Summary
This policy applies to:
- Visitors to our website
- Customers
- Users of our products and services
The purpose of this Privacy Policy is to let you know how we collect, use, store, share, retain, transfer and process your Personal Information. This policy also describes your choices and rights with respect to your Personal Information and how to exercise those rights. "Personal Information" is any information relating to an identified or identifiable individual.
We may amend this Privacy Policy from time to time. We encourage you to review this policy periodically, as changes will be posted on this page. If we make any material changes to this policy we will provide a prominent notice to users by email. By continuing to use the Service after the revised Privacy Policy has become effective, you acknowledge that you accept and agree to the current version of the Privacy Policy.
What Personal Information We Collect
We collect various types of information depending on how you interact with us and what products or services you use.
Personal Information you provide to us
If you fill out a form on our website that requires contact information such as signing up for a newsletter, submitting a request for information or products and services we will collect and process that information to provide you with the communication, products or services. These types of Personal Information may include your name, email address, company name, job title, your physical address, payment and billing information.
Personal Information collected when you visit our website
When you use our website, we automatically collect certain Personal Information from your device. This includes your IP address and user-agent information, which your web browser automatically sends. User-agent information typically includes details like your device's brand, type, and version, as well as your operating system and browser type and version. Collecting this data helps us understand which devices and platforms are used to access StudyStash, so we can ensure continued support for them.
We also collect information using cookies and similar technologies. You can find more details in our Cookie Policy at https://studystash.com/cookies.
Personal Information collected when you use our products or services
When you use our products and services, we collect other types of Personal Information. The categories of personal data transferred relates to the use of StudyStash and may differ depending on the user's use of our Services. Typically, though, this will involve:
- First and last name
- Profile avatar (optional)
- User unique identifier & hashed password
- Email address
- Phone Number (if enabled for 2-Factor Authentication)
- Uploaded content (including text, images, documents, files, links from the web, diagrams)
- Formative assessment results
- University/college Name and Role (e.g. Student/Professor)
- Enrollment status (user's association with a specific course/module)
- Site usage, metadata including device info. used to access the service
- IP Address
- Locale
Information About Your Accounts on Third-Party Services
StudyStash provides the ability to log in to the Service using single-sign-on (e.g. SAML/OIDC) or your Microsoft account. If you authenticate yourself using any of these services, you grant us access to your email address, and, if available, your name, photo, and username associated with them. We do not receive your password.
Information Posted on StudyStash (User content)
The creator of a study resource can choose its privacy - private or "anyone with the link":
- Private: Only registered StudySash users invited to the resource can view content.
- Anyone with the link: People who have the link to the StudyStash within the same company/organisation can view content.
We may also collect usage data regarding your use of our products and services and this data may contain Personal Information.
Unless otherwise noted in this policy, we act as the "controller" of personal data that we collect and process.
The Legal Basis For Collecting and Processing Information
Our legal bases for controlling or processing personal data are:
- Article 6.1(a) GDPR (Consent): You provide informed consent to us or have a reasonable expectation that we will use your information in a certain way – for example, to engage in our community discussions, or to hear about new services or offers. You have the right to withdraw your consent at any time either by selecting 'delete my data' within the specific service or by request to [email protected];
- Article 6.1(b) GDPR (Contract): Providing our services and fulfilling our obligations to you, usually relating to a terms of service or partnership agreement;
- Article 6.1(c) GDPR (Legal Obligation): The necessity to meet compliance with our legal obligations; and/or
- Article 6.1(f) GDPR (Legitimate Interest): Where it is in our legitimate interests to do so. We only rely on 'legitimate interests' as the legal basis for processing by us, or third parties we use, for these purposes:
- business development; or
- providing login systems to users via their existing social media accounts.
Where we rely on a specific basis for processing your information and you wish to object to that processing, you must be aware that it might not be possible for you to continue using our services.
The special categories of personal data (Article 9 of GDPR) we process are:
- biometric data in the form of facial images, where you have uploaded and we store your profile picture;
- any special categories of special personal data which any user volunteers while using our services (for example in a forum or submission).
If we need to pass on special category personal data (see Article 9 of GDPR) to a third party, we will only do that in accordance with the legal bases under Article 6 of GDPR as outlined above. This data is processed only in accordance with the legal grounds outlined in GDPR Article 9.
If you would like more details please request our Register of GDPR Information.
How We Share Information
StudyStash does not sell or rent your personal information to any third party for any purpose, including marketing, advertising or profiling. StudyStash does not display any traditional, contextual or personalised advertisements. We share information we collect from you under the limited circumstances set forth below:
Information Shared With Other StudyStash Users Through the Service
When you collaborate with other people by sharing study resources, they can see your profile photo, name, and email address.
