Privacy Policy

The Service is operated by StudyBase, Israel (“StudyBase”, “we”).

Two situations matter. When a school deploys StudyBase for its students, the school is the controller (owner) of its students’ educational records, and StudyBase processes that data on the school’s behalf and under its instructions. When you register independently — as a private learner, or as a parent creating your own account — StudyBase is the controller of your data.

Privacy questions and requests: support@studybase.ai, subject line “Privacy” (see section 11).

Here is what we collect, in outline:

• Account and identity data — name, email address, mobile phone number, preferred language, and a password (stored only as a cryptographic hash; if you sign in with Google, Google confirms your identity to us).
• School affiliation data — your school, role (student, teacher, parent, or administrator), class and homeroom, grade level, and teaching subjects for teachers.
• Learning data — homework submissions and answers, quiz and challenge results, progress and mastery records, uploaded study materials, and photographs of written work you choose to submit.
• School records — in school deployments, records entered by school staff about a student: marks and grades, attendance, behaviour notes, and wellbeing check-ins.
• AI interaction data — the questions you ask AI features and the content generated in response.
• Parent-child linkage — a parent account may be linked to a student account; link requests record who asked, when, and from which device (IP address and browser identifier), to protect against abuse.
• Usage and device data — pages and features used, timestamps and durations, IP address, browser or device type, screen size, and mobile push-notification tokens.
• Communication data — messages sent through the Service, and delivery records for notifications we send (including SMS and WhatsApp, where enabled).

You are under no legal duty to provide us with personal data; you provide it voluntarily and by your own free will. Without the account details above we cannot open or operate an account, and without school-affiliation details we cannot connect you to your school. In school deployments, roster details are provided by your school under the school’s own authority and its agreement with us. We do not ask for or knowingly collect payment card details through the Service, and we do not collect data for advertising.

Most data comes directly from you — at registration and as you learn. In school deployments, some data comes from the school: rosters, class assignments, and role information. Some data is generated by the Service itself, such as progress records and AI feedback on submitted work.

We process personal data to:

• provide the Service — accounts, lessons, homework, quizzes, live sessions, and progress tracking;
• personalise learning — for example adapting practice to a student’s level and identifying areas that need reinforcement;
• enable teachers, schools, and parents to see the educational information they are entitled to see for their role;
• send service notifications — for example homework reminders — by push notification, SMS, or WhatsApp where enabled;
• keep the Service secure — authentication, abuse prevention, and audit logging;
• comply with legal obligations and, in school deployments, with the school’s instructions;
• improve the Service, using aggregated or de-identified information wherever possible.

We do not sell personal data, and we do not use personal data for third-party advertising.

StudyBase uses artificial-intelligence models to generate lessons, questions, feedback, and explanations. We designed this processing to minimise exposure of personal data:

Before content is sent to an AI provider, our systems remove or replace identifying details — for example names are replaced with neutral aliases, and identifiers such as phone numbers, email addresses, and ID numbers are stripped. This removal works on details we know or can recognise by pattern: identifying details that appear inside content you submit — the text you type, or images and documents you upload — may still reach the provider as part of that material. AI providers receive learning content, not student identity profiles.

AI features are subject to grade-based rules that we apply on our servers, based on the grade level recorded for the student’s account, in line with Israeli Ministry of Education guidance: no AI features in grades 1–3; grade 4 is referred to the Ministry’s own tools; grades 5–7 use AI features in teacher-mediated sessions; from grade 8, students may use AI features independently. Where required, AI use by younger students is subject to parent or guardian approval, which we record.

Our principal AI provider is Anthropic; depending on the feature, we also use OpenAI (including voice transcription), Google, Cohere, Jina (text analysis), and ElevenLabs (audio). These providers process data outside Israel, primarily in the United States — see section 7.

Within your school, teachers, school administrators, and a parent linked to your account see your learning information — grades, homework, progress — according to their role. That is the Service working as intended, not third-party sharing.

Beyond your school, we share personal data only with service providers that help us run the Service, and where the law requires. Our main categories of providers:

• Infrastructure — Amazon Web Services (servers, file storage, and caching, Israel region) and MongoDB Atlas (database); the website is delivered through Vercel.
• AI processing — the providers listed in section 5, receiving de-identified content as described there.
• Communications — an Israeli SMS provider for text messages, Meta’s WhatsApp Business API for WhatsApp notifications where a parent has linked WhatsApp, Resend for email, and Expo for mobile push notifications.
• Document processing — a file-conversion service (CloudConvert) that converts uploaded documents into formats the Service can display.
• Operations — error-monitoring alerts to our internal Slack workspace, with identifying details scrubbed before sending; source code and build infrastructure on GitHub.

