Privacy policy
1. What we collect
Your email address, the name you choose to give, what you answer in practice sessions, and the consent you gave when you signed up.
2. Why we keep it
To run your practice sessions, to show your progress, and to tell you what to study next. We do not sell your data and we do not use it for advertising.
3. How long
While your account exists. When an account is erased we remove what identifies you and keep the answers without a name, so question statistics stay correct.
4. Your rights
You can ask to see, correct or erase your data, and to withdraw your consent.
5. Where your data is stored
For every user, in every country, your data is stored with Microsoft Azure in the Central US region (Iowa, United States): the database, the session cache and the file storage. The only exception is email: the service that sends our emails stores its data in Brazil.
6. Who processes your data for us
These companies process personal data on our behalf:
| Company | What it does for us | Data it receives | Where it processes |
|---|---|---|---|
| Microsoft Azure | Hosting, database, session cache and file storage | All the data described in section 1 | Central US (United States) |
| Microsoft Azure Communication Services | Sending emails: sign-up verification, password reset, password changed and account farewell | Your email address, your name and the content of the email | Data location Brazil |
| Anthropic | The Claude API behind the study coach, when the study coach is on. Today no data of yours is sent to it | The content of your practice sessions, once the study coach is on | United States |
7. If you are in the European Union
Storing your data in the United States rests on the EU-US Data Privacy Framework (Article 45 of the GDPR) when the receiving company is certified for that data, and on the standard contractual clauses approved by the European Commission (Decision (EU) 2021/914, Article 46 of the GDPR) when it is not.
- Microsoft: it states that it complies with the Data Privacy Framework for the U.S. companies that use its brand, and it offers the standard contractual clauses in its data protection addendum. We have not yet confirmed that the certification covers the hosting service, so we do not rely on it alone.
- Anthropic: the standard contractual clauses of its data processing addendum. They matter once the study coach sends data to it.
- Emails stored in Brazil rest on Article 45 of the GDPR: the European Commission recognised Brazil as giving adequate protection (Implementing Decision (EU) 2026/179 of 26 January 2026).
8. If you are in Brazil
Storing your data in the United States is an international transfer under Article 33 of the LGPD. The mechanism is the standard contractual clauses approved by the ANPD (Resolution CD/ANPD 19/2024). They are being put in place with Microsoft, and will be put in place with Anthropic before the study coach sends it any data. Emails stored in Brazil involve no transfer of data at rest.
Until these safeguards are in place, the service holds test accounts only.
9. When this list changes
When we change a company in this list, we publish a new version of this policy. This version replaces version 2026-v2, which named another region and another email company.