Information Shared With Service Providers in Order to Operate the Services
We share Personal Information with our affiliates and partners, as needed to provide our services. We share Personal Information with service providers such as accountants, payment processing companies, and other vendors we use to operate our website and provide our products and services.
Our vendors and service providers are not permitted to use your personal information for any other purpose than to provide contracted services. Vendors are not permitted to use your personal information for their own marketing, and are not allowed to share your information for marketing purposes.
Information shared with Third Parties
We may share aggregated information (information about our users that we combine together so that it no longer identifies or references an individual user) and other de-identified or non-personally identifiable information, with partners, press, or other third-parties in order to, for example, demonstrate how StudyStash is used, spot industry trends, or to provide marketing materials for StudyStash. Any aggregated information and non-personalized information shared this way will not contain any personal information and cannot be used by third parties to re-identify you.
Information shared with AI service providers to operate the Services
AI service providers are used to provide content generation services on StudyStash like the "StudyChat" and "AI Notes" features; as well as content moderation services to ensure that Padlet remains a safe place for all users to collaborate on.
We share only necessary information with our AI service providers and do not use your personal data to train the AI. StudyStash only works with AI partners that respect our privacy agreements and have similar log retention policies.
StudyStash does not claim ownership on any content created by you using the AI features.
Information Disclosed Pursuant to Business Transfers
We may share your personal information with affiliates such as a parent company, subsidiaries, joint venture partners or other companies that we control or that are under common control with us, in which case we will require those companies to agree to use your personal information in a way that is consistent with this Policy.
In the event that all or a portion of StudyStash or its assets are acquired by or merged with a third-party, personal information that we have collected from users would be one of the assets transferred to or acquired by that third-party. This Policy will continue to apply to your information, and any acquirer would only be able to handle your personal information as per this Policy (unless you give consent to a new policy). We will provide you with notice of an acquisition within 30 days following the completion of such a transaction, by posting on our homepage, or by emailing you on your email address on file. If you do not consent to the use of your personal information by such a successor company, you may request its deletion from the company.
In the unlikely event that StudyStash goes out of business, or files for bankruptcy, we will protect your personal information, and will not sell it to any third-party.
Information Disclosed to Fulfill Legal Obligations
We may disclose personal information if necessary to comply with the law, such as complying with a subpoena or other legal process. We may need to disclose personal information where, in good faith, we think it is necessary to protect the rights, property, or safety of StudyStash, our employees, our community, or others, or to prevent violations of our Terms of Service or other agreements. This includes, without limitation, exchanging information with other companies and organizations for fraud protection or responding to law enforcement and government requests.
Where appropriate, we may notify users about the legal requests, unless (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law; (ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud upon StudyStash, or its users. In instances where we comply with legal requests without notice for these reasons, we will attempt to notify that user about the request after the fact where appropriate and where we determine in good faith that we are no longer prevented from doing so.
How Long We Retain Your Information
StudyStash will keep information for as long as necessary to provide the Service under our Terms and Conditions and other relevant agreements between you and StudyStash. We will also retain information so as to fulfill any legal requirement to which we are subject to, e.g. trade, tax, and employment law. We will discard personal information when:
- the data subject withdraws consent to processing,
- our contractual obligations have been fully performed and cannot be performed to any further extent, or
- the personal information is obsolete.
We will also not keep any information the processing of which has been objected to, or for which a request for erasure has been made, beyond the legally required timeframe to complete such a request (usually 30 days).
Cookies and Other Tracking Technologies
Cookies are small files stored on your web browser when you visit our website. Some cookies last only as long as you remain on the website; others, called "persistent cookies" may be stored for longer periods of time. These cookies can make browsing easier by storing your password or your preferences regarding how you use the website. Cookies collect information such as the IP address of your computer, your browser settings, and information about how you use the website. Your general location may be estimated from your IP address.
When you share links to external services on StudyStash, those services may store cookies on your browser too. We have no control over the cookies they store. We recommend that you set your browser to block third-party cookies.
If you would like to opt out of cookies, you may change the settings on your web browser to reject or delete cookies. You may also find more information about cookies, including how to opt out of interest-based advertising, at www.cookiesandyou.com.
We do not use third-party cookies or similar technologies on our service for personalized advertising or to track users and display personalized advertisements on other third-party websites or services.
More information about how we use cookies may be found here: https://studystash.com/cookies.
Your Rights Regarding Access to and Control over Personal Information
You have the following rights with regard to your personal information:
- Right of information and access - You have the right to access your Personal Information we have about you and to be provided with a copy of your Personal Information.
- Right to rectification - You have the right to correct or update your inaccurate or out of date Personal Information.
- Right of erasure - You have the right to request that your Personal Information be permanently erased/deleted.
- Right to restrict processing - You have the right to restrict the processing of your Personal Information.
