1. Information We Collect
1.1 Information you provide
- Account information — email address and password (stored only as a secure hash).
- Profile information — your name, school, course, professor, and similar details you choose to enter.
- Materials you upload — syllabi, notes, problem sets, and images you add to a session.
- Conversations — your tutoring messages and the AI’s responses, including transcripts of voice sessions and any images you attach.
- Support and feedback — messages you send us, including in-app feedback.
1.2 Information collected automatically
- Usage data — features used, sessions, quotas, and similar activity, used to operate the Service and enforce fair-use limits.
- Technical data — IP address, device/browser type, and similar metadata, including data processed by our hosting and bot-protection providers for security.
1.3 Payment information
When you subscribe, payment is handled by our payment provider acting as Merchant of Record. Your card details are collected and processed by that provider; we do not receive or store your full payment-card number. We receive limited billing confirmation data (such as plan, status, and the fact of payment) to manage your subscription.
2. How We Use Information
- To provide, personalize, and improve the tutoring experience, including building your knowledge map and adapting to your learning.
- To operate accounts, process subscriptions, and enforce plan limits and abuse protections.
- To communicate with you about your account, security, and the Service.
- To maintain security, prevent fraud and abuse, and comply with legal obligations.
We do not sell your personal information, and we do not use it for third-party advertising or profiling.
3. How Your Data Is Processed by AI
Tutoring is powered by Anthropic’s Claude AI. To generate a response, we send the relevant context for your current interaction (such as your message, recent conversation, your study profile, and relevant course materials) to Anthropic’s API. Anthropic does not use data submitted through its API to train its models, and it retains API data only for a limited period (currently 7 days) for abuse monitoring before deletion. We send only what is needed for the interaction; we do not send your password or payment details to the AI.
Voice mode. If you use voice, your speech is transcribed and the AI’s replies are converted to audio by our voice provider (Deepgram), and real-time audio is carried by our voice-transport provider (LiveKit). Molecule rendering happens locally in your browser and is not sent to a server.
4. How We Share Information (Sub-processors)
We share information only with service providers that help us operate the Service, under agreements that limit their use of the data. Key providers:
- Anthropic — AI tutoring (Claude API). No training on API data; ~7-day retention.
- Supabase — database, authentication, and file storage (hosted in a U.S. region).
- Vercel — application hosting and delivery.
- Deepgram — speech-to-text and text-to-speech for voice mode.
- LiveKit — real-time audio transport for voice mode.
- Cloudflare — domain/DNS and bot-protection (e.g., the sign-up/login challenge), which processes limited technical data such as IP address.
- Polar — payment processing and tax handling.
We may also disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with notice as required).
5. Data Retention
We keep your information for as long as your account is active and as needed to provide the Service. Conversation data may be summarized for long-term storage rather than retained verbatim indefinitely. When you delete your account, we delete or de-identify your personal information within 45 days, except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements. AI-provider API data is deleted on that provider’s schedule (currently ~7 days).
6. Security
- Encryption of data in transit and at rest.
- Row-Level Security so each user can access only their own data.
- Secure authentication with hashed passwords.
- Private file storage with size and type restrictions.
No system is perfectly secure, but we take reasonable measures to protect your information and review them as the Service grows.
7. Your Rights and Choices
- Access and export — download your conversation history, uploaded materials, and learning data.
- Correction — update your profile information at any time in Settings.
- Deletion — delete your account and associated personal data.
- Marketing choices — opt out of non-essential emails.
Depending on where you live (for example, California), you may have additional rights under applicable privacy laws, including the right to know, delete, and not be discriminated against for exercising your rights. To make a request, contact privacy@annelisetutor.com.
8. Children’s Privacy
The Service is intended for users 18 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have done so, we will delete it.
9. Cookies and Similar Technologies
We use cookies and similar technologies that are necessary to operate the Service (for example, to keep you signed in) and to maintain security.
10. Data Location and International Users
The Service is operated from, and stores data in, the United States. If you access it from outside the U.S., you understand your information will be processed in the U.S.
11. Changes to This Policy
We may update this Policy from time to time. We will post the updated version with a new “last updated” date and, for material changes, provide additional notice.
12. Contact Us
Questions or requests about privacy: privacy@annelisetutor.com.