Privacy Policy

Account information: Name, email address, and authentication credentials (via Google OAuth or email/password). If you upload a profile picture, we store that image.

Uploaded content: Documents, PDFs, images, YouTube URLs, and other study materials you upload. These are stored encrypted on Microsoft Azure Blob Storage.

Generated study materials: Summaries, flashcards, quizzes, mind maps, slides, podcasts, and adaptive tutoring sessions generated from your content.

Usage data: Pages visited, features used, session duration, interactions with study tools, quiz performance, and learning progress.

Device and technical data: IP address, browser type, operating system, device identifiers, and screen resolution. Collected automatically via server logs and analytics.

Payment information: Subscription plan, billing interval, and payment status. Payment card details are processed and stored exclusively by our payment processor (Dodo Payments) and are never stored on our servers.

Preferences: Theme settings, font preferences, wallpaper selections, and reading configuration. These are synced across your devices.

We process your data under the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing your uploaded content to deliver study materials, managing your account and subscription
• Legitimate interests (Art. 6(1)(f)): Analytics to improve our platform, fraud prevention, security monitoring
• Consent (Art. 6(1)(a)): Non-essential cookies, marketing communications (where applicable)
• Legal obligation (Art. 6(1)(c)): Tax records, regulatory compliance, responding to lawful requests

When you upload study materials, our AI processes your content to generate summaries, flashcards, quizzes, mind maps, podcasts, and adaptive tutoring sessions. This processing uses third-party AI services including Microsoft Azure OpenAI and Google Gemini.

Your content is never used to train public AI models. It is processed solely to deliver study features to you, is not shared with other users, and is not sold to third parties. Third-party AI providers process your content under our data processing agreements and do not retain your data after processing.

We may use anonymised, aggregated usage patterns (not your actual content) to improve the accuracy and quality of our AI features. This aggregated data cannot identify individual users or reconstruct study materials.

We do not sell your personal data. We share information only with:

• Cloud infrastructure: Microsoft Azure (hosting, database, blob storage, AI services) — data centres in the US and Europe
• AI processors: Azure OpenAI, Google Gemini — for content analysis and generation
• Payment processor: Dodo Payments — for subscription billing
• Analytics: Google Analytics (anonymised) — for understanding usage patterns
• Authentication: Google OAuth — for sign-in
• Legal authorities: When required by law, court order, or to protect our rights

All third-party processors operate under data processing agreements that require them to protect your data and limit its use to providing services on our behalf.

All data in transit is encrypted using TLS 1.3. Stored data, including uploaded documents, generated materials, and personal information, is encrypted at rest using AES-256 on Microsoft Azure infrastructure.

Our infrastructure uses enterprise-grade cloud security with network isolation, automated security patching, and restricted access through multi-factor authentication and role-based access controls. All access to user data is logged and auditable. We implement CSRF protection, input sanitisation, and secure session management throughout our platform.

Your uploaded documents, generated study materials, and study progress are retained as long as your account is active. When you delete a document, it and all derived materials are permanently removed within 30 days.

If you close your account, all personal data and study materials are deleted within 90 days, except where retention is required for legal, regulatory, or fraud prevention purposes (up to 7 years for financial records). Usage analytics are anonymised after 24 months.

Ultra Learn operates globally. Your data may be processed in India, the United States, and the European Union depending on the service used. When we transfer personal data across borders, we ensure appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where available
• Data processing agreements with all third-party processors
• Compliance with India's DPDPA requirements for cross-border data transfer

Depending on your jurisdiction, you have the following rights:

All users:

• Access your personal data and study materials
• Correct inaccurate information
• Delete your account and all associated data
• Export your data in a portable format

EU/EEA/UK residents (GDPR):

• Right to restriction of processing
• Right to object to processing based on legitimate interests
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with your supervisory authority

California residents (CCPA):

• Right to know what personal information is collected
• Right to request deletion of personal information
• Right to opt out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your rights

Indian residents (DPDPA):

• Right to access information about your personal data
• Right to correction and erasure of personal data
• Right to grievance redressal
• Right to nominate another person to exercise your rights

To exercise any of these rights, contact privacy@ultralearn.life. We respond to all legitimate requests within 30 days.