Privacy Policy

StudioAI ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal data when you use the StudioAI iOS application and related services.

This policy is compliant with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and App Store privacy requirements.

1. Data Controller

The data controller responsible for your personal data is:

• Full name: Francisco Bertero Paz
• Trading as: StudioAI
• Tax ID (NIF): Z0052722B
• Address: C/ Pallars, 194, 08005 Barcelona, Spain
• Email: team@studio-ai.es

StudioAI is operated by Francisco Bertero Paz, an individual based in Barcelona, Spain.

2. Data We Collect

Account & Profile Data

• Email address (required for account creation)
• Display name
• Profile photo (optional, stored in Firebase Storage)
• Native language and target learning language
• Timezone
• Account creation date

Learning Data

• CEFR assessment results and learning paths
• Unit and lesson progress
• Flashcard decks and review history (ratings, intervals, FSRS scheduling state)
• Quiz answers and scores
• Grammar and cloze exercise results
• Study session logs
• Uploaded source materials (PDFs, text, YouTube links)
• AI Tutor conversation memory (stored on-device)

Usage & Analytics Data

• Account-linked learning activity (reviews, answers, scores and progress) used to provide scheduling and personalized learning features.
• Optional product analytics through Google Analytics for Firebase. It is off by default and runs only if you turn it on in Settings → Privacy. It uses a random installation identifier created by Firebase on your device, which is not derived from or linked to your account. Events may include the feature used, timestamps, duration, language, level, plan, platform and app version.
• Product analytics never include messages, roleplay transcripts, uploaded sources, names, email addresses or content identifiers. You can turn analytics off again at any time; doing so stops collection and resets the identifier on your device.
• Aggregate usage statistics computed on our servers from data the service already stores to work (for example, how many accounts practiced on a given day). They contain only counts, never a device identifier, and groups smaller than five accounts are hidden so no one can be singled out. Accounts that switch analytics off in Settings are excluded.

Technical Data

• Device push notification token (for study reminders)
• App version and build configuration

We do not collect location data, contacts, camera input or browsing history. If you use voice dictation or voice Conversations, the app uses your microphone only while the microphone is on. Your speech is turned into text on your device by Apple’s on-device speech recognition; the audio is never recorded, stored or sent to us, to Google or to any other third party. The resulting text is handled like any message you type. We do not use your data for advertising or sell it to third parties.

Website Cookies & Tracking

Our website (studio-ai.es) may use functional and analytical cookies to improve your browsing experience and understand how visitors use the site. A cookie consent banner is displayed on your first visit, allowing you to accept or decline non-essential cookies. Full details are available in our Cookie Policy, accessible from the website footer.

3. Legal Basis for Processing (GDPR)

• Contract performance - processing your email and profile to provide the service you signed up for, including sending the materials you upload and your written answers to our AI providers to generate your study content and score your answers.
• Legitimate interests (Article 6(1)(f) GDPR) - our legitimate interest in improving the reliability, security, and performance of the app, including measuring feature adoption, stability, and session quality. Where possible, we use aggregated and minimized data for this purpose, and we do not use this data for advertising. You have the right to object to processing based on legitimate interests at any time by contacting us at team@studio-ai.es.
• Consent - sending you optional marketing notifications and reminders (you can withdraw at any time in Settings).

4. How We Use Your Data

• To create and maintain your account
• To generate AI-powered flashcards, quizzes, exercises, and audio summaries from your uploaded materials, and to score your written answers to open exercises
• To run the FSRS spaced-repetition scheduling algorithm on your device
• To deliver study reminders via push notifications (with your permission)
• To manage your subscription through RevenueCat
• To improve the app based on aggregate, pseudonymous usage patterns that are not linked to your account

5. Data Sharing and Third-Party Processors

We share data only with the processors necessary to run the service. All processors are bound by data processing agreements and are GDPR-compliant.

• Google Firebase and Google Cloud (Auth, Firestore, Storage, Cloud Functions, Text-to-Speech, Speech-to-Text) - authentication, database, file storage, serverless compute, audio generation, and transcription of audio or video files you upload. Speech-to-Text is used only for audio or video files you upload as sources, never for your microphone. Google Cloud Data Processing Agreement applies. Firebase Privacy
• Anthropic, PBC (Claude API) - our main AI provider. It generates flashcards, quizzes, exercises, and audio scripts, helps process the materials you upload, and scores your written answers to open exercises. Our servers send it only the text each task needs: excerpts of the materials you upload and the text extracted from them, your native and target languages, your level, and, for scoring, your written answer. Requests are made from our servers only, never directly from the app, and do not include your name, email address, account ID, or any other user identifier. Anthropic acts as our processor under its Data Processing Addendum, does not use this data to train its models, and deletes inputs and outputs within 30 days, except content flagged for violating its Usage Policy, which may be kept longer, or where the law requires it. Anthropic Privacy Policy · Anthropic DPA
• Google (Gemini API) - backup AI provider when Claude is unavailable, and the service we use to extract and summarize the materials you upload: documents, web pages, YouTube transcripts, and PDF files that our servers cannot read directly. It receives the same kind of text as Anthropic and, for those PDF files, the whole file, which we ask Google to delete once it has been processed. Requests are made from our servers only and do not include your name, email address, account ID, or any other user identifier. We use the paid Gemini API service, under which Google acts as our processor under its Data Processing Addendum for Products Where Google is a Data Processor, does not use prompts or responses to improve its products (including training its models), and logs them only for a limited period to detect abuse and meet legal obligations. Gemini API Terms · Google Processor Terms · Google Privacy Policy
• RevenueCat - subscription and in-app purchase management. RevenueCat Privacy
• Hugging Face - hosts the on-device AI Tutor model file (downloaded once to your device). No personal data is sent to Hugging Face.
• Apple - Apple Sign In, App Store payments, push notification delivery (APNs).
• Google - Google Sign In (OAuth).

