Privacy policy

Last updated: 9 August 2026

This policy explains what Mentaiq AI (“Mentaiq”, “we”) collects when you use the service, why we collect it, who else processes it, and the control you have over it. We've written it to be read, not to be impenetrable.

1. Who we are

Mentaiq AI is an AI study workspace that turns documents, notes, and videos into study material. It is operated by DarkMode Studios, established in Sweden, which is the data controller for the personal data described below.

Data protection contact: privacy@mentaiq.app

Because we are established in the EU, the GDPR applies to our processing of your personal data wherever in the world you use the service.

2. What we collect

Account data — your name, email address, and authentication identifiers. If you sign in with Google or Apple, we receive your email and basic profile from them; we never receive your password.
Study material you provide — documents you upload, text you paste, and links you submit, plus the flashcards, quizzes, notes, and summaries generated from them.
Study activity — which cards you review, how you grade them, quiz and exam results, and derived progress such as mastery per topic.
Tutor conversations — the messages you exchange with the AI Tutor.
Billing data — subscription status, plan, and billing period. Payments are processed by Stripe; we never see or store your full card number.
Technical data — IP address, browser type, and request timestamps, used for security, abuse prevention, and diagnosing faults.

3. Why we use it, and our lawful basis

To provide the service (performance of a contract) — processing your uploads into study material, tracking your progress, answering your tutor questions.
To take payment (performance of a contract) — managing subscriptions and access.
To keep the service secure (legitimate interests) — rate limiting, CAPTCHA, fraud and abuse prevention.
To fix and improve the product (legitimate interests) — diagnosing errors and understanding which features are used.
To contact you about your account (contract and legitimate interests) — sign-in links, receipts, and service notices.

We do not sell your personal data, and we do not use your study material to serve advertising.

4. AI processing of your material

To generate study material and power the AI Tutor, the content you upload or paste is sent to Anthropic's API for processing. It is used to produce your results and returned to you. Your material is not used to train models. Anthropic acts as our processor under a data processing agreement.

AI output can be imperfect. Study material is generated from your source document, but you should verify anything critical against the original before relying on it in an exam.

5. Who else processes your data

Anthropic — AI processing of uploaded material and tutor conversations.
Supabase — authentication and database hosting.
Stripe — subscription payments. Stripe is the controller of your payment card data under its own privacy policy.
Cloudflare — Turnstile, the bot check on our sign-in and sign-up forms.
Vercel — application hosting and delivery.

Each processes data only as needed to deliver their part of the service, under contract. Some are located outside the UK/EEA; where that is the case, transfers are covered by Standard Contractual Clauses or an equivalent safeguard.

6. Cookies and local storage

We use strictly necessary cookies only: a session cookie that keeps you signed in, and a security cookie set by Cloudflare Turnstile. We do not use advertising or third-party tracking cookies, so there is no consent banner to click through.

Your study sets are also cached in your browser's local storage so they load instantly. Clearing your browser data removes that cache.

7. How long we keep it

Account and study data — for as long as your account exists.
Deleted study sets — removed immediately, including the material generated from them.
Deleted accounts — account data and study material are deleted; any active subscription is cancelled at the same time.
Billing records — retained by Stripe as long as required by tax and accounting law.
Security logs — kept for a short period, then discarded.

8. Your rights

Depending on where you live, you have rights to access, correct, delete, export, restrict, or object to our processing of your personal data, and to withdraw consent where processing relies on it.

You can edit your name and delete your account and all its data directly in Settings → Profile. For anything else, email privacy@mentaiq.app and we'll respond within one month, as the GDPR requires.

If you are unhappy with our response you can complain to a supervisory authority. Ours is the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (imy.se). You may also complain to the authority in your own country of residence or place of work.

9. Security

Traffic is encrypted in transit. Passwords are hashed by our authentication provider and never stored in readable form. Access to paid features and personal data is enforced on the server, and database rows are protected by row-level security so one account cannot read another's. Sign-in forms are protected by CAPTCHA and rate limits. No system is perfectly secure, but we take this seriously.

10. Children

Mentaiq is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will remove it.

11. Changes

If we make a material change to this policy, we will update the date above and notify you by email or in the app before it takes effect.