Privacy policy

The short version

• Studim.ai listens to a lecture through your microphone, transcribes it live, translates it and creates study cards, summaries, glossaries and quiz questions.
• Your data is stored on servers in the EU (database and audio storage in Paris, the web app's server functions in Frankfurt, transcription gateway in Amsterdam).
• Speech recognition runs through Deepgram's EU endpoint; every request switches Deepgram's data retention off.
• Translation, reader cards, answers and study tools run through Google's Gemini API. If Gemini does not answer during a lecture, NVIDIA's API takes over translation, reader cards, transcript correction and answers as a fallback. During the current development phase we use unpaid API tiers at both providers, under which the providers may use the inputs to improve their services; there is no commitment that the processing stays inside the EU. This changes before the commercial launch (section 10). So do not use the audio recording or the AI tools for content you must keep confidential.
• We store an audio recording of a lecture only when you confirm it explicitly for that lecture.
• No cookies before login. After login only the session cookie. We count page views without cookies and without an identifier in your browser (Vercel Web Analytics). No third-party advertising, no ad network.
• You can export all your data as a zip and delete your account yourself in Settings at any time.

1. Controller

Email: hello@studim.ai. Account and billing questions: support@studim.ai [CONFIRM SUPPORT MAILBOX IS LIVE]. Further details are in the legal notice.

No data protection officer has been appointed. [LAWYER: Check the duty to appoint one under Art. 37 GDPR and § 38 BDSG; a sole trader without employees usually has none.]

2. Scope and hosting

This policy covers the website www.studim.ai, the web app under /dashboard and the transcription connection that belongs to it. The web app is served by Vercel; its server functions run in Frankfurt. Database, authentication and the private audio storage are hosted by Supabase in the AWS eu-west-3 data center (Paris). The transcription gateway that forwards your microphone signal to the speech recognition service runs on Railway in the EU West region (Amsterdam).

3. Which data we process

• Account data: Google account id, email address, name and profile picture URL from your Google account.
• Settings: display name, school, nicknames, languages, your corrections list, the plan you are on, the time you accepted the transcript notice and the auto-pause setting.
• Courses: course name and the lectures assigned to it.
• Lectures: transcript, translation, summary, glossary, quiz, key moments, date, duration, language and the consent flags (whether and when you agreed to audio recording, with the text version and the interface language).
• Audio recordings: only with your consent per lecture (see section 4.5).
• Usage data: transcribed seconds per month for the plan limits, plus older daily usage rows (date and counters) from the first version, no longer written since October 2026 and kept until the account is deleted.
• Feedback: rating, school, country and your message from the feedback form.
• Coupons: which coupon codes you redeemed.
• Support: your emails to us and our replies.
• Payment data: held by Lemon Squeezy, not by us (see section 4.8).
• Technical logs: request metadata such as time, route, response code and a shortened error message. In production, logs never contain transcript or audio content.

4. Purposes and legal bases per feature

The legal bases refer to Art. 6 (1) GDPR: point (a) consent, (b) contract, (c) legal obligation, (f) legitimate interest.

4.1 Account and sign-in

Sign-in works only through Google Sign-In. Google sends us your account id, email address, name and profile picture URL. We use them to create your account and settings. Legal basis: Art. 6 (1) (b) GDPR (contract). What Google itself processes during sign-in is described in Google's privacy policy.

4.2 Live transcription

During a lecture your browser captures the microphone signal, turns it into small audio chunks and sends them over an encrypted WebSocket connection to our transcription gateway. The gateway forwards the audio stream to Deepgram's speech recognition and returns the recognized text to your browser. We use the EU endpoint api.eu.deepgram.com and send with every request the setting that Deepgram keeps neither audio nor text after the response (opt-out from the Model Improvement Program). The transcript is stored in your account when you save the lecture. Legal basis: Art. 6 (1) (b) GDPR.

