Privacy Policy for studypdf.net

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website studypdf.net and our iOS app. Personal data is all data with which you can be personally identified.

1.2 The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is HBW Softwares UG (haftungsbeschränkt), Sigbertstraße 5, 51427 Bergisch Gladbach, Germany, represented by its managing director Luis Henrich-Bandis, registered with the commercial register of the district court of Bonn under HRB 28238. Tel.: 01743856722, Email: [email].

1.3 Last updated: 6 August 2026.

2) Data Collection When Visiting Our Website

2.1 When using our website purely for informational purposes, we only collect the data that your browser transmits to the server (server log files), e.g., IP address (possibly anonymized), date, time, browser type, etc.

2.2 Processing is carried out on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) to ensure the operation and security of the website.

2.3 Our website uses SSL/TLS encryption, recognizable by 'https://' and the lock symbol in the browser's address bar.

3) Hosting, Storage and Infrastructure

3.1 Our website and application servers are hosted with Hetzner Online GmbH, Industriestr. 25, 91710 Gundelfingen, Germany, in a German data centre.

3.2 The documents you upload are stored as files with Cloudflare, Inc. (USA) using their R2 object storage. A data processing agreement is in place.

3.3 Our database is operated by PlanetScale, Inc. (USA) in their Frankfurt region (eu-central-1). It holds your account data, your courses, and the study materials generated for you.

3.4 To let you search your own documents, we split their text into sections and store those sections together with a numerical representation of their content with Pinecone Systems, Inc. (USA). This means Pinecone holds excerpts of your document text, not only abstract values.

3.5 Our processing queue uses Upstash, Inc. (Redis, Frankfurt region). Document and Office file conversion runs on our own servers, not with a third party.

4) AI Processing of Your Documents

4.1 This section is the most important one for most of our users, so we state it plainly: the AI does not run on your device. To read your documents, answer your questions and generate study materials, the text of your documents, images of the pages, and the messages you send in the chat are transmitted over the internet to external AI providers.

4.2 Most of these requests are routed through OpenRouter, Inc. (USA), which acts as a gateway and forwards each request to the model provider that serves it. The providers used this way are currently Google, DeepSeek, Cohere and OpenAI. Some functions of our assistant run on Microsoft Azure OpenAI Service (Microsoft Corporation). For the search function, text sections of your documents may also be sent directly to Google.

4.3 We do not use your documents, your questions or the generated materials to train our own AI models, and we do not sell them or pass them on for advertising purposes.

4.4 For every request routed through our gateway, we technically require that it is only sent to providers who do not store the transmitted content and do not use it to train their models. Requests that would require storage are rejected rather than being sent anyway. Please note that this technical setting applies to the gateway described in 4.2; for the parts running on Microsoft Azure, the contractual terms of Microsoft apply instead.

4.5 The legal basis is the performance of our contract with you (Art. 6 para. 1 lit. b GDPR), because the AI processing is the core function of the service you signed up for. If you do not want your documents to be processed this way, please do not upload them.

5) Collected Personal Data and Purposes of Processing

5.1 We store the following personal data: name, email address, the documents you upload, the study materials generated from them, your chat history with our assistant, and usage data about your learning progress.

5.2 The data is processed for the following purposes: - Storage and provision of documents and study materials for you as a user - Generating study materials and answers using AI, as described in section 4 - Showing you your learning progress and suggesting what to review - Internal analyses to improve our service - Sending service messages related to your account

5.3 Apart from the service providers named in this policy, who process data on our behalf, we do not pass your data on to third parties.

6) Account and Sign-In

6.1 You can create an account with your email address. We send you a one-time code or a login link by email.

6.2 You can alternatively sign in with Google or with Apple. If you do, the respective provider (Google Ireland Limited or Apple Inc.) receives the information that you are signing in to our service and transmits your email address and name to us.

6.3 If you connect Google Drive to import files, we access only the files you select for import.

7) Payments

7.1 Subscriptions purchased on our website are processed by Stripe, Inc. (USA). We transmit your email address and an internal user identifier to Stripe. Payment details such as your card number are entered directly with Stripe and are never visible to us.

7.2 Subscriptions purchased inside our iOS app are processed by Apple through the App Store, and managed on our side with RevenueCat, Inc. (USA). RevenueCat receives an internal user identifier and the purchase data, but not your name or email address.

8) Cookies and Tracking Tools

8.1 We use cookies to ensure the functionality of the website and to improve the user experience.

8.2 We use the following tools: - PostHog (product analytics and error reporting, hosted in the EU, delivered through our own domain) - Google Ads (conversion measurement for our advertising), only with your consent

8.3 Analytics and advertising cookies are only used with your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time.

8.4 Our iOS app is more restrained than the website: it contains no advertising or attribution SDKs, does not request your location, and does not record your screen. It only sends us product analytics such as opening the app, starting an upload, or sending a message. The content of your messages is not part of this.

9) Emails

9.1 We send emails such as login codes, password resets and service notifications. They are sent using Amazon Simple Email Service (Amazon Web Services, Inc.).

9.2 Creating an account does not subscribe you to a newsletter or any other mailing list. We only email you about your account and the service. If we ever offer a newsletter, it will require your explicit consent.

10) Data Transfer to Third Countries

10.1 Several of the providers named above are based in the USA, in particular Cloudflare, PlanetScale, Pinecone, OpenRouter, Stripe, RevenueCat, Amazon Web Services, Microsoft, Google and Apple. Data transferred to them may be processed outside the European Union.

10.2 These transfers are safeguarded by data processing agreements with the EU standard contractual clauses, and where applicable by the providers' certification under the EU-US Data Privacy Framework.

10.3 We do not guarantee that AI processing takes place exclusively within the European Union. Where a provider routes a request to a data centre outside the EU, the safeguards described in 10.2 apply.

11) Duration of Storage and Deletion

11.1 Data is stored only as long as necessary for the purposes described or as required by law.

11.2 You can delete individual documents and entire courses at any time. When you do, we delete the file, the study materials derived from it, and the corresponding search index entries.

11.3 You can delete your account at any time. This deletes your account data, your documents and the generated study materials from our database and our file storage, unless legal retention obligations apply.

12) Your Rights under the GDPR

12.1 You have the right to access, rectify, delete, restrict processing, data portability, object to processing, revoke your consent, and lodge a complaint with a data protection supervisory authority.

12.2 To exercise these rights, please contact us using the contact details in section 1.