The materials you upload may contain personal data about other people, for example names in a letter or an article. Please upload only content you have the right to share, and leave out other people's personal data that you do not need for learning.

6. On-Device AI Processing

The AI Tutor feature uses a local language model (Gemma) that runs entirely on your device. Conversations with the AI Tutor are processed locally and are never transmitted to our servers or any third party. Only a short memory summary (topic preferences, current level) may be stored in Firestore to personalize future sessions. This summary contains no conversation transcripts or uploaded content - only high-level learning preferences inferred from your usage. It is processed on the legal basis of contract performance (Article 6(1)(b) GDPR), as it is necessary to deliver the personalized learning experience you signed up for. You can delete this summary at any time from Settings → Account → Clear AI Tutor Memory.

7. Data Retention

• Account data - retained while your account is active.
• Product analytics events from earlier app versions - no longer collected; the remaining records are deleted by November 30, 2026.
• Aggregate usage statistics - kept for about 25 months, then automatically deleted.
• Google Analytics for Firebase (only if you turned analytics on) - kept for up to 14 months under our Google Analytics settings.
• Deleted accounts - all associated data (Firestore documents, Storage files) is permanently deleted within 30 days of account deletion.
• Account-unlinked analytics - because the Firebase installation identifier is not connected to your account, past analytics events cannot be located or deleted through account deletion. Turning analytics off stops future collection and resets the identifier on your device.
• Server logs - Cloud Function logs are retained for 30 days in Google Cloud Logging.

8. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of access - request a copy of your data via Settings → Account → Export My Data, or by contacting us.
• Right to portability - export your account data as JSON from within the app.
• Right to erasure - delete your account and all associated data from Settings → Account → Delete Account.
• Right to rectification - update your profile information in Settings.
• Right to restrict processing - contact us to restrict specific processing activities.
• Right to object - you may object at any time to processing based on legitimate interests by contacting us at team@studio-ai.es. We will review and respond in accordance with applicable law.
• Right to withdraw consent - disable marketing notifications at any time in Settings → Notifications.

Right to lodge a complaint - if you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. If you are located in Spain, the competent authority is:

• Agencia Española de Protección de Datos (AEPD)
• Web: www.aepd.es
• C/ Jorge Juan, 6, 28001 Madrid, Spain

If you are located in another EU member state, you may also contact your local data protection authority.

To exercise any of these rights, contact us at team@studio-ai.es. We will respond within 30 days.

9. Data Security

• All data in transit uses HTTPS/TLS encryption.
• Firestore security rules enforce per-user data isolation - no user can read another user's data.
• The app sends Firebase App Check attestations with its requests, which help us detect unauthorized access to our APIs.
• Sensitive credentials and secrets are stored server-side as environment variables and are never embedded in the app binary. The app may include platform-required public client keys (for example, a RevenueCat public SDK key), which are not authentication secrets.
• Authentication uses industry-standard OAuth 2.0 and cryptographic nonces.

10. Children's Privacy

StudioAI is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at team@studio-ai.es and we will delete it promptly.

11. International Data Transfers

Your data is processed on Google Cloud infrastructure, which may involve transfers to servers in the United States and other countries. The content our servers send to our AI providers is also transferred outside the European Economic Area: to Anthropic, PBC, based in the United States, which may process it in the United States or other countries where it provides its service, and to Google for the Gemini API, which may process it in the United States and other countries where Google operates. These transfers are covered by the Standard Contractual Clauses approved by the European Commission, which are part of Anthropic's Data Processing Addendum and of Google's data processing terms.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes through the app or by email. Continued use of StudioAI after the effective date constitutes acceptance of the updated policy for processing activities based on contract or legitimate interest. For activities based on consent, we will re-obtain your explicit approval if the changes significantly affect those activities.

13. California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following additional rights:

• Right to know - you may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete - you may request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination - we will not discriminate against you for exercising your CCPA rights.
• Right to opt out of sale - we do not sell your personal information to third parties.

To exercise these rights, contact us at team@studio-ai.es. We will respond within 45 days as required by the CCPA.

14. Contact Us

For privacy inquiries, data requests, or to report a concern:

• Email: team@studio-ai.es