Privacy Policy

1. Who we are

BrightStudy is operated by BrightStudy (“BrightStudy”, “we”, “us”). For most purposes we are the “controller” (or “business”, “data fiduciary” or equivalent under your local law) responsible for your personal information, under laws including the UK GDPR and Data Protection Act 2018, the EU General Data Protection Regulation (GDPR), and the other privacy laws described in section 14. Contact us about privacy at support@brightstudy.ai.

Where a school or other organisation provides BrightStudy to you, that organisation may be the controller for your information and we process it on its behalf (see section 12). Its own privacy notice also applies.

“Personal information” means any information that identifies you or could reasonably be linked to you.

2. Information we collect

Information you give us

Information created as you use BrightStudy

Information from other people

We may receive information about you from other members (for example when they send you a friend request, add you to a group, share an item with you or report content), from a school or organisation that creates your account, from a parent or guardian, and from Spotify if you connect it.

What we don’t collect

We do not collect your date of birth, precise location, contacts, advertising identifiers or payment card details. We do not use voice recordings, photos or any other data to identify you biometrically (for example by voiceprint or face recognition). The mobile app only uses your camera, photos, files or microphone when you choose to scan, attach or record something.

Sensitive information

Please don’t include sensitive information (such as information about health, religion, political opinions, sexual orientation, ethnicity or criminal records) in your study content or messages unless you need to. If you do, we process it only to provide the features you use, at your direction, and we do not use it to profile you or infer anything about you.

3. How we use it and why

Data protection laws such as the UK and EU GDPR, Brazil’s LGPD and others require us to have a legal reason (“lawful basis”) for each use.

Where we rely on legitimate interests, we have balanced them against your rights and expectations, taking extra care where members may be young. You can ask us for details and object at any time (see section 13).

We do not sell your personal information, share it for targeted or cross-context behavioural advertising, show you third-party ads, or use your information to profile you for marketing.

4. AI processing of your content

When you use an AI feature, the relevant content is sent to an AI provider to produce the result. Depending on the feature, that may be your document text, images, audio, prompt or recent conversation. Examples include creating a study doc from an upload, transcribing a recording, making flashcards or questions, reading a reply aloud, generating an image or study plan, proofreading, and screening a Community contribution.

• Only what is needed. We send only what the feature needs, to return a result to us, under the provider’s business or API terms.
• No training. We do not use your content to train our own AI models, we do not sell it to AI companies, and we use providers’ business or API services, under which they are not permitted to use your content to train their general models.
• Provider retention. Some providers may keep inputs and outputs for a limited period (typically up to 30 days) to detect and prevent abuse, after which they are deleted, under their own terms.
• Your own keys. When you use your own API key, the request goes to that provider under your own agreement with them, and their terms and privacy policy apply.
• Accuracy. AI output may be inaccurate. If AI output contains incorrect information about you, you can edit or delete it, or ask us to correct it.

5. What other people can see

• Any signed-in member can find you by searching your username, can see your username on Community contributions you publish under your name, and can open your social profile page. On it they see your @username and bio, plus any of your photo, online status, course and stage, interests and Community contributions that you have set to “Everyone”. Your real name is never shown on your profile, and anonymous contributions are never listed on it.
• Friends can see your name shown to friends, the profile details you have set to “Friends” or “Everyone”, your online status and custom status (unless you appear invisible or have hidden it), and the messages and items you send them.
• Members you block cannot see your profile or photo, and you cannot see theirs.
• Group and chat members see the messages, posts and items you share there.
• Members you share an item with can view it, and edit it if you give them permission. Copies they save stay with them.
• Community Library contributions are visible to every signed-in member once approved. Anonymous contributions hide your name from members but not from administrators.
• Your school or organisation, if it manages your account, may be able to see information about your account as agreed with it.
• BrightStudy administrators can see account details and may access content when needed to provide support you ask for, review Community submissions, investigate reports or abuse, keep the Service secure, or comply with the law. Access is limited to authorised staff who are bound by confidentiality.

You choose who sees each part of your social profile in its settings. Your private uploads, notes, study material, progress and study profile are not shown to other members unless you share them. Profile pages and photos are only available to signed-in members, are not public on the web and are not indexed by search engines.

6. Who we share information with

Service providers

We use trusted providers (“processors” or “service providers”) to run BrightStudy. They act on our instructions under written contracts, must keep information secure and confidential, and may only use it to provide their services to us.

We may change providers as the Service develops. We will update this list when we do.

Other disclosures

• Legal requirements. We may disclose information if we believe in good faith that the law, a court order or a valid request from a public authority requires it. Where allowed and appropriate, we will tell you first.
• Safety. We may disclose information to prevent harm, including to the police, child-protection organisations (such as NCMEC or the Internet Watch Foundation) or emergency services, where we believe someone’s safety is at risk, or to report child sexual abuse material as the law requires.
• Protecting rights. We may disclose information to enforce our Terms, investigate fraud, security issues or abuse, or establish, exercise or defend legal claims.
• Business changes. If BrightStudy is involved in a merger, acquisition, financing, reorganisation or sale of assets, information may be transferred to the new owner, who must continue to protect it as this policy describes. We will tell you before your information becomes subject to a different privacy policy.
• With your consent or at your direction, for example when you share an item or connect another service.
• Aggregated or de-identified information that cannot reasonably identify you may be shared, for example in usage statistics. We will not try to re-identify it.

