Privacy Notice
Last updated: 6 October 2026
Our commitment to your data
Protecting your personal data is a top priority. We are committed to safeguarding it at every step — in transit, at rest, and in the way we work with our providers. We will never sell your personal data, never rent it to advertisers, and never share it with third parties for their own marketing. We collect only what we genuinely need to run the service, keep it only as long as necessary, and apply strict access controls so that only authorised people can ever see it.
Who we are
Brainy Bites ("we", "us") operates brainybitesapp.app and is the data controller for the personal information we process about you in connection with the service. You can reach us at Brainybites@edu-wise.app.
What we collect
This notice covers the Brainy Bites website and the Brainy Bites Android app, which opens the same service.
- Account data (required) — email address, user ID, hashed password, or your Google account identifier and email if you sign in with Google.
- Name (optional) — only if you type it into the support or contact form.
- Files and documents (optional) — text, PDFs, Word files, images and scanned or photographed pages you upload as a source, plus the quizzes, exams, explanations and illustrations we generate from them.
- Photos and camera (optional) — if you use Scan, the page photo is sent for text recognition. We do not access your photo library beyond the file you choose.
- Voice recordings (optional) — if you answer out loud, your recording is sent to be turned into text. We keep the text, not the recording.
- Answers, scores and progress — your answers, marks, feedback, exam attempts, saved question bank and study history.
- Sharing data — if you share a live exam, the invitations, guest requests and answers submitted by people you invite.
- Purchase data — your package, subscription status and invoice records. Card details are handled by Paddle and never reach us.
- Usage data — number and timing of quizzes, narrations and study requests, free trial status, plan tier, plus standard request logs (IP address, browser or device type, timestamp) for security and abuse prevention.
- Crash and error logs — technical error details used only to fix problems.
- Support messages and feedback — anything you send us through Help or Feedback.
- Connected assistants — if you connect an AI assistant (for example Claude or ChatGPT) to your account, we record that you approved the connection. The assistant can only read your own results.
Kept only on your device: guest access without an account, settings such as narrator, music volume and theme, and any music you add with "My own music". This music is mixed on your device and is never uploaded to us.
We do not collect: your location, contacts, messages, health data, or an advertising ID. We show no ads.
Why we use it
- To create and operate your account (contract).
- To deliver the service: generate quizzes, mark answers, narrate sources, track your progress and save your settings (contract).
- To process payments and manage your package (contract, legal obligation).
- To prevent fraud, abuse, temporary email sign-ups and security incidents (legitimate interests).
- To fix errors and keep the service working (legitimate interests).
- To send essential service emails (contract). Marketing emails only with your consent.
- To meet legal obligations such as tax and accounting (legal obligation).
Who we share it with
We share data only with service providers that work for us, only what each needs, and never for their own marketing.
- Hosting and database providers that run our application and store your data.
- AI model providers (through the Lovable AI Gateway, including Google and OpenAI models) that generate quizzes, mark answers, read scanned pages, split sources into parts and create illustrations. They receive the content needed for the task, not your account details, and do not use it to train their models.
- Speech services that turn your voice answers into text and read sources aloud, including ElevenLabs for premium narrators and background music.
- Paddle, our Merchant of Record, for payments, subscriptions, tax and invoicing.
- Google, if you choose to sign in with Google.
- Email delivery for verification, password reset and support messages.
- People you invite to a shared exam see that exam and, if you allow it, the answers.
- Authorities where required by law, and professional advisers (legal, accounting) when needed.
We never sell your personal data.
International transfers
We are based in South Africa and many of our providers are located outside South Africa, the UK and the EEA. Where personal data is transferred internationally we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions where applicable.
Retention & deletion
We keep account data while your account is active and for a reasonable period afterwards to deal with disputes and meet legal obligations. The table below summarises how long each category of data is kept by default. You can delete your account and all associated data at any time from the Account page, or follow the steps on our Account & Data Deletion page.
| Data | Stored until |
|---|---|
| Account (email, password, profile) | You delete the account |
| Quiz inputs (text, PDFs) & generated quizzes | You delete them or your account |
| Quiz & study usage logs | You clear them or delete the account |
| Feedback messages & replies | You delete them or your account |
| Paid subscription & invoice records | Up to 7 years (tax law) |
| Payment details | Held by Paddle, not by us |
| Email unsubscribe / suppression list | Indefinitely, to honour your unsubscribe |
| Server request logs (IP, user agent) | Short rolling window (typically 7–30 days) |
You can download a full copy of your data any time from Account → Your data → Download my data.
Your rights
Subject to local law, you have the right to access, correct, delete, restrict or object to processing, request portability, withdraw consent, and complain to your data protection authority. Contact us via the Help page to exercise any of these rights; we'll respond within one month.
Security
We protect your data with industry-standard technical and organisational measures, including TLS encryption in transit, encryption at rest on our managed database, strict role-based access controls, least-privilege service credentials, secret management, audit logging, and row-level security so that one user can never read or modify another user's data. We never sell or rent your personal data, and we do not use it to train third-party AI models. No system is perfectly secure, so we cannot guarantee absolute security — but we take every reasonable step to keep your data safe and will notify you without undue delay if a breach ever affects you.
Cookies
We use a small number of essential cookies and similar local storage to keep you signed in and remember your settings. We do not use third-party advertising cookies.
Children
Brainy Bites is meant for people aged 16 and over. Younger learners should use it only with a parent, guardian or teacher. We do not knowingly collect data from children under 13. If you believe a child has given us data, contact us and we will delete it.
Deleting your account
You can delete your account and data in the app on the Account page, or on the web at brainybitesapp.app/account-deletion, without installing the app. Deletion removes your account, uploads, quizzes, answers and progress. Only invoice records we must keep by law stay, for up to 7 years.
Changes
If we change this notice, we will update the date at the top and tell you in the app for important changes.
Contact
For privacy questions, email Brainybites@edu-wise.app or use the in-app Help page.