Privacy Policy
Definitions
- Personal Data: Any information relating to an identified or identifiable individual (e.g., name, email, user ID, voice recordings).
- Audio Data: Voice recordings, audio files, and related metadata collected through our recording and transcription services.
- Transcription Data: Text generated from audio content, including interim transcripts, final transcripts, summaries, and AI-generated insights.
- Processing: Any operation performed on personal data, such as collection, storage, use, transcription, or deletion.
- Third Party: Any organization or person other than StudySync and the user.
- AI Features: Automated tools and services, including Agent Mode commands, that use artificial intelligence to generate responses, recommendations, transcriptions, or analyze data.
- Agent Mode: A command-driven AI interface for managing lectures, courses, assignments, and grades by retrieving data from connected services.
Who We Are
StudySync is operated by Zia Ullah Khan, Rockville, MD 20852, USA. Email: khansokan1234@gmail.com
StudySync is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights regarding your information. We comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) where applicable.
By creating an account and using StudySync, you consent to the practices described in this Privacy Policy.
Cookies & Tracking Technologies
StudySync uses cookies and similar technologies (such as local storage, analytics SDKs, and pixels) to operate the platform, remember your preferences, and analyze usage. You can control cookies through your browser settings. For more details, see our Cookie Policy (coming soon).
Audio Data Collection and Processing
What Audio Data We Collect
- Audio Recordings: Voice recordings from file uploads, live recording sessions, and real-time transcription sessions
- Audio Metadata: File size, duration, recording quality, timestamp, and session information
- Transcription Data: AI-generated text transcripts, confidence scores, speaker identification (when applicable), and processing timestamps
- Usage Analytics: Recording session duration, feature usage patterns, error logs, and performance metrics
How We Process Audio Data
- Real-Time Processing: Live audio streams are processed through secure WebSocket connections for immediate transcription
- Third-Party AI Services: We use AssemblyAI and other AI services to transcribe audio content and generate summaries
- Temporary Storage: Audio files are temporarily stored on our servers for processing, typically for up to 30 days
- Transcription Generation: Audio is converted to text using AI services, with transcripts stored as part of your account data
- Quality Enhancement: We may process audio to improve transcription accuracy (noise reduction, normalization)
Audio Data Security
- Encryption: Audio data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption
- Access Controls: Strict access controls limit who can access audio data to authorized personnel only
- Secure Transmission: Real-time audio streams use secure WebSocket connections with authentication
- Data Minimization: We collect only the audio data necessary for transcription and service functionality
Audio Data Retention
- Audio Files: Original audio files are automatically deleted after 30 days unless explicitly saved by you
- Transcriptions: Text transcripts are retained as part of your account data until you delete them or close your account
- Live Session Data: Real-time transcription data is processed immediately and not permanently stored unless you save the session
- Backup Data: Audio data in backups is retained for up to 30 days for disaster recovery purposes
Agent Mode Data Usage and Privacy
When you use Agent Mode, we access data from third-party educational platforms (e.g., Canvas) on your behalf. Your OAuth tokens are encrypted in transit and at rest, and used solely to retrieve your course, assignment, and grade information.
- OAuth Tokens: Stored securely and used only to fulfill your data retrieval requests.
- Agent Mode Logs: Commands and responses are logged for service improvement; you may request deletion of these logs at any time.
- Data Caching: Retrieved academic data is cached for up to 7 days to optimize performance, then purged automatically.
Your Rights Regarding Agent Mode Data
You have the right to access, correct, or delete any data retrieved via Agent Mode, including OAuth tokens, command logs, and cached academic data. To exercise these rights, visit your account settings or contact our Data Protection Officer.
- Access: Request a copy of your Agent Mode tokens, logs, and cached data.
- Deletion: Revoke Agent Mode access at any time to delete stored OAuth tokens, logs, and cached data.
- Correction: Request correction of any inaccurate data retrieved by Agent Mode.
- Opt-Out: Disable Agent Mode in your account to stop any data retrieval and storage.