4.3 Live translation and reader cards

The recognized text is sent to Google's Gemini API to translate it into your language and to detect important moments: questions from the lecturer with suggested answers, exam hints, assignments and important call-outs (the "reader cards"). For this we send the relevant text passages, your target language and, where present, the name of the course. When you ask the assistant a question, the request also carries your display name and school, if you entered them in Settings. Your corrections list is applied in your browser, and nicknames never reach a request to the model. If the Gemini API does not answer (for example during an outage or when a quota is exhausted), we send the same text passage to NVIDIA's API (NVIDIA Corporation, USA) as a fallback; this covers only the live translation, the reader cards, the transcript correction and the answers, never the Library study tools. During the current development phase we use unpaid API tiers at both providers; what that means is explained in section 10. Legal basis: Art. 6 (1) (b) GDPR. Details about Google, NVIDIA and the status of the agreements are in sections 5, 6 and 10.

4.4 Library and study tools

Saved lectures live in your Library. On your click, the Gemini API creates a summary, a bilingual glossary and a practice quiz from them; the key moments come from the live lecture and are saved with it. The export of each lecture as a .txt file is built in your browser; no request is sent to our servers or to any provider for it. Legal basis: Art. 6 (1) (b) GDPR.

4.5 Audio recording with consent

On the Professor and Dean plans you can additionally save the lecture as an audio file to replay it in the Library. This happens only if you tick the checkbox before the lecture starts: "I confirm I have permission from the lecturer and my institution to record this lecture's audio". With the lecture we store that and when you agreed, which text version of the notice you saw and in which language. The audio file sits in a private storage area that only your account can access; playback links are valid for one hour. Legal basis: Art. 6 (1) (a) GDPR (consent). You withdraw consent by deleting the lecture or your account; the audio file is then deleted. Processing before the withdrawal remains lawful. Whether you may record other people in the room depends on the law and the rules of your institution; that responsibility is yours (see terms, § 8).

4.6 Library search

The full-text search looks through title, course, date and text of your own lectures in our database. The search term travels in the request body, not in the address bar, so it does not appear in logs. Legal basis: Art. 6 (1) (b) GDPR.

4.7 Usage limits

For the monthly hour limits of the plans we count the transcribed seconds per month. Legal basis: Art. 6 (1) (b) GDPR.

4.8 Payments and subscriptions

You buy paid plans through Lemon Squeezy. The contracting party for the purchase (merchant of record) is Sold through Link, LLC (formerly Lemon Squeezy LLC), Utah, USA. Lemon Squeezy collects and processes your payment data (payment method, billing address, tax country) as its own controller. From Lemon Squeezy we receive only what we need to activate your plan: your Lemon Squeezy customer id, the subscription id, the variant you bought (monthly or yearly), the plan, its status, the renewal or end date, and your email address to match it with your account. Consent record: before we send you to the payment page, you confirm on our order page that the service should start immediately (see the withdrawal information). For that we store per order your account id, the plan, the term, the version and language of the notice text, its wording, the time and the browser identifier (user agent) of your device. Cancellation requests: if you cancel through the page Cancel contracts here without signing in, we store your email address, the plan you name, your message, the time and a reference number so we can match the cancellation to your subscription and confirm it. Legal bases: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR for the record-keeping duties (§ 312k and § 356 of the German Civil Code, tax duties at Lemon Squeezy). More in Lemon Squeezy's privacy policy. Note: payments are not switched on yet; this section describes the prepared flow. [CONFIRM WHEN G3 PAYMENTS GO LIVE]

4.9 Support and feedback

When you write to us we process your email address and the content of your message to answer the request. The mailboxes hello@studim.ai and support@studim.ai [CONFIRM SUPPORT MAILBOX IS LIVE] are hosted by Zoho in its EU data center. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in handling requests), for contract questions Art. 6 (1) (b) GDPR. The feedback form in the dashboard stores rating, school, country and message with your account; the legal basis is Art. 6 (1) (f) GDPR (legitimate interest in improving the service). Feedback is deleted with your account.

4.10 Coupons

When you redeem a coupon code we store which code your account redeemed, so a code cannot be used more than once. Legal basis: Art. 6 (1) (b) GDPR.

4.11 Security and technical logs

Our hosting providers log requests with time, route, response code and IP address to detect attacks, fix errors and keep the service running. Retention periods are in section 7. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure operation).

4.12 Export and deletion

In Settings you can download all your data as a zip file and delete your account yourself. These functions implement your rights under Art. 15, 17 and 20 GDPR. Legal basis for the processing involved: Art. 6 (1) (b) and (c) GDPR.

4.13 Audience measurement without cookies

We count page views on the website and in the web app with Vercel Web Analytics, a service of our hosting provider Vercel (section 5). The script is served from our own address, sets no cookie, writes nothing to local storage and places no identifier in your browser; so no consent under § 25 TDDDG is required for it. On every page view it sends to Vercel, and to Vercel only: the path of the page, the referring page (referrer), browser, operating system, device type and any campaign parameters in the address. Vercel derives the country from the IP address, states that it does not store the IP address, and builds on its server a hash from the IP address and the browser signature to tell returning visitors from new ones, which is discarded after 24 hours. Lecture content, your account id and search terms are not sent; the statistics are aggregated, and the retention is in section 7. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in knowing which pages are visited and where visitors come from, to improve the website). If you do not want to be counted, block the address /_vercel/insights/ with a content blocker or in your browser; the service keeps working unchanged. What we re-check whenever the script changes is in the cookie statement.

5. Recipients and processors

We use the following providers. Data processing agreements under Art. 28 GDPR with the processors exist or are requested; the status per provider is in the last column of the table (the status column of our contract checklist). Lemon Squeezy and Google Sign-In act as their own controllers.

No longer used: the unofficial Google Translate endpoint was removed from every production path on 8 October 2026. NVIDIA's API was removed on the same day and re-added on 14 October 2026 only as a fallback for Gemini (see the table); it is removed again before the commercial launch. No advertising network, tag manager or analytics service with cookies is embedded; Vercel's cookieless audience measurement is described in section 4.13.

6. Transfers to third countries

Vercel, Railway, Deepgram, NVIDIA and Lemon Squeezy are companies based in the USA; Supabase is based in Singapore. As described above, your data is processed in data centers in the EU. Access from the third country, for example for support or maintenance, and the payment processing at Lemon Squeezy are covered by EU standard contractual clauses (Art. 46 (2) (c) GDPR) where section 5 marks a contract as concluded; the contracts with Deepgram and Railway are requested. [CONFIRM AFTER DEEPGRAM AND RAILWAY DPA ARE SIGNED] [LAWYER: For each US provider check whether it is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); if so, name the certification here. Status at the time of this draft: [DPF STATUS VERCEL], [DPF STATUS RAILWAY], [DPF STATUS DEEPGRAM], [DPF STATUS LEMON SQUEEZY].] For the Gemini API our contracting party is Google Cloud EMEA Limited in Ireland; Google makes no data-location commitment for the Gemini Developer API, so processing outside the EU is possible. Today we use the free tier, for which Google's data processing addendum does not apply yet. [CONFIRM AFTER PAID TIER IS LIVE: With the paid tier the transfer is covered by Google's data processing addendum with standard contractual clauses.] [LAWYER: Check the transfer safeguard under Art. 46 GDPR for the free tier of the Gemini API; until the paid tier is live this draft names none.] NVIDIA's API (NVIDIA Corporation, USA) processes the text passages sent as a fallback in the USA. During the current development phase there is no data processing agreement and there are no standard contractual clauses for it; this transfer ends before the commercial launch. [LAWYER: Check the transfer safeguard under Art. 46 GDPR for the NVIDIA API during the development phase; this draft names none.]

7. Retention

• Lectures (transcript, translation, study tools) and audio files: until you delete the lecture or your account.
• Playback links for audio files: valid for 1 hour, after that a new link is created.
• Account and settings: until you delete your account.
• Usage rows (monthly and daily): until account deletion.
• Feedback and coupon redemptions: until account deletion.
• Logs at Supabase: 1 day (Free) to 7 days (Pro). Vercel: about 1 hour. Railway: 7 days.
• Audience measurement at Vercel: aggregated statistics without IP address; the hash used to recognise returning visitors is discarded after 24 hours; retention of the statistics per plan: [CONFIRM ANALYTICS RETENTION IN VERCEL DASHBOARD].
• Deepgram: no retention after the response.
• Gemini API: free tier during the development phase, for which Google states no retention period and may use the inputs to improve its products. [CONFIRM AFTER PAID TIER IS LIVE: paid tier: up to 55 days for abuse monitoring.]
• NVIDIA API (fallback requests only, development phase): unpaid tier, for which NVIDIA states no retention period and may use the inputs to improve its services.
• Support mailbox: until the request is closed, plus [RETENTION PLACEHOLDER].
• Payment and invoice data at Lemon Squeezy: per the tax retention periods that apply there.
• Subscription data and consent records for orders with us: until account deletion.
• Cancellation requests from the cancellation page: until the cancellation is handled, plus [RETENTION PLACEHOLDER]; the link to the account is removed with account deletion.
• After account deletion your data is removed immediately from the database and the audio storage. Database backups: [BACKUP RETENTION PLACEHOLDER].

