Privacy Policy

When you use Nexelia, we collect the following information:

• Account information: your name, email address, and password (hashed).
• Age and country: your date of birth and country of residence, collected at signup so we can apply the right minimum age. See section 7.
• Parental consent records: if you are below the age of consent where you live, your parent or guardian’s email address, the date they agreed, and the IP address and browser they used. We keep this as evidence that consent was given.
• Study progress: which questions you answer, flashcard reviews, exam attempts, and accuracy data.
• Your written answers: everything you type into exam questions, essays and the AI tutor.
• Photographs you upload: pictures of handwritten work, for marking. These are deleted after 30 days.
• Preferences: exam board, subjects of interest, daily study goals, and exam dates.
• Usage data: pages visited, features used, and device/browser type. See section 6 for which of this is optional.
• Payment information: processed securely by Stripe. We do not store your card details.

• Teaching and marking: to mark your answers, generate explanations, and adapt what you are shown to what you find difficult.
• Personalisation: to generate study plans, track your progress, and recommend content.
• Age assurance: to decide whether you can use the service directly or need a parent’s agreement first.
• Service improvement: to understand how the platform is used and improve it.
• Communications: assignment reminders, weekly digests, and account notifications. You can opt out of non-essential emails.
• Security and reliability: to detect abuse and to record technical errors so we can fix them.

Your data is stored in the European Union — our database, login system and file storage run on Supabase in Ireland (eu-west-1), and our error monitoring runs in Sentry’s EU region.

However, the application itself runs on servers in the United States. Our hosting provider, Vercel, executes our code in Washington DC, so information you send us — including your written answers — passes through the United States on its way to the European database. Several of the services in section 4, including the AI providers, also process data outside the EU.

All data is encrypted in transit (TLS) and at rest in our database. We keep your data for as long as your account is open. What governs how long each kind of thing lives is set out in section 5.

We use the following services to operate Nexelia. Those that receive things you have written are marked, because that is the part most worth knowing.

• Supabase (EU, Ireland): database, authentication, and file storage.
• Vercel (United States): website hosting and the servers that run our code.
• Google Gemini — receives your written work. Marks your answers and powers the tutor. Photographs of handwritten work are sent to Google for marking.
• Groq (United States) — receives your written work. Generates tutor replies and hints.
• Anthropic (United States) — receives your written work. Generates explanations and interactive widgets.
• Google Cloud Text-to-Speech: turns chapter text into audio. Receives our lesson content, not your work.
• Upstash: temporary caching and rate limiting.
• Sentry (EU): records technical errors so we can fix them. It receives the page address, your user ID and the error itself.
• Stripe: payment processing. Receives your email address and what you bought.
• Resend (United States): sends our emails. Receives the recipient address and the message.
• Google Analytics: website analytics on our public pages, only if you accept cookies. See section 6.

We would rather tell you what governs how long something lives than give you a list of numbers. A number goes out of date the moment it changes; a reason stays true and lets you check us against it.

⚠ For most of what we hold, the clock is not a clock. Your work is kept because the product is built on it — your progress, your weak topics and your revision history are the service. So the thing that ends retention is normally you deleting your account, not a timer expiring.

⚠ Being honest about the shape of this: apart from photographs and your cookie choice, we do not run timers that delete things. Your data lives until you delete your account, and then it goes immediately. If you would rather it did not sit there indefinitely, the control is in your hands and it is in section 7.

These get confused, and the difference matters, so here is each one plainly.

⚠ The one people get wrong: withdrawing parental consent closes the account, it does not erase the data. If a parent withdraws consent, the student can no longer sign in — and because they can no longer sign in, they can no longer run the deletion themselves. If you want both, delete the account first, then there is nothing left to withdraw. If consent has already been withdrawn and you want the data gone too, write to us and we will do it.

You have the right to:

• Access: request a copy of the data we hold about you.
• Correction: update or correct inaccurate information via your account settings.
• Deletion: delete your account and its data at any time from Account settings → Danger zone. This happens immediately, and removes your answers, progress, tutor conversations and any photographs you uploaded.
• Portability: request your data in a machine-readable format.
• Withdraw consent: change your cookie choice at any time from the “Cookie preferences” link in the footer. A parent who gave consent can withdraw it using the link in the email they received, at any time.
• Objection: opt out of non-essential communications at any time.
• Complain: raise a concern with your national data protection authority. In Spain that is the Agencia Española de Protección de Datos — aepd.es. If you live elsewhere in the EU or the UK, you can complain to your own country’s authority instead.

If there is an active complaint or legal process

Where a complaint, claim or legal process is under way and involves you, we may need to keep some data that we would otherwise delete — to handle, defend or resolve it. If that happens we keep only what is needed for that purpose, use it for nothing else, delete the rest, and tell you what we have kept and why. This is the exception in Article 17(3)(e) GDPR.

⚠ To be straight with you: this is a commitment about how we would behave, not a description of a system that already exists. We have no automated legal-hold mechanism — if this ever applies, a person will do it by hand and write to you. We would rather say that than describe machinery we have not built.

We use cookies that are necessary to run the site — keeping you signed in, and remembering your cookie choice itself. These do not ask permission because the site cannot work without them.

Google Analytics is optional and off by default. We do not load it at all until you press Accept. It runs only on our public marketing pages — never inside the product, and never while you are signed in. If you accept, it sets two cookies that last 400 days. Google keeps the underlying event data for 2 months and user-level data for 14 months.

You can change your mind at any time using Cookie preferences in the footer. Withdrawing deletes the Google Analytics cookies as well as stopping any further collection. A full list of every cookie and stored value is in our Cookie Policy.

Data protection law sets a minimum age at which you can agree to a service like this on your own. It differs by country — commonly 16, but as low as 13 in some places. We ask for your date of birth and country of residence at signup so we can apply the right one. If your country is not on our list, we apply 18.

If you are below that age, you can still use Nexelia, but we ask for a parent or guardian’s email address and email them for their agreement first. Your account stays inactive until they confirm. They can withdraw their agreement at any time using the link in that email, which closes the account.

We keep a record of who agreed and when, because we have to be able to show that consent was given.

Most of what you write on Nexelia is yours alone — your answers, your essays, your tutor conversations. When you delete your account, those go with it.

A few places are shared with other people, and there the rules differ depending on the space:

• Question discussions and peer reviews: what you wrote is deleted along with your account.
• Community resources you shared: the resource stays, detached from you. Your name and the link to your profile are removed, and it is no longer connected to you.

Where something stays, we keep it under Article 17(3)(a) GDPR, which allows content to be retained where it is necessary for other people’s freedom of expression and information. A shared library is several people’s work, and removing one contribution can leave what others built on top of it meaningless.

⚠ This is not an automatic rule you have to accept. If something you wrote identifies you by its own content even after your name is removed, tell us and we will look at it individually. We can edit it, remove part of it, or delete it entirely. That is an open channel, not an exception you have to earn.

⚠ We have not designated a Data Protection Officer. We are not currently required to, and we would rather say so than leave you looking for one. Privacy requests go to the address below and are handled by the team directly.

For any privacy-related questions or requests, contact us at main@nexeliaacademy.com.