Privacy Policy

1. Who we are

ReviseBase ("we", "us") operates the ReviseBase study platform (the "Service") at www.revisebase.com. We are the controller for your personal data. You can reach us through the contact page. If you are in the UK, your rights are under the UK GDPR and the Data Protection Act 2018; if you are in the EU/EEA, equivalent rights apply under the EU GDPR.

2. Data we collect

• Account data: your email address, the name you provide, a password held securely by our login provider, and your plan (Free/Premium).
• Uploaded documents and pasted material: the study content you upload or paste, stored in private storage — only you (and the AI processing needed to serve you) can access it.
• Prompts and AI outputs: the questions you ask the AI study assistant, and the notes, summaries, quizzes, flashcards, answers and recommendations AI generates from your material.
• Learning and progress data: quiz attempts, scores, confidence tags, mastery estimates, flashcard review history and study sessions, so the Service can track and support your learning.
• Usage data: daily counters (documents processed, questions generated) used to enforce plan limits.
• Support data: contact-form messages, question reports you raise, and public reviews you choose to publish (which display only a username you choose).
• Terms acceptance records: which versions of our legal documents you accepted and when.
• Payment-related data: payments are handled entirely by Stripe; we store only Stripe customer/subscription IDs and your plan status. We never see or store your card details.
• Technical data: our hosting and login provider processes standard logs and security data needed to run the Service. UNVERIFIED — HUMAN/PROVIDER CONFIRMATION REQUIRED: exact log contents, retention periods, and whether session-recording analytics are enabled at platform level.

3. How and why we use your data

| Purpose | Lawful basis | |---|---| | Providing your account, processing your materials, generating notes/quizzes/flashcards/answers and tracking progress | Contract — this is the Service you signed up for | | Enforcing plan limits and preventing abuse | Contract; legitimate interests (security) | | Recording which policy versions you accepted | Legal obligation / legitimate interests (evidence of our contract with you) | | Sending optional daily reminders and weekly progress digests | Consent — only when you switch them on in Settings; switch off anytime | | Billing and subscription administration | Contract; legal obligation | | Anonymous, aggregate usage statistics (only if you accept analytics cookies) | Consent | | Moderating public reviews and handling reports | Legal obligation / legitimate interests (safety) |

We never use your data for automated decisions with legal or similarly significant effects, and we do not profile you. We never sell your data.

4. Data minimisation

We collect only what the Service needs: we do not ask for your date of birth, address or school, we do not run identity or age checks, and we use the least data that makes each feature work.

5. Children and young people

ReviseBase is a study platform and may be used by under-18 learners. Because children may use the Service, we apply high-privacy defaults for everyone:

• your study materials and progress are never shown to other users, or to us, except where you explicitly choose to publish something (public reviews);
• optional emails are off unless you turn them on;
• analytics are off unless you accept them;
• we do not use behavioural profiling to keep children using the Service.

Parents and guardians may contact us to exercise rights on behalf of a child or ask us to delete a child's account. See our Young People's Privacy page, written for under-18 users.

6. AI processing of your content

To generate notes, quizzes, flashcards, tutor answers and recommendations, your study content is sent as prompts to third-party frontier AI models via our platform provider. This means your study content may be processed outside the UK, including in the United States. UNVERIFIED — HUMAN/PROVIDER CONFIRMATION REQUIRED: whether prompts/outputs are used for provider model training — we make no claim about this until it is confirmed in writing. See our AI Transparency page for the features, models and data involved. Do not paste other people's personal or sensitive information into materials unless you have permission.

7. Sharing, processors and subprocessors

We share personal data only with providers necessary to run the Service:

• Base44 — hosting, login, private file storage and email delivery. UNVERIFIED — HUMAN/PROVIDER CONFIRMATION REQUIRED: the data-processing agreement covering app end-user data and its subprocessor list.
• AI model providers (listed on our AI Transparency page) — prompts and uploaded content only, for the purpose of generating your study outputs.
• Stripe — payment processing; Stripe's own privacy policy applies to payment data.

8. International transfers

Our hosting and AI processing involve countries outside the UK, including the United States. Transfers rely on appropriate safeguards required by UK data protection law. UNVERIFIED — HUMAN/PROVIDER CONFIRMATION REQUIRED: the specific transfer mechanism (IDTA/UK Addendum or the UK Extension to EU adequacy) must be confirmed before it is named here.

9. Retention and deletion

We keep each category of data only as long as needed for its purpose, per our retention schedule. Study content, quizzes, flashcards and progress are kept while your account exists — you can delete any item anytime. Deleting your account (Settings → Delete account) permanently removes your topics, materials, quizzes, flashcards and study history. A small number of records may be retained where we must keep them (for example terms-acceptance evidence and billing IDs while a subscription is active); see our Data & Privacy Rights page for the full exceptions list. UNVERIFIED — HUMAN/PROVIDER CONFIRMATION REQUIRED: how quickly deleted file bytes disappear from platform backups.

10. Your rights

You can ask us to access, correct, export, restrict or delete your personal data, or object to our use of it. The fastest routes: most data is under your control in the app; account deletion is one click in Settings; for anything else use the contact page and we will respond within the statutory period (normally one month). You can withdraw consent (optional emails, analytics) anytime. UK users may complain to the ICO (ico.org.uk); EU/EEA users may complain to their local data protection authority.

11. Security

We protect your data with: private (never world-readable) file storage with short-lived signed URLs; per-user row-level security so accounts cannot read each other's data; server-side API-key handling so secrets never reach the browser; admin-only access controls enforced on the backend; and account suspension controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Breaches

If a personal-data breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours where the law requires, and tell affected users without undue delay where the risk to you is high.

13. Cookies and similar technologies

We use only essential cookies/local storage to run the Service (login, remembering your theme, hiding announcements you have seen). Anonymous usage analytics are off unless you accept them via the cookie notice. We use no advertising or cross-site tracking cookies. Full details: our Cookie Policy.

14. Changes

When we make material changes we update this document's version, explain what changed, and ask you to accept the new version before you continue using the Service.