Privacy Policy

1. Who we are

ExamAITutor ("ExamAITutor", "we", "us") provides an AI-assisted GCSE revision platform at examaitutor.com. We are the data controller for the personal data described in this policy. You can reach us any time at hello@examai.app.

2. What we collect

• Account data — your email address, display name and authentication identifiers (including Google sign-in identifiers if you use it).
• Content you upload — past paper PDFs, notes, typed answers and flashcard material.
• Learning data — quiz results, marks awarded, AI feedback, streaks, flashcard review history and progress statistics.
• Usage data — pages viewed, session length, feature usage and diagnostic error logs.
• Billing data — subscription status, plan type and Stripe customer/subscription identifiers. We never see or store your card number.
• Support data — feedback and messages you send us.

3. Why we use it

• To create and secure your account and keep you signed in.
• To extract questions from your papers, mark answers and generate flashcards.
• To show your dashboard, analytics, streaks and revision history.
• To apply free and Premium plan limits fairly and process payments.
• To respond to support requests and fix bugs.
• To understand aggregate product usage so we can improve the service.

Our lawful bases are performance of a contract (running the service you signed up for), legitimate interests (security, product improvement, fraud prevention) and consent where required. We do not sell your data and we do not use your work to train third-party foundation models.

4. AI processing

When you upload a paper or submit an answer, the relevant text and page images are sent to our AI provider to extract questions, mark your response or generate flashcards. Only the content needed for that request is sent, and it is processed to return your result — not to train public models. Do not upload personal or sensitive information that is not needed for revision.

5. Who we share data with

• Supabase — database, authentication and file storage hosting.
• Stripe — payment processing and subscription management.
• Our AI model provider — question extraction, marking and flashcard generation.
• Lovable — application hosting and deployment.

These providers act as processors under contract. We may also disclose data where legally required, or as part of a business transfer.

6. How long we keep it

We keep your account and revision data for as long as your account exists, so your progress, streaks and analytics remain available across sessions and deployments. You can delete your data at any time from Settings; deletion removes your papers, answers, flashcards and progress. Billing records are retained where required for accounting and tax purposes.

7. Security

Data is encrypted in transit and at rest. Access to your rows is enforced at the database level so no other user can read your papers, answers or results. Passwords are hashed by our authentication provider and never visible to us. Card details are handled entirely by Stripe and never touch our servers.

8. Your rights

If you are in the UK or EEA you have the right to access, correct, delete, restrict or port your data, and to object to processing based on legitimate interests. Settings includes "Download my data" (a full JSON export of everything we hold) and permanent account deletion. For anything else, email hello@examai.app and we will respond within 30 days. You may also complain to the UK Information Commissioner's Office (ico.org.uk).

9. Where your data is processed

Our database, authentication and file storage run on managed infrastructure in the EEA/UK. Payment processing (Stripe) and the AI models used for marking, extraction and flashcard generation may process data outside the UK/EEA, including in the United States. Where that happens, transfers rely on the UK International Data Transfer Addendum or EU Standard Contractual Clauses put in place by those providers.

10. Children

ExamAITutor is built for GCSE students. If you are under 13, please ask a parent or guardian to set up and supervise your account. We do not knowingly collect data from children under 13 without that involvement.

11. Cookies and local storage

We use strictly necessary cookies and browser storage to keep you signed in and to remember interface preferences. We do not run third-party advertising trackers.

12. Changes

We may update this policy as the product evolves. Material changes will be announced in-app or by email, and the "last updated" date above will always reflect the current version.