Privacy Policy
SchooledUp Inc. (“SchooledUp”, “we”, “us”) is accountable for the personal information it handles under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This policy explains what we collect, why, who we share it with, how long we keep it, and your rights. We are an independent vendor and are not affiliated with any school, college, or university.
1. Personal information we collect
- Account: your email address and authentication credentials.
- Content you upload: documents, images, audio, PDFs and text you add to the service, and the text we extract from them (which may include your name, course information, and study notes).
- Derived data: the notes, tasks, summaries, flashcards, and study plans we generate from your content.
- Integration data: tokens and content for services you connect, such as Google, Microsoft/OneNote, Notion, and email forwarding.
- Usage & technical data: log and usage records, and — subject to your consent — product-analytics events.
2. Why we use it
We use your information only to provide the service; to keep it secure and prevent abuse; to debug and maintain it; and to meet our legal obligations. We do not sell your information, and we do not use your content to train AI models.Where our AI providers support it, we route requests with settings that instruct them not to train on your content and to minimise how long they retain it; some providers' retention for their own abuse-monitoring or legal-compliance purposes is outside our control and is described in their policies.
3. Please don't upload restricted information
SchooledUp is for ordinary study material. Do not upload government or student IDs, official transcripts, grades or disciplinary records, medical, counselling, disability or accommodation information, financial or payment data, passwords or access keys, intimate or unlawful images, or confidential, exam-bank or answer-key material. We automatically screen uploads and block, quarantine, or delete restricted content. See our Upload Policy for the full list.
4. Service providers (subprocessors) and why
To run SchooledUp we share data with the following providers, only as needed to provide the service:
| Provider | Purpose | Data it receives |
|---|---|---|
| OpenRouter (routing to Google Gemini) | AI text & vision extraction | Uploaded text and images |
| Deepgram | Audio transcription (primary) | Audio you upload |
| OpenAI (Whisper) | Audio transcription (fallback) | Audio you upload |
| Supabase | Database, authentication, file storage | All account content and files |
| Purelymail | Email mailbox & ingest | Forwarded email content |
| Sign-in; Docs/Tasks/Calendar integrations | Auth tokens, profile, integration content | |
| Microsoft | OneNote integration | Auth tokens, exported note content |
| Notion | Notion integration | Auth codes, exported note content |
| Vercel / Railway | Web / API hosting | All request traffic |
| Cloudflare Turnstile | Bot / CAPTCHA protection | Challenge data |
| Google Analytics | Product analytics (consent-based) | Usage / page-view events |
5. Cross-border processing
Some of our providers process or store data outside Canada, including in the United States. While your information is in another country, it may be accessible to that country's courts, law enforcement, or national-security authorities under its laws. We require our providers to protect your information to a comparable standard, but we cannot override foreign lawful-access powers.
6. Retention
We keep personal information only as long as necessary for the purposes above, then delete or de-identify it, per our retention schedule. You can delete individual uploads anytime in the app, or your entire account via Settings (gear icon in the bottom navigation) → Delete account. Summary of default retention periods:
| Data category | Default retention |
|---|---|
| Raw uploaded file bytes | About 30 days after processing, then deleted |
| Extracted text | Life of your account (deletable anytime) — it is the source your notes and tasks are generated from |
| Forwarded email content | Discarded after extraction; not retained |
| AI request payloads sent to providers | Not retained by us; provider zero-retention where supported |
| Notes / tasks / study material | Life of your account; deletable anytime |
| Rejected uploads | Refused at upload and never stored |
| Logs & audit records | About 180 days |
| Account data | Until deletion (plus a short backup window) |
7. Your rights
You may access, correct, or delete your information; withdraw consent; and ask questions or make a complaint. Use Settings (gear icon in the bottom navigation) → Delete account, or contact us at privacy@schooledup.app. We respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
8. Safeguards
We protect your information with encryption in transit (HTTPS/HSTS), a private access-controlled file store, per-user database row-level security, encrypted storage of sensitive credentials, bot protection, and least-privilege internal access. No system is perfectly secure.
9. Privacy contact
Ryan Fong, CEO, is accountable for privacy at SchooledUp.
Contact: privacy@schooledup.app.
We may update this policy from time to time. If we make a material change we will post the revised version here with a new effective date and ask you to review it.