Privacy Policy

Swotly is run by Swotly ("we", "us"). We are the data controller for the personal data described here. This policy explains how we handle your data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact us at alexlazar2023@yahoo.com.

Who Swotly is for

Swotly is only for people aged 18 or over. We do not knowingly collect data from anyone under 18.

What we collect

• Account data: your email address, sign-in details and the date you accepted our Terms and confirmed you are 18 or over.
• Notes you submit: used only to create your questions. We store just the first 300 characters as an excerpt, not your full notes.
• What we generate for you: quizzes, flashcards, exam questions, your written answers and their marks.
• Credit records: a history of credits granted, spent and refunded.
• Payment records: when you buy credits we keep the pack bought, the amount paid, the date and Stripe's payment reference. Your card number, expiry date and security code are entered into Stripe's own payment form, so we never see or store them.
• Usage and technical data: AI token counts per request (for cost tracking) and basic security logs.

Why we use it (lawful bases)

• To provide the service you asked for (contract).
• To prevent abuse of free credits, keep the service secure and track costs (legitimate interests).
• To take payment for credits, issue refunds and keep records required for tax (contract and legal obligation).

Who we share it with

We use these processors, each under a written agreement:

• Anthropic: provides the AI models that write questions and mark answers. Your notes and answers are sent to Anthropic to process each request.
• Our hosting and database provider: stores your account and generated sets.
• Stripe: processes card payments when you buy credits. Card details go straight into Stripe's secure payment form, so we never see or store them. Stripe also calculates and collects any tax due on a purchase, and keeps its own transaction records as the payment provider.

Some processors may handle data outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Addendum.

How long we keep it

We keep your data while your account is open. You can delete any set at any time from your library, and delete your whole account from the Account page, which removes your sets, marks and credit history. Payment records are kept for as long as UK tax law requires, which is normally six years, even after an account is deleted. To stop the same email claiming free credits twice, we keep a one-way scrambled (hashed) version of your email address, which cannot be turned back into your email.

Your rights

You can ask to access, correct, delete, restrict or move your data, and object to processing. Email alexlazar2023@yahoo.com. You can also complain to the Information Commissioner's Office (ico.org.uk).

Cookies

We use only the storage needed to keep you signed in. We do not use advertising cookies.

Changes

We will tell you about any important changes to this policy by email or in the app.