Privacy Policy

1. Who we are

APEX is an independent, AI-powered study platform that helps students prepare for International Baccalaureate (IB) Diploma examinations in Mathematics, Physics and Chemistry. We are the data controller responsible for your personal data processed through the platform.

For any privacy question or request you can contact us at privacy@apexedu.app.

2. Data we collect

We collect only what we need to run the service:

• Account data: your email address, an encrypted password (handled by our authentication provider — we never see it in plain text), and an optional display name.
• Learning data: the questions you generate, the answers you submit, AI feedback and scores, exam attempts, chat messages with the AI tutor, study plans, streaks, XP and achievements.
• Usage data: pages visited, features used, language preference and approximate counts such as daily task usage, used to enforce plan limits and improve the product.
• Billing data: if you subscribe to a paid plan, our payment processor (Stripe) collects and stores your payment details. We receive only a customer identifier and subscription status — never your full card number.
• Technical data: IP address, browser type and device information collected automatically for security, fraud prevention and error monitoring.

3. How we use your data

• To provide the core service: generate questions, grade answers, run the AI tutor, build study plans and track your progress.
• To maintain your account, authenticate you and remember your preferences.
• To enforce free and paid plan limits and process subscription payments.
• To secure the platform, prevent abuse and debug errors.
• To send essential service emails (for example account or billing notifications). We do not sell your data or use it for third-party advertising.

4. AI processing of your work

When you generate a question, submit an answer for marking, or chat with the tutor, the relevant text is sent to an AI model to produce the response. This processing exists solely to deliver the feature you requested.

We do not use your submitted answers or chat messages to train third-party advertising profiles. To generate a response, your work is sent to our AI provider (currently OpenAI) solely to produce the output you requested — it is not shared with that provider for any other purpose, such as advertising.

5. Legal bases for processing

Where the GDPR or similar laws apply, we rely on:

• Performance of a contract — to provide the service you signed up for.
• Legitimate interests — to secure, maintain and improve the platform.
• Consent — for any optional processing, which you may withdraw at any time.
• Legal obligation — where we must retain certain records (for example for tax).

6. Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in, remember your chosen language and operate the service. We do not use advertising or cross-site tracking cookies. You can clear this data in your browser at any time, though doing so will sign you out.

7. Service providers we share data with

We share the minimum necessary data with trusted processors that help us operate:

• Supabase — authentication and database hosting (account and learning data).
• Stripe — payment processing for paid plans (billing data).
• A transactional email provider — to send essential account emails.
• An error-monitoring provider — to capture technical errors and keep the service reliable.
• Each provider is bound by its own data-protection obligations and may process data outside your country.

8. Data retention

We keep your account and learning data for as long as your account is active so you can see your history and progress. If you delete your account, we delete or irreversibly anonymise your personal data within a reasonable period, except where we must retain limited records to meet legal obligations.

9. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be forgotten").
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time. To exercise any right, email privacy@apexedu.app and we will respond within the period required by law.

10. Security

We protect your data with encryption in transit, hashed passwords, row-level access controls in our database and restricted administrative access. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information and will notify affected users of any breach as required by law.

11. Children

APEX is intended for IB Diploma students, who are typically 16–19 years old. If you are under the age of digital consent in your country, you must use APEX with the involvement of a parent or guardian. We do not knowingly collect data from children under 13.

12. International transfers

Our providers may store and process data in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) to protect your data when it is transferred internationally.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will change the "last updated" date above and, for material changes, notify you through the platform. Continued use after an update means you accept the revised policy.

14. Contact

For any privacy question or to exercise your rights, contact us at privacy@apexedu.app.