Privacy Policy

• Your name and email address when you create an account
• Year group, school, and subject selections during onboarding
• Study activity such as notes viewed and features used
• Payment information processed securely via Stripe (we never see your full card number)

• To create and manage your account
• To personalise your dashboard and recommend relevant content
• To enforce usage limits on free and paid plans
• To process subscriptions and billing

We retain your data for as long as your account is active. If you wish to delete your account and all associated data, email contact@acemybacs.com and we will process your request within 30 days.

We use the following third-party services to operate AceMyBacs:

• Supabase — authentication and database (EU-hosted)
• Stripe — payment processing
• Anthropic — AI tutor powered by Claude
• Vercel — hosting and deployment

We do not sell your data to any third party.

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Account management, subscription processing, delivering the service you signed up for
• Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, service improvement
• Consent (Art. 6(1)(a)): Optional communications

As a user in the EU, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct any inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit how we process your data in certain circumstances
• Portability — receive your data in a machine-readable format (available via your account settings)
• Objection — object to processing based on legitimate interests
• Complaint — lodge a complaint with your national data protection authority

To exercise any of these rights, contact us at contact@acemybacs.com. We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection authority. In Luxembourg, this is the Commission Nationale pour la Protection des Données (CNPD).

Some of our service providers are based outside the EU:

• Anthropic (AI processing): United States — transfers covered by Standard Contractual Clauses
• Supabase (database): EU-hosted
• Stripe (payments): EU and US — covered by adequacy decisions and Standard Contractual Clauses
• Vercel (hosting): EU and US — covered by Standard Contractual Clauses

We retain your data for as long as your account is active. Upon account deletion, personal data is deleted within 30 days. Usage logs and anonymised analytics may be retained for up to 12 months for service improvement.

For any privacy-related questions, reach us at contact@acemybacs.com.

You may also contact your national data protection authority if you believe your data has been processed unlawfully.