Privacy Policy
1. Data controller
Studinotes, Paris, France. Contact: contact@studinotes.app
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password | Account creation, authentication | Contract |
| Cookies & UI prefs | Keep user logged in; remember layout | Legitimate interest |
| Username, profile image | Marketplace identity | Contract |
| Note content, PDFs, audio | Provide core service & AI features | Contract |
| Stripe transaction IDs | Payments & fraud prevention | Contract |
| Logs & analytics | Security, performance, improvement | Legitimate interest |
3. Who we share with
- OpenAI, LLC – AI text generation and Text-to-speech (US, SCC)
- Google LLM / Gemini – Text-to-speech and Text-to-speech (US, SCC)
- Stripe, Inc. – Payments (US/EU, BCR + SCC)
- Firebase (Google) – File storage (EU or US via SCC)
- Hetzner Online GmbH – DB hosting (Germany, EEA)
We do not sell your personal data.
4. International transfers
Data sent outside the EEA is protected by Standard Contractual Clauses or an equivalent lawful mechanism.
5. Retention
- Account data: while the account is active + 2 years
- Marketplace records: 10 years (tax law)
- Cookies: 12 months max
- Logs: up to 12 months
6. Your rights
You may request access, rectification, erasure, restriction, portability, or object to processing (GDPR/UK GDPR). Email privacy@studinotes.app. You may lodge a complaint with CNIL or your local authority.
7. Security
Passwords are hashed. Data in transit uses TLS. We apply role-based access controls and regular security audits.
8. Children
Studinotes is not directed to children under 16. We do not knowingly collect their data.
9. Cookies
Essential session cookies and layout-preference storage are required for functionality; analytics cookies are optional and set only with consent.
privacy.changes
privacy.changesDesc