Privacy
Privacy Policy
How ISTUDYCLOUD INC. collects, uses, and protects your information while iStudyCloud is in closed alpha.
Effective Date: May 26, 2026
1. Overview & scope
This Privacy Policy describes how ISTUDYCLOUD INC. (a British Columbia, Canada corporation, registration number BC1383084, "Company", "we", "us") handles personal information when you use iStudyCloud — the AI-powered learning and creator workspace available through istudycloud.com, our desktop applications, and related services (collectively, the "Services").
iStudyCloud is currently operating as a closed alpha that is available to invited testers only. The Services and this Policy may evolve as we move toward general availability.
2. Information we collect
2.1 Account information
When you sign in we receive your email address, name, profile photo (if provided through your identity provider), and a unique authentication identifier. We do not store passwords ourselves; authentication is handled by Firebase Authentication.
2.2 Organization and team data
When you create or join an organization, we collect the organization name, member roles, billing contacts, and seller activation details required to operate the workspace.
2.3 Content you create
Studios, documents, drawings, files, and other content you create or upload are stored on our infrastructure so we can make them available to you and the collaborators you choose. We treat this content as confidential and do not use it to train AI models.
2.4 AI prompts and outputs
When you use AI features we transmit your prompts and the relevant context (selected text, files, or workspace content you choose to share with the assistant) to the model provider you select. We retain a record of AI interactions for a limited period to support the in-product chat history and to help you reload prior conversations.
2.5 Payment information
Subscription and marketplace payments are processed by Stripe. We receive the metadata required to manage your subscription (status, plan, renewal date, last 4 digits, country) but we do not see or store full card numbers.
2.6 Usage and diagnostic data
We automatically collect basic technical data — IP address, browser or app version, operating system, locale, and event logs needed to operate, secure, and improve the Services. We use only essential cookies and a minimal analytics signal during closed alpha; we do not run advertising trackers.
3. How we use information
We use personal information to (a) provide and maintain the Services, (b) authenticate users and protect accounts, (c) process payments and payouts to marketplace sellers, (d) route AI prompts to the model provider you select and return results, (e) communicate service-related notices, (f) respond to support requests, (g) detect abuse, and (h) comply with applicable law.
We do not sell personal information and we do not use customer content or AI prompts to train our own models.
4. Sub-processors
We rely on the following sub-processors to run the Services. Each provider receives only the data needed for its specific function and is bound by data protection terms:
Stripe, Inc. — subscription billing, marketplace payouts (Stripe Connect Express), and payment fraud signals.
Convex, Inc. — primary application database and real-time sync.
Cloudflare, Inc. — content delivery, web application firewall, R2 object storage for user files, and Workers compute.
Google LLC (Firebase Authentication and Google Workspace) — identity, transactional email, and operator productivity.
Anthropic, PBC and other model providers you explicitly select — AI model inference for prompts you send through AI features. The applicable provider receives the prompt content you submit; we do not send your content to model providers you have not chosen.
We will update this list when sub-processors change.
5. International data transfers
Our infrastructure operates primarily in North America. When you use the Services, personal information may be transferred to and stored in Canada, the United States, or other jurisdictions where our sub-processors operate. We rely on industry-standard safeguards including the applicable model contractual clauses for international transfers.
6. Data retention and deletion
We retain personal information for as long as your account is active or as needed to provide the Services. Workspace content and AI history persist until you delete it or close the account. Billing records are retained for the period required by Canadian tax and consumer-protection law (currently seven years).
You may request deletion of your account and personal information at any time by emailing admin@istudycloud.com. We will action eligible deletion requests within 30 days, subject to legal retention obligations.
7. Your rights
Subject to the laws that apply to you, you have the right to access the personal information we hold about you, correct inaccurate information, request deletion, restrict or object to processing, withdraw consent, and request a portable export of your data.
Users in Canada may also escalate complaints to the Office of the Privacy Commissioner of Canada at priv.gc.ca. Users in the European Economic Area and the United Kingdom may contact their local supervisory authority. To exercise any of these rights, contact admin@istudycloud.com.
8. Children's privacy
iStudyCloud is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact admin@istudycloud.com and we will delete it.
Educational deployments that intend to use the Services with minors should contact us first so we can put an appropriate data processing agreement in place.
9. Security
We protect personal information using industry-standard safeguards including TLS in transit, encryption at rest on managed databases and object storage, role-based access controls, least-privilege internal access, audit logging, and continuous security monitoring of our infrastructure.
No system is perfectly secure. If we become aware of a personal information breach that is likely to result in significant harm we will notify affected users without undue delay and report the breach to the Office of the Privacy Commissioner of Canada where required.
10. Changes and contact
We may revise this Policy as the Services evolve. Material changes will be communicated by email or by in-product notice at least 30 days before the effective date. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.
For privacy questions, access requests, or complaints, contact us at admin@istudycloud.com.