7. International transfers

BrightStudy is available worldwide, and we and our providers process information in several countries, including the United Kingdom, member states of the European Economic Area, the United States and other countries where our providers operate. These countries may have data protection laws that differ from those where you live.

When we transfer personal information out of the UK, EEA, Switzerland or another country that restricts transfers, we use safeguards recognised by the law that applies. These include adequacy decisions (including the UK–US Data Bridge and the EU–US and Swiss–US Data Privacy Frameworks for certified companies), standard contractual clauses approved by the European Commission with the UK International Data Transfer Addendum, and, where required, other contractual or legal mechanisms. You can ask us for a copy of the relevant safeguards.

8. Cookies and device storage

We use essential cookies to keep you signed in, protect connections to other services and remember your cookie choice. These are needed for BrightStudy to work, so they don’t need your consent. We do not use advertising cookies, tracking pixels or cross-site tracking.

If you allow “Analytics”, we use Google Analytics to count visits and see which pages and features are used, so we can improve BrightStudy. It sets its own _ga cookies and receives your IP address, browser details and the pages you open. We don’t send it your name, email or study content, and we have turned off Google signals and advertising features. If you don’t allow it, Google Analytics never loads.

Embedded video and music players from YouTube, Vimeo, Spotify, TikTok and Instagram can set their own cookies, so they only load after you allow “Embedded media” in the cookie banner or cookie settings. Until then you see a placeholder. We serve web fonts from our own servers, so opening a page does not contact Google.

Our Cookie Policy lists every cookie and storage item, how long each lasts and how to change your choice. You can change it at any time from “Cookie settings”. In the mobile app, your sign-in token is kept in the device’s secure storage, and preferences, local calendar items and to-dos are stored on the device.

Because we don’t sell or share personal information for advertising, there is nothing for a “Do Not Track” signal to opt you out of. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid opt-out of sale and sharing where the law requires, and we do not show the cookie banner: embedded media and analytics stay off unless you turn them on.

9. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, then delete or anonymise it.

When you delete your account (from the mobile app’s Profile screen, or by emailing us), we delete your account record, your study content, progress, social data, Community contributions and the files you uploaded. Copies that other members already received through sharing or downloading stay in their accounts. We may keep a minimal record that an account was closed for breaking our Terms, to stop it being re-created.

10. Security

We protect your information with technical and organisational measures that include encrypted connections (HTTPS), passwords stored only as one-way hashes, secure HTTP-only sign-in cookies, secure device storage for mobile sessions, per-account checks on who can open your workspace, rate limiting, and staff access limited to authorised administrators. No online service is perfectly secure, and we cannot guarantee the security of information sent over the internet. Use a strong, unique password and tell us straight away if you suspect a problem.

If a personal data breach is likely to put you at risk, we will tell you and the relevant regulators without undue delay, as the law requires. If you believe you have found a security vulnerability, please report it to support@brightstudy.ai and do not access or change other people’s data.

11. Children and young people

BrightStudy supports learners from school to university, so some of our members are under 18. We design BrightStudy with children’s privacy in mind, following principles such as the UK Age Appropriate Design Code: we collect no more than the Service needs, we show no advertising, we do not sell children’s information or use it for profiling or marketing, we do not track members across other sites, we do not collect precise location, profiles are not public, and personal names are only shown to accepted friends.

Minimum ages and consent

• You must be at least 13 to create your own account.
• In some countries a parent or guardian must consent before a young person can use an online service, until the “age of digital consent”. This is 13 in the UK and the US, between 13 and 16 in EU countries (for example 16 in Germany, Ireland and the Netherlands, 15 in France, 14 in Italy and Spain), 14 in South Korea, and 18 in India. Below that age where you live, you may only use BrightStudy with the verifiable consent of a parent or guardian, or of your school where the law allows the school to consent for educational use.
• Children under 13 may only use an account set up and supervised by a parent, guardian or school.
• Chat (direct messages and group chats) is only open to members aged 18 or over who pass our age check. Other members can’t message members who haven’t passed it, or add them to group chats.

Children under 13 in the United States (COPPA)

We do not knowingly collect personal information from children under 13 without verifiable parental consent, or the consent of a school acting on parents’ behalf for educational purposes only. Where a child under 13 uses BrightStudy with that consent, we collect only the information described in section 2 that is reasonably necessary for the child to use the features, we use it only to provide the Service, and we do not disclose it to third parties except the service providers in section 6 that help us run the Service. A parent or guardian can at any time review the child’s personal information, ask us to delete it, and refuse to allow further collection or use, by emailing support@brightstudy.ai. We will verify that you are the child’s parent or guardian before acting.

