Privacy Policy

1. Who we are (data controller)

Reviza (“we”, “us”, “our”) is the data controller for the personal data described in this notice. You can contact us about anything in this policy at privacy@reviza.app. We are not currently required to appoint a Data Protection Officer.

Before going live, replace this with your registered trading name, postal address and, if you are registered with the Information Commissioner’s Office, your ICO registration number.

2. The data we collect

• Account data: email address, display name and sign-in details.
• Study content: the notes, topics and photos you upload, and the tips, summaries, flashcards and quizzes we generate from them.
• Quiz results: your scores and when you took each quiz.
• Usage data: pages visited, a randomly-generated session identifier and referring site — collected only if you accept analytics cookies.
• Billing data: subscription status, plan and renewal dates. Card details are handled entirely by Stripe and never reach our servers.

Please do not upload special category data (for example health information) or other people’s personal data in your notes or photos.

3. Why we use it, and our lawful basis

• Providing your account and study sets — performance of our contract with you (Art. 6(1)(b)).
• Generating study materials with AI — performance of our contract with you (Art. 6(1)(b)).
• Taking payment and managing subscriptions — contract (Art. 6(1)(b)) and legal obligation for tax and accounting records (Art. 6(1)(c)).
• Keeping Reviza secure and preventing abuse — our legitimate interests in protecting the service (Art. 6(1)(f)).
• Analytics on how the app is used — your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Service emails (confirming your email, resetting your password, billing notices) — contract (Art. 6(1)(b)).

4. AI processing

When you create a study set, the notes, topic or photo you submit are sent to a third-party AI model through the Lovable AI Gateway so the materials can be generated. Those providers act as our processors, are contractually bound to use your content only to return a result to us, and are instructed not to use it to train their models.

We do not carry out automated decision-making that produces legal or similarly significant effects about you. Generated study material is a study aid only and may contain mistakes.

5. Who we share data with

We share data only with processors acting on our instructions under written data processing terms:

• Lovable Cloud / Supabase — hosting, database, authentication and file storage.
• Lovable AI Gateway and its model providers (including OpenAI) — generating study materials.
• Stripe — payments and subscription billing. Stripe is an independent controller for its own fraud-prevention and regulatory purposes.
• Google — only if you choose to sign in with your Google account.

We never sell your personal data or study content, and we do not use it for advertising. We may disclose data where the law requires it.

6. International transfers

Some of our providers process data outside the UK, including in the United States. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the EU Standard Contractual Clauses together with the UK Addendum, plus additional safeguards where needed. You can ask us for a copy of the safeguards in place.

7. How long we keep it

• Account, study sets and quiz scores: until you delete them or delete your account.
• Deleted accounts: removed from our live systems immediately and purged from encrypted backups within 30 days.
• Analytics records: 14 months.
• Payment and invoice records: 6 years after the end of the financial year, as UK tax law requires.

8. Security

Data is encrypted in transit and at rest. Every table uses row-level security so your study sets and account details are only reachable by you, and administrative access is limited to what is strictly necessary. If a personal data breach is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you without undue delay where required.

9. Cookies and analytics

We use strictly necessary cookies and local storage to keep you signed in — these do not need your consent. We only record page views after you choose “Accept analytics” in our cookie banner. Choosing “Essential only”, or clearing your browser storage, stops that tracking. You can change your mind at any time by clearing site data for Reviza in your browser, which brings the banner back.

10. Your rights

Under the UK GDPR you have the right to:

• be informed about how we use your data (this notice);
• access a copy of your data;
• have inaccurate data corrected;
• have your data erased;
• restrict how we process it;
• data portability — receive your data in a machine-readable format;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw consent where we rely on it, without affecting past processing.

You can exercise the access, portability and erasure rights yourself right now: sign in and use Download my data or Delete my account on your Account page. For anything else, email us and we will respond within one month.

11. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office — ico.org.uk or 0303 123 1113.

12. Children and the ICO Children’s Code

Most of our users are students aged 13 to 18, so Reviza is designed from the ground up to meet the ICO’s Age Appropriate Design Code (the “Children’s Code”). You must be 13 or older to create an account — you will be asked to confirm this when you sign up, and if we learn that an account belongs to someone under 13 we will delete it and its data. In the UK, children aged 13 and over can consent to online services themselves, so we do not need parental consent for our users — but parents and guardians are always welcome to contact us on a student’s behalf.

The Children’s Code standards, and how Reviza meets them:

• Best interests of the child: Reviza exists only to help you revise. We do not use your data for anything that could work against your interests, such as advertising, behavioural profiling or content recommendations designed to keep you hooked.
• Data minimisation: we collect only what we need to run your account and generate your study sets — your email, name, study content and quiz scores. We never ask for your school, location, contacts or date of birth.
• High privacy by default: analytics tracking is off unless you actively turn it on in the cookie banner, and your study sets and profile are visible to no one but you. There are no public profiles, follower lists or social features.
• No profiling or marketing to children: we do not build advertising profiles, we do not sell or share data with advertisers, and we do not send marketing emails — only service emails about your account and subscription.
• Transparency: this notice is written in plain language, and the banner choices are explained honestly without “dark patterns” or nudges towards less private options.
• Parental controls and detriments: there are no chat features, no user-generated public content and no geolocation tracking, so the usual risks to children online are designed out rather than managed.

A note for students: you can download everything we hold about you, or delete your whole account, any time from your Account page — no need to email anyone or give a reason. A note for parents and guardians: if you believe your child has created an account they should not have, or you want to ask about or erase their data, contact us at privacy@reviza.app and we will act promptly.

13. Changes to this notice

We may update this notice from time to time. The new version will appear on this page with an updated date and, where the changes are significant, we will tell you by email or in the app.

14. Contact us

Questions, requests or complaints about your data: privacy@reviza.app.