CCPA/CPRA Data Disclosure Table
| Category | Source | Purpose | Disclosure | Retention |
|---|---|---|---|---|
| Identifiers (name, email, user ID) | User | Account creation, login, support | Service providers | Until account deletion or 12 months inactivity |
| Audio Recordings & Voice Data | User | Transcription, AI analysis, service features | AI transcription services (AssemblyAI) | 30 days (audio files), until deletion (transcripts) |
| Transcription & AI-Generated Content | User, AI processing | Learning features, content analysis | None (unless user shares) | Until user deletes or account deletion |
| Usage Data (logs, interactions) | User, system | Improve service, analytics | Analytics providers | 12 months |
| Uploaded Files | User | Learning features | None (unless user shares) | Until user deletes or account deletion |
| Payment Data | User | Subscription processing | Payment processor | Not stored by StudySync |
| AI-Generated Content | User, AI | Learning features | None | Until user deletes or account deletion |
| OAuth Tokens & Agent Mode Data | User, third-party platforms | Agent Mode functionality, academic data retrieval | Canvas LMS, educational platforms | Until revoked (tokens), 7 days (cached data), until deletion (logs) |
| Academic Data (courses, assignments, grades) | Third-party platforms via Agent Mode | Study management, assignment tracking | None (unless user shares) | 7 days (cached), until user deletes (saved data) |
Data Retention Schedule
- Account data: Deleted upon user request or after 12 months of inactivity.
- Audio recordings: Automatically deleted after 30 days unless explicitly saved by user.
- Transcription data: Retained until user deletion or account closure.
- Live transcription sessions: Not permanently stored unless user saves the session.
- Uploaded files, chat logs, flashcards, quizzes: Deleted when you delete them or your account.
- Analytics data: Retained for up to 12 months.
- Payment data: Not stored by StudySync; see payment processor policy.
- OAuth tokens: Retained until revoked by user or account deletion.
- Agent Mode logs: Retained until user requests deletion or account closure.
- Cached academic data: Automatically purged after 7 days.
- Backups (including audio data): Retained for up to 30 days for disaster recovery.
- Backups (including audio data): Retained for up to 30 days for disaster recovery.
International Data Transfers
If your data is transferred outside your country (e.g., to the US), we use Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or the EU-U.S. Data Privacy Framework (DPF) as appropriate to protect your rights.
Subprocessors
We use trusted third-party service providers (subprocessors) for hosting, analytics, payment processing, and AI services including audio transcription. Key subprocessors include AssemblyAI (for audio transcription), cloud hosting providers, and payment processors. A current list is available upon request and will be published at /subprocessors.
Automated Decision-Making & Profiling
StudySync's AI features may provide recommendations, generate content, or transcribe audio, but do not make decisions that have legal or similarly significant effects on users. Audio transcription is performed by AI services to convert speech to text, but does not involve profiling or automated decision-making about individuals. No fully automated decisions are made regarding your rights or access. If this changes, we will update this policy and explain the logic and consequences.
Data Protection Impact Assessments
We conduct Data Protection Impact Assessments (DPIAs) for new features that may affect your privacy, especially those involving AI, audio processing, voice recordings, or sensitive data. Audio recording and transcription features have been assessed for privacy risks and appropriate safeguards have been implemented.
Breach Notification
If we become aware of a data breach affecting your personal data, we will notify you without undue delay and, where required, within 72 hours, in accordance with applicable law.
Supervisory Authority & Complaints
If you are in the EU or UK, you have the right to lodge a complaint with your local Data Protection Authority. Our lead authority is the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland (dataprotection.ie).
Your Rights
Under GDPR and CCPA, you have the following rights regarding your personal data, including chat sessions, flashcards, quizzes, quiz scores, audio recordings, transcriptions, and recommendations:
- Access, download, or delete your data (including chat history, flashcards, quizzes, quiz scores, audio recordings, transcriptions, and recommendations) at any time from the User Data page or via available API endpoints
- Right to rectify inaccurate data (including correcting transcription errors)
- Right to restrict or object to processing of your data in certain situations
- Right to data portability (download your data including transcriptions in a machine-readable format)
- Right to withdraw consent for audio recording and processing at any time
- Right to opt-out of audio features while continuing to use other StudySync services
- We do not sell your personal information to third parties.
- California users have the right to request access to, or deletion of, their personal data.
- If you have questions or requests regarding your data, or wish to confirm that your data is not being sold, please visit our User Data page or contact us below. To submit a verifiable request under the CCPA, please use these channels. To verify your identity, we may ask for additional information, such as account details or confirmation via your registered email address, before processing your request.
- Although we do not sell your personal information, California residents have the right to opt-out of the sale of their personal information. You can exercise this right by contacting us or visiting our [Do Not Sell My Personal Information page - Link to be added when page exists].
Children's Privacy (COPPA)
StudySync is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information and terminate the child's account. If you believe we might have any information from or about a child under 13, please contact us immediately at khansokan1234@gmail.com, and we will delete the information as required.
Contact & Data Protection Officer
Our Data Protection Officer (DPO) is responsible for overseeing compliance with data protection laws. For privacy-related questions or to exercise your rights, please contact our DPO at khansokan1234@gmail.com.