Privacy Policy

This Privacy Policy explains how Pluddy("we", "us") processes personal data when you use www.pluddyonline.comand related services (the "Service").

1. Who we are

Controller for website enquiries and our own marketing/operations data: Pluddy, contact hello@pluddyonline.com.

For student and school-account data processed inside a school's workspace, the school is typically the data controller and Pluddy acts as a data processor under GDPR Article 28. See the Data Processing Agreement (DPA) or email hello@pluddyonline.com for a signed copy.

2. Data we process

• Account data: name, email, role (student / teacher / school admin), authentication identifiers
• Learning data: CEFR level, exercise scores, weak/strong areas, vocabulary progress, chat/practice transcripts used for tutoring context
• School content: uploaded materials (e.g. PDFs) and derived lesson / exercise content tied to the school
• Usage / technical: basic logs needed for security, debugging, and service reliability (IP address, timestamps, approximate device/browser metadata)
• Push tokens (student app, optional): an Expo push token for the device if you enable homework or streak reminders. Stored until you turn reminders off or delete the account. Not used for ads.
• Demo / contact forms: name, work email, school name, role, optional message

We do not sell personal data, run advertising pixels for ads, or use school content to train our own AI models.

3. Purposes and legal bases

• Provide the Service (contract / school instructions as processor)
• Secure and improve reliability (legitimate interests)
• Respond to demos and support (legitimate interests / pre-contract)
• Send optional study reminders on the student app (consent — you enable notifications in Settings)
• Comply with law (legal obligation)

4. AI processing (Google Gemini — global API)

Tutoring replies, drills, reviews, and material extraction are generated using the Google Gemini API (consumer endpoint generativelanguage.googleapis.com). Each school uses its own Gemini API key where configured. Requests are sent from our servers to Google for inference and returned to the Service.

This is a global endpoint today— Google may process prompts and outputs outside the EEA under Google's terms and transfer safeguards (such as Standard Contractual Clauses / Google's Data Processing Addendum). We do not currently route school traffic through Vertex AI regional endpoints, so we do notclaim that AI processing stays inside the EU. An in-product "AI region" preference may exist for future use; it does not pin processing to the EU while the global API is in use.

Under Google's paid / Gemini API terms applicable to billed use, Google states that API inputs and outputs are not used to train their generative models. Schools must use a properly billed Gemini / Google AI setup suitable for institutional data — not an unpaid consumer tier that permits broader use of inputs. We do not use School Content to train or fine-tune our own models.

Only data needed for the request is sent (for example selected note excerpts, chat turns, or drill prompts). App data such as accounts and stored PDFs remain in our database / storage providers and are not wholesale copied to Google.

5. Sub-processors

We use trusted providers to run the Service, which may include:

• Hosting / application delivery (e.g. Vercel)
• Database and storage (e.g. Supabase)
• Authentication (Supabase Auth)
• AI inference (Google Gemini global API — may process outside the EEA; see section 4)
• Transactional email (e.g. Brevo) for demo and operational messages
• Optional student-app push delivery (Expo push service, Apple APNs, Google FCM) when reminders are enabled

A current sub-processor list can be provided to school customers under a DPA.

6. Retention

• Account and learning data: for the life of the account / school contract, then deleted or returned per the DPA
• Optional Expo push tokens: until you turn reminders off or delete the account
• School Content after cancellation: typically deleted within 30 days unless law requires longer
• Demo form enquiries: kept as needed to respond and for reasonable business records
• Security logs: retained for a limited period appropriate to security needs

7. Your rights (GDPR)

Depending on your role and applicable law, you may have rights to access, rectify, erase, restrict, object, and data portability. Students and parents should usually contact their school first (the controller). You may also contact us at hello@pluddyonline.com. You can lodge a complaint with your local supervisory authority (in Poland: UODO).

8. Children

The Service is offered through schools. Schools are responsible for obtaining any required consents or providing notices for students, including minors, under applicable education and privacy rules.

9. Security

We apply technical and organisational measures appropriate to the risk (access control, encrypted transport, logical school isolation). No method of transmission or storage is 100% secure.

10. International transfers

Where data is processed outside the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, as described by the relevant provider.

11. Changes

We may update this Policy by posting a new version here. Material changes for school customers will be communicated where practicable.

12. Contact

Privacy questions: hello@pluddyonline.com

Related: Terms of Service