Who we are
PSTUDY is operated by Tesco Engineering BV, a company incorporated in Belgium with its registered office at Heibergstraat 6, 2235 Hulshout, Belgium. Our Belgian VAT number (BTW/VAT) is BE 0477 579 104. When this policy refers to “we”, “us”, or “our”, it means Tesco Engineering BV in relation to the PSTUDY service.
If you have questions about how we handle personal data, you can reach our privacy contact at privacy@pstudy.be.
What data we collect
We only collect information that we genuinely need to run PSTUDY and to keep it safe. Depending on how you use the product, this may include your email address and name when you create an account or join the beta, and any optional note you choose to add about how you plan to use PSTUDY (for example on the signup form). We store the study content you create, such as decks, cards, titles, and any images or attachments you upload as part of your decks.
When you practise, we record activity that is tied to your account, such as which decks you practised, when you practised, and scores or outcomes that the product needs in order to show you progress and run the modes you select. If you use the AI deck generator, we process the text you submit as input to that feature so we can return a generated result. If you take or issue exams through PSTUDY, we store the exam results and related data needed to operate exams. If you email us or use support channels, we keep the correspondence and any details you volunteer so we can respond and improve the service.
If you use speak practice and choose Google Cloud as the recognition engine, short recordings of your voice are sent for transcription while you answer. We do not store them: the audio passes through our server to the speech provider and is never written to our database.
Why we collect it (legal basis under GDPR)
Most processing is necessary to perform our contract with you: creating and maintaining your account, storing and syncing your decks, running practice and exam features, and delivering the PSTUDY experience you signed up for. Where we rely on legitimate interests, we use them in a measured way for running and securing the service, preventing abuse, and making sensible product improvements that do not override your rights. Where a feature is clearly optional and not required to provide the core service, we will rely on consent when the law requires it, and you can withdraw consent at any time without affecting processing that is still lawful on another basis.
How long we keep it
We keep account information for as long as your account exists. If you ask us to delete your account, we will anonymise personal data within 30 days and complete hard deletion of the underlying account record and related personal identifiers within 90 days, except where a longer retention is required by law. If an account becomes inactive with no meaningful use, we may delete or anonymise it after three years of inactivity, subject to any legal holds.
Deck content remains until you delete it or delete your account. Practice activity is kept on a rolling twelve-month basis so recent learning history stays available without holding years of detailed logs indefinitely. We do not retain a server-side log of the text you submit to AI generation. Your input is sent to OpenAI to produce a result, and is not stored in PSTUDY's own database. OpenAI's own retention practices apply to their processing — see their Data Privacy Framework commitments.
Who we share it with (processors)
We use carefully chosen service providers (“processors”) who process personal data on our instructions. They may only use the data to provide their service to us. The main providers today are:
Supabase provides authentication and the primary application database. Data for PSTUDY is hosted in the European Union (eu-west-3, Paris, France). Processing is governed by our agreement with Supabase and standard contractual terms required by GDPR.
Vercel hosts the PSTUDY web application. Engineering and edge infrastructure may involve processing in the United States. Where data is transferred to the United States, we rely on the EU–US Data Privacy Framework and supplementary measures as appropriate, together with Vercel’s data processing terms.
OpenAI powers AI deck generation when you use that feature. Processing may take place in the United States. We rely on the Data Privacy Framework and OpenAI’s enterprise / API data processing commitments for transfers and safeguards. Per OpenAI's API data processing terms, OpenAI may retain API inputs for up to 30 days for abuse monitoring before deletion. Inputs are not used to train OpenAI's models when accessed via their API.
Google Cloud Speech-to-Text transcribes your speech during speak practice, if you choose it. Practice uses your browser's own speech recognition by default; Google Cloud is an engine you select yourself, per browser, in the exercise settings. What we send is short audio clips of roughly a second recorded while you answer, the practice language you chose, and the words of the deck you are practising, supplied as recognition hints to improve accuracy. No account identifier, name or email address is sent with the request. We use Google's global Speech-to-Text endpoint and do not pin a processing region, so this processing may take place outside the European Union, including in the United States. We rely on Google's data processing terms and the standard contractual clauses for those transfers.
When you leave the engine on your browser's own speech recognition, the transcription is performed by your browser rather than by us. In Chrome and Edge that involves the browser sending audio to Google; on Apple devices it may run on the device. That processing is between you and the maker of your browser, and we neither see nor control it.
Resend delivers the email PSTUDY itself sends: invitations to review or approve a deck, notices that a review was completed or that changes were requested, and invitations to join a school. It receives the recipient's email address and name, together with whatever the message contains — typically a deck or exam title and a link. Resend, Inc. is established in the United States; transfers are made under its data processing terms and the standard contractual clauses.
Cloud86 provides our mail server, which carries two things: the account email sent by our authentication provider on our behalf — sign-up confirmation and password reset — and the messages you send through our contact and help forms, which arrive in our own inbox. It receives the sender's or recipient's address and the contents of those messages. Processing occurs in the Netherlands / European Union.
Paddle is listed because we intend to use it as the merchant of record for payments when paid plans go live. Paddle is not active during the private beta; when it is enabled, payment-related data will be processed under Paddle’s terms and a separate checkout flow. We will update this policy before payments go live.
Where your data is stored
The authoritative copy of your account and deck data lives in our Supabase database in France (EU). The PSTUDY website is deployed on Vercel; pages and assets may be cached at edge locations, including within the EU where available, so that the application loads quickly. That caching does not change who controls your data: Tesco Engineering BV remains responsible, and our processors act on our instructions.
Your rights under GDPR
If EU data protection law applies to you, you have a set of rights that we take seriously. You may request access to the personal data we hold about you (Article 15 GDPR), and ask us to correct inaccurate information (rectification, Article 16). You may request erasure (“right to be forgotten”) where the law allows (Article 17), and in many cases you can delete content yourself inside the product. You may request data portability (Article 20); PSTUDY supports exporting your decks in a portable text format from the product, which is the practical way to move your study material elsewhere. You may also ask for restriction of processing (Article 18) or object to processing that is based on legitimate interests (Article 21), and we will respond within the time limits set by law.
PSTUDY does not perform automated decision-making that produces legal or similarly significant effects solely by automated means (Article 22). Features such as AI generation are assistive tools; they do not replace human judgement for exams or formal assessments on our side.
How to exercise your rights
The simplest route is to email privacy@pstudy.be from the address associated with your account (or tell us which account is yours). We will confirm receipt and respond within 30 days. If a request is unusually complex, GDPR allows us to extend that period by up to two further months; if that happens, we will explain why and keep you informed.
Cookies and similar technologies
PSTUDY uses a small number of strictly necessary first-party cookies so that you can stay signed in and so that your browser can complete secure authentication with our backend. We do not use analytics cookies, advertising cookies, or third-party marketing trackers. A short dedicated page describes the exact cookies we use: see Cookies.
Right to lodge a complaint
If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Belgian Data Protection Authority. You can find contact details and filing instructions on their website at dataprotectionauthority.be.
Changes to this policy
We may update this privacy policy from time to time, for example when we launch new features, change processors, or need to reflect legal requirements. When we make a material change, we will notify you in a sensible way—such as a short email to your registered address or a clear notice inside the application—so you are not surprised. The “Last updated” date at the top will always reflect the latest version.