Study Time customer privacy notice

Contact details

What information we collect, use, and why

We collect or use the following information to provide the Study Time service (account management and study tracking):

• Names and contact details for users
• Account access information
• Study session records (subjects/topics, hashtags, duration, start/end timestamps, and creation timestamp used for retention)
• Journaling entries (free-text reflections in editor content, optional)
• Feelings (optional)
• Consent audit metadata for optional journaling (consent status, when consent was recorded, consent notice version, and consent source)
• Data retention preference records (selected retention policy and when it was set)
• Progress reports

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide the Study Time service (account management and study tracking) are:

• Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Consent - we use consent for optional journaling fields (feelings and free-text reflections). You can withdraw your consent at any time in Settings. Withdrawal does not affect processing already carried out before withdrawal. We keep consent audit metadata (status, timestamp, notice version, and source) to evidence your consent choices.

Where we get personal information from

• Directly from you

How long we keep information

You can choose a per-user retention policy for study sessions and optional journaling content in Settings:

• 6 months
• 12 months
• 24 months
• Keep until I delete

For time-bound policies (6/12/24 months), a scheduled cleanup job runs daily and automatically deletes sessions older than your selected window, measured from each session's creation timestamp. Deleting a session also deletes its related topics and feelings.

If you choose "Keep until I delete", session records remain until you delete them manually or delete your account.

Account profile data and account-level settings are kept while your account is active. When your account is deleted, associated records are deleted within a reasonable period, unless a longer retention period is required for security, troubleshooting, or legal compliance.

Deleted data may remain in backups for a limited period before those backups are rotated out.

Retention preference metadata (policy and timestamp) and consent audit metadata (status, timestamp, notice version, and source) are retained to demonstrate compliance with your choices.

How we protect your information

In addition to baseline legal requirements, we apply extra field-level encryption to optional journaling content.

• We apply application-level encryption to optional journaling fields before storage: feelings and free-text reflection content.
• As a result, direct database access alone (including by database administrators) does not provide readable plaintext for these optional journaling fields.

Who we share information with

Data processors

Sharing information outside the UK

Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.