Privacy Policy

CaptoLearn is an AI-powered study tool developed by Bytes Forge. We are the data controller for personal data collected through this platform. If you have any questions about this policy or your data, contact us at support@captolearn.com.

We collect the following categories of personal data:

• Account data — your email address and hashed password when you register.
• Profile data — optional display name and avatar you provide in settings.
• Study content — images, text, flashcards, quiz attempts, and other study material you upload or generate.
• Usage data — pages visited, features used, session duration, and device/browser metadata collected via Google Analytics.
• Payment data — billing information processed by our payment provider (Paddle). We never store raw card details on our servers.
• Cookie data — authentication session cookies and, with your consent, analytics cookies (see Section 7).

We use your data to:

• Provide and operate the CaptoLearn service.
• Authenticate your account and keep sessions secure.
• Generate AI-powered study tools from your uploaded material.
• Process subscription payments and send billing receipts.
• Send transactional emails (email verification, password reset, billing receipts).
• Analyse platform usage to improve features (only with your consent for analytics cookies).
• Comply with legal obligations.

We do not sell your personal data to third parties, and we do not use your study content to train AI models without your explicit consent.

For users in the European Economic Area (EEA) and United Kingdom, we process your data under the following legal bases:

We share your data only with trusted processors required to run the service:

All processors are bound by data processing agreements that require them to protect your data in accordance with applicable law.

We retain your personal data for as long as your account is active, or as needed to provide the service. You can set a custom data retention period in your privacy settings. When you delete your account, we delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or financial obligations (typically up to 7 years for financial records).

We use the following types of cookies:

You can manage your cookie preferences at any time using the cookie consent banner or by contacting us.

Under GDPR (and similar laws), you have the following rights regarding your personal data:

To exercise any of these rights, email us at support@captolearn.com. We will respond within 30 days.

Some of our processors are based in the United States. Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection.

CaptoLearn is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

We use industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, and Supabase Row-Level Security (RLS) to ensure your data can only be accessed by you. We conduct regular security reviews and promptly address any vulnerabilities discovered.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 14 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

For any privacy-related questions or to exercise your rights, contact us at: