MySummaries

Privacy

Privacy Policy.

Effective 20 August 2026 · Version 2026-08-20

1. Scope

This Privacy Policy explains how MySummaries Pty Ltd (ABN 75 545 287 502), a company registered in Victoria, Australia ("MySummaries", "we", "us"), collects, uses, discloses and protects personal information when you use mysummaries.app, portal.mysummaries.app, the MySummaries mobile apps and the services reachable through them (the "Service"). It is written to meet the Australian Privacy Act 1988 and the Australian Privacy Principles, the EU General Data Protection Regulation and UK GDPR, and the California Consumer Privacy Act as amended by the CPRA. Where those laws give you particular rights, the sections below say so. It forms part of our Terms of Service.

For the personal information described here, MySummaries Pty Ltd is the controller (or, in California terms, the business). Our contact details are in section 13. We have not appointed a representative in the European Union or the United Kingdom; contact us directly at the address in section 13.

2. What we collect

  • Account information. Email address, the name you give us, your sign-in provider identifier (for Google sign-in), a hashed password (for email sign-in, held by our authentication provider — we never see it), and the study profile you set up: what you are studying, which examiner persona you chose, exam dates and the name you want the examiner to use.
  • Your Content. Everything you put into the Service: notes, scratchpad text, uploaded documents (PDF and Word files are converted in your browser to text and page images, and those are what we store), images, flashcards, typed exam answers, audio recordings of spoken answers and the transcripts made from them, and the outputs the Service generates from all of that — cards, papers, marks, lectures, examiner transcripts and feedback.
  • Acceptance records. When you accept the Terms and this Policy we record the versions accepted, the time, your IP address and browser user-agent string, so we can show what you agreed to.
  • Usage and billing. Which features you use, when, with which model, and what each call cost (to meter your plan); your plan, subscription and credit balance; and the customer and subscription identifiers our payment provider assigns you. We never receive or store your full card number.
  • Technical and security information. IP address, device and browser type, app version, request logs, error reports, and the signals our bot-protection service (reCAPTCHA Enterprise / App Check) returns. If you file a bug report from inside the Service, it includes the description you write and a short trail of the screens and calls that preceded it.
  • Messages. Anything you send us through the contact form or by email.
  • Referral information. If you arrive through an affiliate link, a cookie holding that affiliate's code is set for 60 days so that a signup or purchase can be attributed to them. The affiliate sees a masked form of your email address, never the full address or any of Your Content.

We do not collect information from data brokers, and the Service carries no advertising or third-party analytics trackers.

3. Sensitive information, and information about other people

We do not ask for sensitive information (health, racial or ethnic origin, political or religious views, sexual orientation, genetic or biometric data, criminal history). Your own study notes may nonetheless contain some — a medical student's notes about their own condition, for example. If you choose to enter sensitive information about yourself, we process it only to provide the Service to you, on the basis of your explicit choice to include it, and you can remove it at any time by editing or deleting the content.

The Terms prohibit uploading personal information about anyone else that you are not authorised to disclose, and in particular any information about a patient, client or other identifiable individual. We do not want it, do not knowingly process it, and have no agreement with you to act as your processor or service provider for it. If you upload it anyway, you are the party responsible for it under privacy law. If we become aware of it we may delete it and suspend the account, and we will cooperate with any affected person or regulator. If you believe information about you has been uploaded by someone else, contact us and we will investigate.

4. Why we use it, and our legal bases

Under the GDPR and UK GDPR we need a legal basis for each use. They are:

  • To provide the Service you asked for (performance of our contract with you) — storing and displaying Your Content, sending it to our AI providers to generate cards, papers, marks, lectures and oral examinations, transcribing your recordings, syncing between the web and mobile apps, sharing with people you choose, metering your plan, and billing. AI processing is inseparable from the Service, which is why it is a term of the contract rather than a separate consent you can withdraw while keeping the Service.
  • To run the Service safely and improve it (our legitimate interests, balanced against yours) — security, fraud and abuse prevention, debugging, capacity planning, aggregate usage statistics, reviewing model performance, and paying affiliates for signups they referred (the 60-day first-party referral cookie records only the affiliate's code and is used for nothing else). Where we look at Your Content for these purposes it is to investigate a specific problem or report, not routinely.
  • To meet legal obligations — tax and accounting records, responding to lawful requests, and data-breach notification.
  • With your consent — optional study reminders or product updates by email. You can withdraw consent at any time; every optional email carries an unsubscribe link that takes effect immediately.

We do not use Your Content to train AI models, do not sell personal information, and do not make decisions about you that have legal or similarly significant effects by automated means. AI marking is feedback for your own use; it is not reported to any examining body.