If we learn a child is using BrightStudy without consent

If you believe a child is using BrightStudy without the consent their country requires, contact us and we will suspend the account and delete the child’s information, unless we must keep some of it by law.

12. Schools and organisations

When a school, university or other organisation provides BrightStudy to its students or staff, it decides why and how their information is used for its educational purposes, and is responsible for having a lawful basis and giving any required notices and consents. In that role we act as its processor or service provider: we process student information only to provide the Service to the organisation and its users, we do not sell it or use it for advertising, and we help the organisation respond to requests from students and parents.

Where the US Family Educational Rights and Privacy Act (FERPA) applies, we use education records only as a “school official” with a legitimate educational interest, under the school’s direct control, and do not re-disclose them except as FERPA allows. Students and parents should send requests about school-managed information to their school first. We will pass on any request we receive.

13. Your rights and choices

Wherever you live, we offer every member the following rights, subject to limits the law allows (for example where a request would reveal another person’s information):

• access the personal information we hold about you and get a copy;
• correct information that is wrong or incomplete;
• delete your information;
• restrict or object to certain uses, including uses based on legitimate interests;
• data portability: receive the information you gave us in a structured, reusable format, or have it sent to another organisation where technically feasible;
• withdraw consent at any time where we rely on it, without affecting earlier processing; and
• not be discriminated against for using any of these rights.

How to use your rights

Many of these you can do yourself. You can edit your profile and study profile in Settings, change your password, download study documents and decks, disconnect Spotify, remove API keys, unpublish Community items, block members, appear invisible, and delete your account in the mobile app. For anything else, email support@brightstudy.ai from your account’s email address.

We will reply within one month (or the shorter or longer period your local law sets, for example 45 days under US state laws), and we may extend this where the law allows if a request is complex, telling you why. We may need to confirm your identity before acting, and we will only use the information you give us for that purpose. Requests are free unless they are clearly unfounded or excessive. A parent or guardian can make requests for their child, and you can use an authorised agent where the law allows. We may ask the agent for proof of authority and ask you to confirm your identity directly. If we refuse a request, we will tell you why and how to appeal or complain.

14. Additional information for your region

BrightStudy is used by learners around the world. The rights in section 13 apply to everyone. This section adds what specific laws require.

Where the law requires us to appoint a local representative or data protection officer, we will do so and publish their details here.

15. United States privacy notice

This section applies to residents of US states with consumer privacy laws, including California (CCPA as amended by the CPRA), Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia and others, to the extent those laws apply to us. It is also our notice at collection.

• Sources: you, your device, other members, your school or parent, and services you connect (section 2).
• Purposes: those listed in section 3.
• Retention: as described in section 9.
• No sale or sharing. We have not sold or “shared” (for cross-context behavioural advertising) personal information in the past 12 months, including that of consumers under 16, and we do not use or disclose sensitive personal information for any purpose that would give a right to limit it.
• Your rights. You may have the right to know what we collect, use and disclose, to access, correct and delete it, to data portability, to opt out of sale, sharing, targeted advertising and significant profiling (we do none of these), and not to be discriminated against for using your rights. Use them as described in section 13. If we refuse your request, you can appeal by replying to our decision. If the appeal is refused, you can contact your state Attorney General.
• California “Shine the Light”. We do not disclose personal information to third parties for their own direct marketing.
• Minors in California. If you are under 18 in California, you can ask us to remove content you posted. Email us, but note that copies others have saved may remain, and removal doesn’t ensure complete erasure.

16. Emails and notifications

We currently send only service emails, such as password-reset codes and important notices about your account, our terms or this policy. We do not send marketing emails. If we start to, we will ask you first where the law requires it, and every message will include a way to unsubscribe. The notifications you see in the app are generated from your own activity. We do not currently send push notifications.

17. Automated decisions

We use automated tools to personalise your study (for example scheduling flashcard reviews and estimating readiness) and to screen Community contributions and other content for safety. A person reviews every Community contribution before it is published and every appeal. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. If you think an automated result is wrong, contact us and a person will look at it.

18. Other websites and services

BrightStudy contains links to and embeds from other websites and services, such as YouTube, Vimeo, Spotify and the sources cited in study material. Their own privacy policies apply when you use them, and we are not responsible for their practices.

19. Changes to this policy

We will update this policy when our features, providers or the law change. The date at the top shows the latest version. If a change significantly affects how we use your information, we will tell you in the app or by email before it takes effect, and ask for your consent again where the law requires.

20. Contact and complaints

For any privacy question or request, email support@brightstudy.ai with “Privacy” in the subject. If you are unhappy with how we handle your information, please tell us first so we can try to put it right.

You also have the right to complain to a data protection regulator. In the UK that is the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). In the EU, it is the authority in the country where you live or work (listed at edpb.europa.eu). Regulators for other regions are listed in section 14.