Privacy Policy

The Study Deck is operated by [Registered company name], [address], Finland ("The Study Deck", "we", "us"). We are the data controller for the personal data described in this policy. You can reach us at admin@thestudydeck.com.

This policy explains what we collect when you use The Study Deck, what happens to the course material you upload, and what rights you have over it.

Account data. Your name, email address, and password (stored only as a hash). If you complete onboarding, the academic level, subjects and study goals you select.

Course material you upload. The lecture slides, PDFs, notes, images and scans you add to a notebook, and the text and images extracted from them.

Content generated from your material. The structured notes, flashcards, quizzes, concept maps and answers The Study Deck produces from your uploads, together with your quiz answers and card review ratings.

Usage data. Study sessions, review history, streaks and progress, and technical logs such as processing events, error records and approximate processing cost per job.

To provide the service — creating your account, processing your uploads, generating study material and scheduling reviews. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

To keep the service working and secure — diagnosing failed jobs, preventing abuse, and monitoring processing cost. Legal basis: our legitimate interests in operating a reliable service (Art. 6(1)(f)).

To meet legal obligations, such as accounting requirements for paid plans. Legal basis: legal obligation (Art. 6(1)(c)).

We do not use your personal data for advertising, and we do not sell it.

This is the part worth reading closely, because it involves a third party.

When you upload material, the file is stored in Google Cloud Storage. Its pages are then sent to the Google Gemini API, which reads them — including handwriting, diagrams and tables — and returns extracted text and structure. The same API is used to generate notes, flashcards, quizzes and answers, and to create the embeddings that let you search and ask questions across your notebook.

This means the contents of the documents you upload are transmitted to and processed by Google as our processor. If your course material contains personal data about you or about other people, that data is part of what is transmitted.

Do not upload material you are not permitted to share, or documents containing sensitive personal data about other people, such as medical or identity records.

We do not use your uploads, your generated study material, or your study activity to train machine learning models — neither our own nor anyone else’s. Your material is used to produce your study material and to answer your questions, and for nothing else.

Your material is private to your account. It is not shown to other users unless you explicitly share it.

We use a small number of processors, each bound by a data processing agreement and permitted to act only on our instructions:

Google Cloud Platform — storage of uploaded files and generated assets, and database hosting.

Google Gemini API — document reading and generation of study material, as described in section 4.

Our hosting and analytics providers, for serving the site and understanding aggregate usage.

Some of these providers process data outside the European Economic Area. Where that happens, transfers are made under the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.

Your uploads, notes and generated study material are kept for as long as your account is active, because the service is built around them remaining available to you.

You can delete an individual upload, note or notebook at any time from within the app. Deleted items are removed from our active systems promptly and from backups within 30 days.

If you delete your account, we delete your account data, uploads and generated material within 30 days, except where we are required to retain records — for example billing records — for a longer period under law.

Processing and error logs are kept for a shorter period for operational purposes.

Under the GDPR you have the right to access the personal data we hold about you; to have inaccurate data corrected; to have your data erased; to restrict or object to processing; to receive your data in a portable format; and to withdraw consent where processing is based on consent.

To exercise any of these rights, email admin@thestudydeck.com. We will respond within one month.

If you believe we have handled your data improperly, you have the right to complain to your local supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

Data is encrypted in transit and at rest with our infrastructure providers. Passwords are stored only as hashes. Access to production systems is limited to the people who need it to operate the service.

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will notify you and the supervisory authority as required by law.

We use cookies and similar browser storage that are necessary for the service to work, such as keeping you signed in and remembering your theme preference. Where we use any non-essential cookies, we ask for your consent first, and you can withdraw it at any time.

The Study Deck is intended for students in higher and upper-secondary education. It is not directed at children under 16. If we learn that we have collected data from a child under 16 without appropriate consent, we will delete it.

If we make a material change to how we handle your data, we will tell you before it takes effect. The date at the top of this page shows when it was last revised.