Who we are
PSTUDY is operated by Tesco Engineering BV, a company incorporated in Belgium with its registered office at Heibergstraat 6, 2235 Hulshout, Belgium. Our Belgian VAT number (BTW/VAT) is BE 0477 579 104. When this policy refers to “we”, “us”, or “our”, it means Tesco Engineering BV in relation to the PSTUDY service.
If you have questions about how we handle personal data, you can reach our privacy contact at privacy@pstudy.be.
What data we collect
We only collect information that we genuinely need to run PSTUDY and to keep it safe. Depending on how you use the product, this may include your email address and name when you create an account or join the beta, and any optional note you choose to add about how you plan to use PSTUDY (for example on the signup form). We store the study content you create, such as decks, cards, titles, and any images or attachments you upload as part of your decks.
When you practise, we record activity that is tied to your account, such as which decks you practised, when you practised, and scores or outcomes that the product needs in order to show you progress and run the modes you select. If you use the AI deck generator, we process the text you submit as input to that feature so we can return a generated result. If you take or issue exams through PSTUDY, we store the exam results and related data needed to operate exams. If you email us or use support channels, we keep the correspondence and any details you volunteer so we can respond and improve the service.
Why we collect it (legal basis under GDPR)
Most processing is necessary to perform our contract with you: creating and maintaining your account, storing and syncing your decks, running practice and exam features, and delivering the PSTUDY experience you signed up for. Where we rely on legitimate interests, we use them in a measured way for running and securing the service, preventing abuse, and making sensible product improvements that do not override your rights. Where a feature is clearly optional and not required to provide the core service, we will rely on consent when the law requires it, and you can withdraw consent at any time without affecting processing that is still lawful on another basis.
How long we keep it
We keep account information for as long as your account exists. If you ask us to delete your account, we will anonymise personal data within 30 days and complete hard deletion of the underlying account record and related personal identifiers within 90 days, except where a longer retention is required by law. If an account becomes inactive with no meaningful use, we may delete or anonymise it after three years of inactivity, subject to any legal holds.
Deck content remains until you delete it or delete your account. Practice activity is kept on a rolling twelve-month basis so recent learning history stays available without holding years of detailed logs indefinitely. We do not retain a server-side log of the text you submit to AI generation. Your input is sent to OpenAI to produce a result, and is not stored in PSTUDY's own database. OpenAI's own retention practices apply to their processing — see their Data Privacy Framework commitments.
Who we share it with (processors)
We use carefully chosen service providers (“processors”) who process personal data on our instructions. They may only use the data to provide their service to us. The main providers today are:
Supabase provides authentication and the primary application database. Data for PSTUDY is hosted in the European Union (eu-west-3, Paris, France). Processing is governed by our agreement with Supabase and standard contractual terms required by GDPR.
Vercel hosts the PSTUDY web application. Engineering and edge infrastructure may involve processing in the United States. Where data is transferred to the United States, we rely on the EU–US Data Privacy Framework and supplementary measures as appropriate, together with Vercel’s data processing terms.
OpenAI powers AI deck generation when you use that feature. Processing may take place in the United States. We rely on the Data Privacy Framework and OpenAI’s enterprise / API data processing commitments for transfers and safeguards. Per OpenAI's API data processing terms, OpenAI may retain API inputs for up to 30 days for abuse monitoring before deletion. Inputs are not used to train OpenAI's models when accessed via their API.
Cloud86 provides email delivery for transactional messages (for example invitations and security emails). Processing occurs in the Netherlands / European Union in line with our configuration.
Paddle is listed because we intend to use it as the merchant of record for payments when paid plans go live. Paddle is not active during the private beta; when it is enabled, payment-related data will be processed under Paddle’s terms and a separate checkout flow. We will update this policy before payments go live.
Where your data is stored
The authoritative copy of your account and deck data lives in our Supabase database in France (EU). The PSTUDY website is deployed on Vercel; pages and assets may be cached at edge locations, including within the EU where available, so that the application loads quickly. That caching does not change who controls your data: Tesco Engineering BV remains responsible, and our processors act on our instructions.
Your rights under GDPR
If EU data protection law applies to you, you have a set of rights that we take seriously. You may request access to the personal data we hold about you (Article 15 GDPR), and ask us to correct inaccurate information (rectification, Article 16). You may request erasure (“right to be forgotten”) where the law allows (Article 17), and in many cases you can delete content yourself inside the product. You may request data portability (Article 20); PSTUDY supports exporting your decks in a portable text format from the product, which is the practical way to move your study material elsewhere. You may also ask for restriction of processing (Article 18) or object to processing that is based on legitimate interests (Article 21), and we will respond within the time limits set by law.
PSTUDY does not perform automated decision-making that produces legal or similarly significant effects solely by automated means (Article 22). Features such as AI generation are assistive tools; they do not replace human judgement for exams or formal assessments on our side.
How to exercise your rights
The simplest route is to email privacy@pstudy.be from the address associated with your account (or tell us which account is yours). We will confirm receipt and respond within 30 days. If a request is unusually complex, GDPR allows us to extend that period by up to two further months; if that happens, we will explain why and keep you informed.
Cookies and similar technologies
PSTUDY uses a small number of strictly necessary first-party cookies so that you can stay signed in and so that your browser can complete secure authentication with our backend. We do not use analytics cookies, advertising cookies, or third-party marketing trackers. A short dedicated page describes the exact cookies we use: see Cookies.
Right to lodge a complaint
If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Belgian Data Protection Authority. You can find contact details and filing instructions on their website at dataprotectionauthority.be.
Changes to this policy
We may update this privacy policy from time to time, for example when we launch new features, change processors, or need to reflect legal requirements. When we make a material change, we will notify you in a sensible way—such as a short email to your registered address or a clear notice inside the application—so you are not surprised. The “Last updated” date at the top will always reflect the latest version.