- Right to object to processing - You have the right to object to specific types of processing of your Personal Information.
- Right to portability - You may ask to receive a portable copy of your personal information in a format that may be transferred to another organization.
- Right not to be subject to decisions based solely on Automated Decision Making - You have the right not to be subject to decisions based solely on automated processing.
- Right to complain to a data protection authority - You have the right to complain to a supervisory authority in the country in which you reside, details of which can be provided upon request. For residents of the United Kingdom, this is the Information Commissioner's Office (ICO). The lead supervisory authority for StudyStash for its UK operations is the Information Commissioner's Office (ICO), which can be contacted at: ico.org.uk.
- Right to withdraw consent - If you have given us consent to collect or process your Personal Information, you may withdraw that consent at any time.
- The Right to Non-Discrimination - We may not discriminate against you if you exercise your privacy rights.
If you wish to exercise any of these rights please submit a request via the DSAR form.
We may charge a reasonable fee if your request is not valid under applicable law, repetitive or excessive. We may also request additional information from you in order to verify your identity before processing your request.
These rights are available to all users.
Deleting your account
You may delete your Account at any time - you can do so from clicking on your profile picture and selecting "Manage Account" when logged in to StudyStash.
When you delete your account, we delete:
- your profile information and any other content you provide in your profile (such as your name, username, password, email address, and profile photos)
- all the resources you have created, and any uploaded content
We do not delete non-identifiable aggregate information about your usage of the service.
We aim to maintain our services in a manner that protects information from accidental or malicious destruction. Because of this, even after you update or delete personal information you have provided us from our Service, your personal information may be retained in our backup files, archives, and server logs for up to 30 days, unless legal obligations require us to retain them for longer periods of time.
Information for California Residents
The California Consumer Privacy Act (CCPA) applies to information collected from California residents. Residents of California have the following rights with regard to their personal information:
- The Right to Know and Access Information
The categories of personal information we collect is described above in the section entitled "The Information We Collect". California residents may submit a verifiable request regarding the information collected, the types of sources from which personal Information is collected, the purposes for which information is collected, and the specific personal information collected about them.
- The Right to Have Personal Information Deleted
- The Right To Portability
California residents may request a copy of their personal information in a format that can be transferred to another person or entity.
- The Right to Non-Discrimination
We may not discriminate against you if you exercise your privacy rights.
You may be asked for more information in order for us to verify your identity when you make a request. You may exercise your rights by sending an email to [email protected].
We do not sell Personal Information to third parties (pursuant to California Civil Code Sections 1798.100-1798.99, also known as the California Consumer Privacy Act of 2018.
The sections above "What Personal Information We Collect" lists the categories of Personal Information we have collected in the preceding 12 months.
International Data Transfers
For personal data transfers outside of the UK and EEA, we have implemented appropriate safeguards in accordance with data protection laws, such as using Standard Contractual Clauses (SCCs) to ensure that your data is protected to the same standards as in the UK/EEA.
Security
The security of your personal information is important to us. We maintain administrative, technical and physical safeguards to protect against loss, theft, unauthorized use, disclosure, or retrieval of personal information. You can check out our Trust Center for more details.
If we learn of a security breach, we will attempt to notify you electronically (subject to any applicable laws) so that you can take appropriate protective steps; for example, we may post a notice on our Site or elsewhere on the Service, and email to your email address on file. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.
Children's Privacy
We do not knowingly collect or solicit personal information from children under age 13 without parental consent, unless permitted by law. If we become aware that we have collected personal information from children under the age of 13 without parental consent (or as permitted by law), we will delete it. If you believe that a child may have provided us with personal information without such parental consent, please contact us.
California consumers: We will not sell the information of California consumers who are 16 years old or younger unless we have prior parental authorization. If a California consumer is under the age of 13, a parent or guardian must consent to the sale of such minor's personal information. If the California consumer is between the ages of 13 and 16 years old, the minor may consent on an opt-in basis to the sale of their personal information. Our sites directed toward children will ask for age verification and will require appropriate consent.
EU residents: We do not collect or process personal information of data subjects in the EU under the age of 16 without explicit consent from a parent or guardian. Our sites directed toward children will ask for age verification and will require appropriate consent.
Sensitive Information
Unless specifically requested, we ask that you not send us, and you not disclose on or through our websites or otherwise to us sensitive personal Information unless specifically requested by us or required by law.
Contact Us
If you have any questions about this privacy policy, or if you want to exercise your privacy rights as outlined above, please contact us by email at [email protected] or write to us at:
StudyStash Inc., 1111B S Governors Ave STE 37383, Dover, DE 19904, USA
StudyStash Limited, Spaces Castle Park, The Pithay Programme, Bristol BS1 2NB