We do not sell personal data. A current list of our sub-processors is available on request from support@studybase.ai.

Student and school data is stored and processed server-side in Israel: our servers, database, and file storage run in the AWS il-central-1 (Tel Aviv) region. This is a deliberate data-residency commitment for Israeli schools.

Some processing does occur outside Israel, in three main categories. First, the website is delivered through Vercel’s global content-delivery network, which serves the application code; the personal data shown to you is fetched by your browser directly from our Israeli servers. Second, AI processing takes place with the providers listed in section 5, primarily in the United States, after the de-identification described there. Third, message delivery and document conversion — email (Resend), mobile push notifications (Expo), WhatsApp (Meta), and file conversion (CloudConvert) — are performed by providers operating outside Israel, and those messages or files can include a student’s name and educational updates.

We transfer personal data abroad only as described above, and such transfers are handled under the framework of the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

We operate an information-security management system aligned with ISO/IEC 27001, and we are working toward certification. Concretely, protections in operation today include:

• encryption of data in transit (TLS) and at rest at the storage layer;
• passwords stored only as salted cryptographic hashes; multi-factor authentication secrets stored encrypted;
• role-based access control — each role sees only what that role requires;
• server-side enforcement of the AI grade-gates and of ownership checks on data access;
• de-identification of content before AI processing, as described in section 5;
• audit logging of sensitive operations, and security alerting on failures;
• restricted, logged administrative access to production systems.

No system is perfectly secure, and we do not claim ours is. If we learn of a data breach that materially affects you, we will act in accordance with our incident-response procedures and applicable law, including notification duties to the Privacy Protection Authority and affected individuals where required.

Educational records — such as grades, submissions, and progress — are kept for as long as the account and the related school relationship are active, because continuity of the educational record is central to the Service’s purpose. In school deployments, retention of student records follows the school’s instructions and applicable education regulations.

Security and audit logs are retained for the periods required for security and accountability. Short-lived operational data — such as some usage telemetry and delivery records — expires automatically.

When an account closure request is received, the account is deactivated and flagged; subsequent handling of the underlying records follows the review process described in section 11. A detailed retention schedule is available on request.

Under the Israeli Privacy Protection Law you have the right to:

• inspect the data we hold about you (section 13 of the Privacy Protection Law) — we will respond within 30 days, as the inspection regulations under the Law require;
• request correction or deletion of data that is incorrect, incomplete, unclear, or outdated (section 14 of the Privacy Protection Law);
• withdraw consent to processing that is based on consent — for example parental approval of AI use — with effect going forward;
• object to receiving direct marketing (we do not send third-party marketing);
• complain to the Privacy Protection Authority (the PPA) if you believe your rights have been violated.

A parent or legal guardian may exercise these rights on behalf of a minor. For data controlled by a school, we may refer your request to the school, or coordinate with it, as the law and our processor role require.

Write to support@studybase.ai with the subject line “Privacy”, from the email address linked to the account (or, for a minor, from the linked parent account), and tell us what you are asking for: a copy of the data, a correction, a deletion of inaccurate data, or the closure of an account.

If your account has no usable email address — for example, an account created with a phone number — write to us from any address and include the phone number linked to the account; we will verify your identity another way before acting.

We verify identity before acting on a request, we respond within the timeframe set by law, and we keep a record of requests and how they were resolved. Where we decline a request — for example where an educational record must be preserved for the school, or where the law requires retention — we will tell you why and name the legal basis.

The Service is used by school students, including minors, and we treat their data as particularly sensitive information, applying the heightened protections the Privacy Protection Law requires for such data.

Students use StudyBase through their school or with parental approval. AI features are grade-restricted as described in section 5, and parental approval for AI use is collected and recorded where required. Parents can be linked to their child’s account to see the educational information intended for parents.

We do not advertise to students, we do not sell student data, and we do not build advertising or marketing profiles of students.

We use cookies and similar browser storage for the Service to function, plus one lightweight measurement service:

• Authentication — cookies and browser storage that keep you signed in across StudyBase pages;
• Preferences — your language and display settings;
• Measurement — Vercel Analytics and Speed Insights, cookieless services that count page visits and measure performance in aggregate, without cookies that track you across sites and without building advertising profiles.

We do not use advertising cookies or third-party ad trackers. Blocking authentication cookies will prevent sign-in. The mobile application uses equivalent secure device storage.

When we change this Policy we will post the updated version here with a new effective date. For material changes we will provide notice through the Service, and where a change concerns the processing of students’ data in school deployments, we will inform the schools concerned.

Privacy requests and questions: support@studybase.ai, subject line “Privacy”.

You may also contact the Israeli Privacy Protection Authority regarding your rights under the Privacy Protection Law.