Privacy Notice

1. What we collect

• Account data: email address, authentication identifiers, account status, and security/session information.
• Study content: PDFs you upload and the study material created from them.
• Usage and operations data: plan usage and technical information needed to operate, secure, and troubleshoot the service, such as processing status, timestamps, error identifiers, and security events. Operational logs are designed not to contain PDF content or generated study material.
• Billing data: Paddle customer, transaction, and subscription identifiers and entitlement status. Paddle receives and processes payment-card and tax information; StudyLayer does not receive or store complete card details.

2. Why we use personal data

We use personal data to:

• create and secure accounts;
• store PDFs and produce the study guide you request;
• enforce plan limits, manage subscriptions, and provide account controls;
• prevent abuse, investigate failures, and maintain service reliability;
• respond to support, privacy, and legal requests; and
• meet accounting, tax, fraud-prevention, and other legal obligations.

Depending on where you live, our legal bases include performing our contract with you, complying with legal obligations, protecting the legitimate interests of operating a safe and reliable service, and consent where the law requires it.

3. Service providers and disclosures

We disclose personal data only as needed to provide the service to:

• Cloud infrastructure and operations providers: services supporting authentication, database hosting, private file storage, application hosting, background processing, and privacy-limited error monitoring;
• OpenAI: generation of requested summaries and explanations;
• Email and communications providers: account messages, support, and limited internal service-operation notifications;
• User-connected AI providers: when you authorize an external AI service such as Claude, the selected study content and guide data needed for that request are shared through your connection; and
• Paddle: Merchant-of-Record checkout, tax, payment, subscription, receipt, fraud-prevention, and refund services.

We may also disclose information when required by law, to protect users or the service, or in connection with a business transfer subject to appropriate safeguards. We do not sell personal data or use PDF content for advertising.

4. AI processing

Automatic guide generation sends the relevant parts of your PDF to OpenAI. If you choose to connect an external AI service, selected study content and guide data are exchanged with that service only when you authorize and use the connection. AI output may be inaccurate. Each external AI provider applies its own account terms, privacy notice, and usage controls.

5. Retention and deletion

Uploaded documents and generated material are kept while the document remains in your account. Free-plan documents are scheduled to expire after 30 days; paid-plan documents may remain until you delete them or your account. Deleting a document permanently removes that document and its associated study data from active systems. Account deletion removes owned account content and then the authentication account.

Limited billing, security, and transaction records may be retained for legal, accounting, fraud-prevention, dispute, and system-integrity purposes. Provider backups may take a limited time to cycle out under provider retention schedules.

6. International transfers

Our providers may process data in countries outside Turkey or your country of residence. Where required, we use contractual and other recognized safeguards for international data transfers. Paddle separately describes its payment-data practices in its own buyer privacy notice presented through checkout.

7. Cookies and similar technology

StudyLayer uses essential session and security cookies needed to sign you in and protect the service. Paddle may use technology needed to operate checkout and prevent payment fraud. We currently do not use advertising cookies or third-party behavioral analytics.

8. Your choices and rights

Depending on applicable law, including Turkey's KVKK and the GDPR where it applies, you may have rights to know whether data is processed, access it, correct it, request deletion, restrict or object to certain processing, receive portable data, and complain to a competent data-protection authority. You may delete individual documents or your account through StudyLayer. For other requests, contact us using the address below. We may need to verify your identity before acting.

9. Children and changes

StudyLayer is not directed to children who cannot legally consent to this processing. If you are under the applicable age, use the service only with authorization from a parent or legal guardian. Contact us if you believe a child provided personal data without valid permission.

We may update this notice as the service or law changes. We will post the new date and provide additional notice for material changes where required. See also our Terms of Service.