict their use of your data to providing their service to us. Some may process data outside the UK/EEA; where they do, transfers are protected by recognised safeguards such as the UK Addendum / EU Standard Contractual Clauses.
5. Cookies and local storage
We use no advertising or tracking cookies, and no analytics that identifies you. Page views are counted by Cloudflare Web Analytics, which sets no cookie and builds no profile. The app stores your session token, study progress and your free-tier status in your browser's local storage — strictly necessary for the app to function (staying signed in, working offline). On your first visit to the site your browser also notes, in local storage, the page you arrived at and any referring site or campaign link; this stays on your device and is sent to us once, as your sign-up context, only if you create an account. Clearing your browser data removes all of it.
6. How long we keep data
- Account, progress and free-tier data: until you delete it or your account.
- Purchase and entitlement records: for as long as required for tax, accounting and legal purposes (typically 6 years in the UK).
- Support messages: only for as long as needed to deal with your query, then deleted — unless a complaint or dispute is open, in which case until it is resolved.
- Email delivery logs: kept briefly by our email provider for deliverability and abuse prevention, then deleted.
7. Your rights
Under UK GDPR you can ask us to access, correct, delete, restrict, or port your personal data, and you can object to processing based on legitimate interests. Two of these you can do instantly yourself:
- Reset your study progress: in the app, Account → Reset progress. This clears your progress and keeps your account.
- Delete your account entirely: in the app, Account → Delete account. This removes your sign-in, your progress, your free-tier record and any access pass, immediately and permanently, and cancels a weekly plan. Full instructions are on the account deletion page.
- Everything else (a copy of your data, corrections): email support@aigovernance.study — we respond within one month.
One limit on erasure: if you have bought an access pass, we must keep the transaction record for tax and accounting purposes (typically 6 years in the UK). Deleting your account removes the link between those records and you, leaving the transaction without your identity attached, rather than deleting the accounting record itself.
If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
8. Children
The service is designed for working professionals preparing for a professional certification and is not directed at children under 16. We do not knowingly collect data from them.
9. Changes to this policy
If we make material changes, we'll update this page and its date, and for significant changes notify you by email or an in-app notice before they take effect.