Privacy Policy

Aicademy is a learning platform for creating lessons, quizzes, flashcards, notes, learning paths and AI-supported study sessions. It is run by Diba Malikzadeh, a sole trader based in the United Kingdom. In this policy, "we", "us" and "Aicademy" mean that business.

We are the data controller for the information described here. That means we decide what is collected and why, and we are responsible for looking after it.

You can reach us about anything on this page at privacy@useaicademy.com.

This policy explains our side of things. For the rules that apply when you use the platform, see our Terms of Service.

Aicademy's AI features run on Azure OpenAI, Microsoft's enterprise AI service. This is a different product from the consumer ChatGPT service, with different data handling terms.

Our Azure resource is located in Microsoft's Sweden Central data centre, and anything stored at rest stays in that region. The processing itself — the moment your prompt is turned into a response — takes place within Microsoft's EU data zone, which means it may happen in Sweden or in another EU country, depending on where there is capacity.

According to Microsoft's published Azure OpenAI documentation, prompts and responses are not used to train or improve foundation models and are not shared with OpenAI, the company. We have not given Microsoft permission to use your content for anything of that kind.

Microsoft also runs automated abuse monitoring across the service. If content is flagged as potentially breaking Microsoft's rules, it may be stored separately and checked — usually automatically, and in some cases by authorised Microsoft staff. Because our resource sits in the European Economic Area, any staff who review it are located there too. This is Microsoft's process rather than ours, and it is on by default for services like Aicademy.

Aica is instructed not to repeat back personal information about real people, and to ask you to rephrase without it. But anything you send is still processed to produce a reply, so please do not put personal details about yourself or anyone else into prompts, uploads or study content.

Everything you make is private by default. It becomes visible to other people only when you choose to share or publish it. When you use those features we store the follow relationships, collaborator lists and notifications that make them work, the visibility setting you picked, and whether you want your name and profile shown alongside the content.

If you publish something publicly, it can be seen by anyone — including people without an Aicademy account — and may be picked up and indexed by search engines. Unpublishing removes it from Aicademy, but copies may survive in search engine caches or with people who already saved it.

If you are under 18, please talk to a parent or guardian before publishing anything publicly.

We do not sell your personal information, and we never use it for advertising.

We do rely on other companies to run Aicademy. These ones work only on our instructions, under a data processing agreement:

• Supabase — our database. Your account, lessons, quizzes, notes, tutor history and progress all live here, along with your sign-in sessions.
• Microsoft Azure OpenAI — AI generation and tutor replies
• Vercel — hosting the site, and basic page analytics
• Cloudinary — note images, avatars and cover images
• Resend — sending our emails
• PostHog — product analytics, covered in section 8

Three others are not working purely to our instructions. They decide some things for themselves, under their own privacy policies:

• Stripe handles payments and subscription billing, and makes its own decisions about fraud checks and record-keeping. See Stripe's Privacy Policy.
• Google and Microsoft run the sign-in itself if you choose that route, and tell us your name and email address so we can create your account.
• DiceBear generates default profile pictures. It is run by Florian Körner in Germany, and your browser fetches the image directly — so DiceBear sees your IP address and the username used to make it, and decides for itself what it does with that. Upload your own picture and we stop calling it.

Beyond that, we share information only where we need to comply with the law, respond to a valid legal request, enforce our terms, or protect users, the platform or the public.

Your information does not all sit in one place:

• Your account and everything you create is stored in London, in the UK
• AI processing happens in the EU, with anything stored at rest kept in Sweden
• Product analytics is processed in the EU, and default avatars are generated in Germany
• Hosting, media storage, email delivery, payments and Google Sign-In are provided by US-based companies. Microsoft Sign-In runs on Microsoft's global identity infrastructure.

Several of these companies are American even where they keep your data in the UK or the EU, and their staff can reach it to support and maintain the service. That counts as your information leaving the UK, so it is covered by the safeguards below.

Where information leaves the UK, it is protected by the International Data Transfer Addendum approved by the UK Information Commissioner, which forms part of our agreement with each of those providers. Transfers to the European Economic Area are covered by the UK's own adequacy regulations. You can ask us for a copy of any of this at privacy@useaicademy.com.

• Your account, content, tutor history and personalisation — until you delete them, or until you delete your account
• Text taken from uploaded documents — the same: until you delete it or your account
• Session recordings — 30 days
• Analytics events — kept for the retention period set on our PostHog plan, then deleted automatically
• Content flagged by Microsoft's abuse monitoring — held on Microsoft's systems, not ours. Microsoft does not publish how long for.
• Billing and subscription records — for around six years after the tax year they relate to, because HMRC requires it
• Images tied to deleted content — queued for removal when the content goes

You can delete your account yourself from Settings. That removes your profile, study content, tutor conversations, progress, uploaded document text, media and sign-in records from our database in one operation.

Three things sit outside that. Anything you published publicly may survive in search engine caches or with people who already saved it. Our analytics provider still holds the usage data recorded before you left, though any session recording ages out after 30 days — email us and we will delete that too. And Stripe keeps the payment records we are legally required to keep.

Beyond those, we may keep a small amount of information longer where the law requires it, or where we genuinely need it to prevent fraud or defend a legal claim.

Aicademy covers GCSE and A-level subjects, so we expect a good number of our users to be between 13 and 17. We design the service on that basis rather than treating it as an edge case.

You must be at least 13 to create an account. We do not knowingly collect information from children under 13. If you think a child under 13 has an account, tell us and we will look into it and act.

What that means in practice for users under 18:

• We do not build advertising profiles, and we do not sell personal information — to anyone, at any age
• We do not use analytics for advertising, and we do not use AI to analyse session recordings
• Everything you make is private until you decide otherwise
• We try to keep what we collect to what the service actually needs to work, and we treat what you write to Aica as yours

We take the best interests of younger users seriously when we design features, as the Information Commissioner's code for children expects. Where a decision affects how much information we collect from you, we would rather collect less.

If you are a parent or guardian and want to talk to us about your child's account, email privacy@useaicademy.com.

We protect your information with encrypted connections, hashed passwords and rate limits on sensitive account actions. Aicademy is run by one person, and no one else has access to the database.

No service can promise perfect security, so use a strong password and do not upload personal information you do not need to. If something does go wrong and it puts your rights at risk, we will tell the Information Commissioner's Office as soon as we can, and within 72 hours of finding out. If the risk to you is high, we will tell you as well.

We will update this policy as Aicademy changes. The date at the top always tells you when it last moved. If a change genuinely affects you — new kinds of information, a new reason for using it, a new company involved — we will give you notice in the product or by email rather than quietly editing the page.

For anything about this policy, your information, or a request about your rights:

Email: privacy@useaicademy.com

Run by: Diba Malikzadeh, sole trader, United Kingdom