5. Who we share it with

We share personal information only with the service providers that run the Service on our behalf, each bound by contract to use it only for that purpose:

  • Google Cloud / Firebase (United States) — authentication, database, file storage, hosting, serverless compute and bot protection. All of Your Content is stored here.
  • OpenAI and Anthropic (United States) — the AI models. The parts of Your Content needed for a request are sent to one of them and the output comes back. Under their API terms they may not use your data to train their models, and they retain it only briefly (currently up to 30 days) for abuse and safety monitoring. Which provider serves a feature is an operational setting and may change.
  • Stripe (United States and local entities) — payments and billing.
  • Amazon Web Services (United States) — sending transactional email.
  • Apple and Google — distribution of the mobile apps and their crash and install statistics, under their own policies.

We may also disclose personal information where the law requires it, to protect the rights, safety or property of any person, to enforce the Terms, or to a successor if the Service is acquired or merged (we would tell you first). We do not sell personal information and we do not share it for cross-context behavioural advertising.

6. International transfers

MySummaries is operated from Australia, and the providers above store and process data in the United States. If you are in the EEA, the United Kingdom or Switzerland, your personal information is therefore transferred outside your region. We rely on the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework where the recipient is certified under them, and otherwise on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), incorporated into our agreements with those providers. You can ask us for a copy of the relevant safeguards.

7. Security

Data is encrypted in transit and at rest. Access to each account's content is restricted by per-user security rules at the database and storage layer; staff access to production data is limited to what is needed to operate the Service and investigate problems. Our AI providers receive only what a request needs, and the API keys for them never leave our servers. No system is perfectly secure, so we also ask you to use a strong, unique password — we check new passwords against known breach lists — and to tell us at once if you think your account has been compromised. If a data breach is likely to result in serious harm to you we will notify you and the relevant authority as the law requires (within 72 hours to a European supervisory authority where the GDPR applies).

8. How long we keep it

  • Your Content stays until you delete it or delete your account. A subject you schedule for deletion is removed 90 days later; background generation job records are removed after 30 days; data-export files after seven days.
  • Account deletion runs after a seven-day recovery window, then removes Your Content, your stored files, your profile, subscription projections and your authentication account. Backups holding copies roll off within a further 30 days.
  • Billing, usage and acceptance records are kept for as long as tax, accounting and consumer law require — generally up to seven years — and then deleted or anonymised.
  • Security logs are kept for up to 12 months unless needed for an ongoing investigation.

9. Your rights and controls

Wherever you live, the Account page lets you export a structured copy of your data, edit your profile, manage your subscription and schedule deletion of your account, and every board lets you edit or delete its content directly.

Depending on where you live you also have rights under law to:

  • access the personal information we hold about you and be told how we use it;
  • have inaccurate information corrected;
  • have your information deleted;
  • receive it in a portable, machine-readable form;
  • object to, or ask us to restrict, particular processing;
  • withdraw consent where consent is the basis (this does not affect processing already done);
  • not be discriminated against for exercising any of these rights; and
  • complain to a supervisory authority.

To exercise a right that the Account page does not cover, email info@mysummaries.app from the address on your account, or use the contact form while signed in, so that we can verify the request. We respond within one month (45 days for California requests), or tell you if we need longer and why. We will not charge for a request unless it is manifestly unfounded or excessive. If you are unhappy with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), the UK Information Commissioner's Office (ico.org.uk), your local EU data protection authority, or the California Attorney General.

10. California residents

This section supplements the rest of the Policy for California residents under the CCPA/CPRA. In the preceding 12 months we have collected the following categories of personal information, from you directly and from your device, for the purposes in section 4, and disclosed them for a business purpose to the service providers in section 5: identifiers (name, email, account and customer IDs, IP address); customer records and commercial information (plan, purchases, credits); internet and electronic activity (feature use, logs, bug-report trails); audio information (recordings you make); the content you upload and the outputs generated from it; inferences limited to study scheduling (which cards are due); and sensitive personal information limited to account credentials and any health or other sensitive information you choose to include about yourself in your notes. We use sensitive personal information only to provide the Service you requested and for security, which are permitted purposes, so no "Limit the Use of My Sensitive Personal Information" control is required. We do not sell personal information, do not share it for cross-context behavioural advertising, and have no actual knowledge of selling or sharing the personal information of anyone under 16. You have the rights to know, access, correct, delete and port your information and not to be discriminated against, exercisable as described in section 9, including through an authorised agent with written permission from you. Retention periods are in section 8.

11. Cookies and local storage

The Service uses only what it needs to work: a sign-in token kept by our authentication provider, your display preferences (theme, fonts, pomodoro timings, country filter) stored in your browser, bot-protection tokens, and — on the marketing site only, if you arrived through an affiliate link — the 60-day referral cookie described in section 2. There are no advertising or analytics cookies. You can clear all of these from your browser settings; clearing the sign-in token signs you out.

12. Children

The Service is not directed at children under 16 and we do not knowingly collect personal information from them. If you are under 18 a parent or guardian must agree to the Terms for you. If you believe a child under 16 has created an account, contact us and we will delete it.

13. Changes and contact

When this Policy changes we publish the new version with a new version date and, for changes that matter, ask you to accept it in the Service before you continue and tell you by email where we can. Questions, requests and complaints about privacy go to info@mysummaries.app or the contact form. Please include enough detail for us to identify your account and understand the request.