8. Your rights

Under the GDPR you have the following rights towards us:

• access (Art. 15) to the data stored about you,
• rectification (Art. 16) of inaccurate data,
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection (Art. 21) to processing based on Art. 6 (1) (f) GDPR,
• withdrawal of consent (Art. 7 (3)) with effect for the future,
• complaint to a supervisory authority (Art. 77). The authority responsible for us is [COMPETENT AUTHORITY PLACEHOLDER]. You can also contact the authority at your place of residence.

Access and portability: in Settings under "Download my data" you get a zip file with all data in JSON format, the lectures as text files and your audio files. Erasure: in Settings under "Delete my account" your account, settings, courses, lectures, audio files, usage rows, feedback and coupon redemptions are deleted immediately. For anything else write to hello@studim.ai.

9. Cookies and local storage

We set no cookies before login. After login your browser stores only Supabase's session cookie, which is strictly necessary for staying signed in, plus three settings (theme, interface language and the language chosen on the legal pages) in local storage. We count page views with Vercel Web Analytics without cookies and without an identifier in your browser (section 4.13); there are no advertising cookies or tag managers; we serve the fonts ourselves. Details are in the cookie statement.

10. Notes on processing by AI models

Translations, reader cards, suggested answers, summaries, glossaries and quiz questions are generated by language models through Google's Gemini API; if Gemini does not answer during a lecture, NVIDIA's API takes over the translation, the reader cards, the transcript correction and the answers as a fallback. The models receive the text of the lecture, never the audio file. The results can contain mistakes and do not replace the lecture. We make no automated decisions within the meaning of Art. 22 GDPR and build no profiles. Development phase: Studim.ai has not launched commercially yet. During this phase we use unpaid API tiers at Google and at NVIDIA. Under the terms of these tiers the providers may use the inputs and outputs to improve their services and models; at Google human reviewers may read them; neither provider commits to processing inside the EU. We therefore cannot promise during this phase that your lecture content is not used to train AI models. Do not use the audio recording or the AI tools during this phase for content you must keep confidential. Before the commercial launch we switch the Gemini API to the paid tier, remove NVIDIA from the service and update this policy. [CONFIRM AFTER PAID TIER IS LIVE: For the paid tier of the Gemini API, Google's terms state that Google does not use the prompts to train its models and keeps them for up to 55 days for abuse monitoring; Google then acts as a processor under Art. 28 GDPR on the basis of its data processing addendum.] Whether lecture content contains special categories of personal data (Art. 9 GDPR) depends on the subject; we do not analyze the content for such attributes. [LAWYER: Check the wording on Art. 9 for lectures in, for example, medicine, religion or politics.]

11. Data security

• All connections are encrypted with TLS (website, API, WebSocket, database).
• Every database table is protected with Row Level Security: your account sees only its own rows. The plan cannot be changed from the browser.
• The audio storage is private; playback links are signed and valid for one hour.
• Keys with full access are used only on the server, never in the browser.
• In production our logs contain no transcript or audio content.
• Coupon redemption runs through a database function, so codes cannot be read out.

12. Minors

Studim.ai is intended for people aged 16 or older. Paid plans are for adults, or with a guardian's consent. If we learn that an account was created by a younger person, we delete it. [LAWYER: Check the age limit under Art. 8 GDPR and § 110 BGB; the app does not ask for the age at sign-up today.]

13. Changes to this policy

We update this policy when the service or the legal situation changes. The current version is always at www.studim.ai/legal/datenschutz. For major changes we inform you in the dashboard or by email.

Last updated: 14 October 2026