Privacy Policy

1. Who we are

Acadu (“we”, “us”) is an intelligent tutoring platform that helps students learn from their own study materials. This policy explains what personal data we collect, why, and how you can control it.

2. Data we collect

• Account data — email address, name, and year of study.
• Study content — documents you upload, subjects, chats, flashcards, solutions, and whiteboards.
• Learning profile — mastery scores and review schedules used to personalize tutoring.
• Technical data — request logs and identifiers needed to operate the service.

3. How we use your data

• To provide and personalize the tutoring experience.
• To authenticate you and secure your account (including two-factor codes).
• To send transactional emails (password resets, verification codes).
• To generate AI explanations and answers from your uploaded content.

4. Legal basis (GDPR)

We process your data on the basis of contractual necessity (to provide the service you requested) and legitimate interest (security and service improvement). Where required, we obtain your consent.

5. Sub-processors

We use the following third-party providers to operate the service. Each processes data only on our instructions. Links are to their own privacy policies and terms, so you can read their commitments directly.

• Ollama Cloud — AI language model inference (transient processing; never trains on your data). Privacy · Terms
• OpenAI — AI inference (no-training-by-default, DPA-backed). Activated when configured. Privacy · Terms
• Neon — PostgreSQL database hosting (EU region). Privacy
• Cloudflare R2 — object storage for uploaded files. Privacy
• Resend — transactional email delivery. Privacy
• Vercel — frontend hosting and CDN. Privacy
• Oracle Cloud — backend hosting. Privacy
• Google (YouTube Data API) — fetches educational video results. Only the topic search query is sent server-side; no student identity or uploaded content is shared. Videos are embedded in privacy-enhanced mode (no cookies until interaction). Privacy · API Terms

6. AI processing of your content

To generate explanations, lessons and answers, the text of the material you upload is sent to our AI provider for processing. Acadu does not use your content to train its own models. Our current provider (“Ollama Cloud”) processes prompts transiently: it does not log, store, or use your content to train any model. When an alternative provider such as OpenAI is configured, the same applies — the commercial API does not train on data by default and offers Zero Data Retention. In all cases the text is sent only to produce a response for you.

Acadu may use different AI providers depending on the configuration of the service. The providers currently configured are listed in Section 5 above.

Do not upload material you are not permitted to share with a third-party processor (for example, confidential or personal documents belonging to someone else).

Age. Our AI provider’s terms are entered into by Zikriya Technologies Limited as the account holder, not by individual students. Students use Acadu, and their content is sent to the provider on our account. Where a student is under 18, a parent or guardian must give permission (see our Terms of Service).

7. International transfers

Some of the providers listed above are located outside the United Kingdom, including our AI inference and hosting providers in the United States. Where your personal data is transferred outside the UK, we rely on recognised safeguards under UK data protection law — such as the UK International Data Transfer Addendum / EU Standard Contractual Clauses, or the UK’s adequacy regulations for certain destinations.

Our AI provider processes data in the United States. Its published terms state that prompts and responses are processed transiently, are not stored beyond the time needed to fulfil the request, and are not used to train any model. We rely on those commitments, together with the transfer safeguards described above. You can ask us for more detail using the contact below.

8. Data retention

We retain your data for as long as your account is active. When you delete your account, we delete your active account data. Encrypted backups may retain copies temporarily until they are overwritten according to our backup retention schedule, and request logs are retained only as long as needed to operate and secure the service.

9. Your rights (GDPR)

You have the right to:

• Access and portability — download a copy of your data (Settings → Export data).
• Erasure — delete your account and all data (Settings → Delete account).
• Rectification — correct inaccurate data.
• Restriction and objection — limit or object to processing.

The learning profile we build (mastery scores and review schedules) is used only to personalize your study experience. It does not produce any decision with legal or similarly significant effect on you.

To exercise any of these rights, contact us at hello@acadu.org. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority — see ico.org.uk.

10. External links

Some features link to external sites (e.g. YouTube search results). Those sites are governed by their own privacy policies, and we are not responsible for their practices.

11. Contact

Questions about this policy? Email hello@acadu.org.