Privacy Policy

Effective date: [26 April 2026] This Privacy Policy explains how Grounded Study, operated at sulcai.com (“we”, “us”, “our”, the “Service”), collects, uses, stores, discloses, and protects personal information and uploaded content. By using the Service, you acknowledge this Privacy Policy.

1. Important beta privacy notice The Service is currently a private beta. Do not upload sensitive personal information, health information, patient information, student information, confidential material, or third-party personal information unless you have a lawful basis and permission to do so. Do not upload copyrighted textbooks, journal articles, course packs, paid resources, publisher materials, or examination materials unless you have the legal right or permission to use them with the Service.
2. Information we collect We may collect the following information. Account information This may include: • name; • email address; • profile information provided by authentication providers such as Google; • account identifiers; • authentication method; • account settings; • login and security metadata. Uploaded material This may include: • PDFs; • text files; • images; • screenshots; • notes; • study documents; • pasted text; • sample questions; • question-format examples; • other files or content you upload or submit. Uploaded material may contain personal information if you choose to include it. You are responsible for ensuring you have the right and lawful basis to upload it. Generated and submitted content This may include: • generated questions; • answers; • explanations; • citations; • practice responses; • mock exam responses; • feedback; • ratings; • prompts; • style instructions; • question formats; • progress data; • usage history. Technical and usage data This may include: • IP address; • browser type; • device type; • operating system; • language; • referrer; • pages visited; • features used; • timestamps; • session duration; • errors; • logs; • performance metrics; • security events; • approximate location inferred from IP address. Payment information If paid services are introduced, payment information may be processed by a third-party payment provider such as Stripe. We do not store full payment card numbers. Communications If you contact us, we may collect: • your name; • email address; • support messages; • feedback; • attachments; • other information you provide.
3. How we use information We use information to: • provide, operate, maintain, and secure the Service; • authenticate users; • process uploaded materials; • extract text from uploads; • chunk and index study materials; • create embeddings; • retrieve relevant content; • generate questions, answers, explanations, feedback, and mock exams; • store generated questions and study progress in your account; • display citations and study results; • monitor reliability, usage, errors, abuse, and security; • debug and improve the Service; • communicate with you about the Service; • respond to support requests; • enforce our Terms; • detect and prevent fraud, abuse, security incidents, and unlawful activity; • comply with legal obligations; • create aggregated or de-identified operational statistics.
4. No sale of personal information We do not sell your personal information.
5. No cross-user sharing during private beta During the private beta, we do not intentionally share your private uploaded materials with other users. During the private beta, we do not intentionally serve questions generated from your private uploads to other users. We may use aggregated or de-identified operational statistics that do not identify you and do not reveal the content of your private uploads.
6. AI processing The Service may send uploaded material, extracted text, prompts, retrieved passages, answers, and related content to third-party AI providers to provide features such as embeddings, question generation, verification, feedback, and grading. Where we use the OpenAI API, OpenAI’s platform documentation states that API data is not used to train or improve OpenAI models by default unless the customer explicitly opts in. We do not use your uploaded materials to train or fine-tune AI models unless we obtain separate express consent from you or have another lawful basis and provide appropriate notice.
7. Legal bases for UK/EU users If you are located in the UK or European Economic Area, we process personal data under one or more of the following legal bases: • Performance of a contract: to provide the Service you requested. • Legitimate interests: to operate, secure, debug, improve, and protect the Service, provided those interests are not overridden by your rights. • Consent: where we ask for specific consent, such as for optional analytics or marketing. • Legal obligation: where processing is necessary to comply with law. You may withdraw consent where processing is based on consent.
8. Sharing and disclosure We may disclose information to the following categories of recipients. Service providers We may share information with providers that help us operate the Service, including providers for: • hosting; • database infrastructure; • file storage; • authentication; • AI processing; • email delivery; • analytics; • logging; • security; • payment processing; • customer support. These providers are authorised to process information only as needed to provide services to us, subject to their contracts and policies. Legal, safety, and rights protection We may disclose information where we believe it is reasonably necessary to: • comply with law; • respond to lawful requests, court orders, subpoenas, or regulatory requests; • enforce our Terms; • investigate abuse or security incidents; • protect our rights, users, third parties, or the public; • respond to copyright complaints, takedown notices, or other rights-holder claims. Business transfers If we are involved in a merger, acquisition, financing, restructure, sale of assets, or transfer of the Service, information may be transferred as part of that transaction, subject to appropriate confidentiality protections where applicable. With your consent We may disclose information with your consent or at your direction.
9. International transfers We may store and process information in countries other than the country where you live, including Australia, the United States, and other locations where our service providers operate. Where required, we take reasonable steps to ensure appropriate safeguards for overseas transfers. For Australian users, the Australian Privacy Principles include requirements about overseas disclosure, and OAIC guidance explains that an APP entity may remain accountable in certain circumstances for overseas recipients’ handling of personal information.
10. Retention We retain personal information and uploaded material for as long as reasonably necessary to: • provide the Service; • maintain your account; • store your uploaded materials and generated study outputs; • comply with legal obligations; • resolve disputes; • enforce agreements; • prevent fraud or abuse; • maintain security; • keep backups; • improve the Service using aggregated or de-identified information. You may request deletion by contacting privacy@sulcai.com. Backups may persist for a limited period after deletion. Aggregated or de-identified information may be retained indefinitely.
11. Security We use commercially reasonable technical and organisational measures to protect information, including access controls, encrypted transport, private storage where configured, logging, and security monitoring. No system is completely secure. We cannot guarantee absolute security. You are responsible for keeping your account, email account, and authentication method secure.
12. Your privacy rights Depending on where you live, you may have rights to: • access personal information we hold about you; • correct inaccurate information; • request deletion; • restrict or object to certain processing; • withdraw consent where processing is based on consent; • request portability; • complain to a data protection authority. To exercise rights, contact: privacy@sulcai.com We may need to verify your identity before responding.
13. Australian users This Privacy Policy is intended to be consistent with the Australian Privacy Principles under the Privacy Act 1988 (Cth). OAIC guidance explains that APP 5 requires reasonable steps to notify individuals about collection matters at or before collection where practicable, or as soon as practicable afterwards. If you have a complaint about our handling of personal information, please contact us first at privacy@sulcai.com. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.
14. UK/EU users If you are located in the UK or EEA, you may have additional rights under applicable data protection law. You may contact us at privacy@sulcai.com. You may also lodge a complaint with your local supervisory authority.
15. Children The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information, contact us at privacy@sulcai.com and we will take reasonable steps to delete it.
16. Cookies and analytics We use cookies and similar technologies as described in our Cookie Notice. Where required, we will seek consent before using non-essential cookies or analytics technologies.
17. Changes to this Privacy Policy We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you, such as by email, in-product notice, or updating the effective date.
18. Contact Questions about this Privacy Policy can be sent to: sulcaisupport@gmail.com
19. We currently use or may use providers such as Vercel, Neon/Postgres, Vercel Blob, Google, OpenAI, Stripe if payments are enabled, and analytics/logging providers if enabled.