Privacy Policy

Last Updated: 18 October 2026

Welcome to AskCrates ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

1. Information We Collect

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide when you:

Create a family account
Add a child account to your family account
Use our application or services
Contact us for support or inquiries, or request a demo

The personal information we collect may include:

Contact Information: Name and email address of the account holder. For a child account we collect only the name the parent enters; children do not provide an email address.
Account Credentials: Your password, and for child accounts a PIN set by the parent. Both are stored only as a hash, never in readable form.
Date of Birth: Asked when you create your family account, only to check that the account holder is 18 or older. We do not store the date itself, only that the check was passed and when. You also confirm that you are 18 or older and the holder of the payment method used for the trial; we record when you did.
Campaign Source: If you reach the sign-up page through a link with campaign tags (for example from one of our announcements), we keep the names of that source and campaign with your account, to see which announcements bring families to AskCrates. We also count visits to the sign-up form and refused sign-ups without any identifier (no IP address, no cookie).
Profile and Family Settings: Language, family name and family code, which children belong to the family, and the settings a parent chooses for each child
User Content: Learning materials you upload, the subjects, topics, and study plans you create, your conversations with the tutor, and your answers in exercises and mock exams
Learning Data: Learning objectives and your progress on them, mock exam results, study time and study days, and the notes the tutor keeps about what helps you learn (which you can view, correct, or remove in the app)
Subscription Information: To start the trial you add a payment method at Paddle, which handles all payments. We receive your trial and subscription status, billing interval, invoices, and the type and last digits of your card to show them to you in the app. We do not receive or store full card numbers.

1.2 Information Automatically Collected

When you visit our website or use our services, we automatically collect certain information:

Usage Data: Which features you use, when a trial limit is reached, and steps taken toward starting the subscription. We record this ourselves on our servers, without cookies and without third-party analytics.
AI Usage Records: For each AI request, the model used, its purpose, size, duration, and cost, linked to the account. These records do not contain the content of the request.
Device and Log Data: IP address and browser type, stored with your sign-in session and used to protect against abuse (for example rate limiting and sign-in lockouts)
Cookies: Only cookies that are necessary to run the Services; see our Cookie Policy for details

2. How We Use Your Information

We use the information we collect for the following purposes:

To Provide Services: Deliver personalized tutoring and learning assistance, including AI-generated learning objectives, study plans, explanations, practice questions, and mock exams based on your inputs and materials
To Improve Services: Analyze usage patterns to enhance user experience and the quality of AI responses
To Communicate: Send emails needed to run your account (email verification, welcome, password reset, subscription confirmation, confirmation that an account was deleted, notices when your password or email address changes), an optional weekly progress summary if you switch it on, and replies to your inquiries. We do not send marketing newsletters.
To Ensure Security: Protect against fraud, abuse, and unauthorized access
To Comply with Legal Obligations: Meet regulatory and legal requirements
With Your Consent: For any other purpose with your explicit permission

2.1 Use of Artificial Intelligence (AI)

AskCrates uses large language models from Anthropic (Claude), Google (Gemini), and OpenAI (text embeddings), which we access through OpenRouter, to read your uploaded materials, prepare learning objectives and study plans, and generate tutoring responses, mock exam questions, and grading based on the questions you ask and the learning materials you provide. These providers may process data in the United States and other countries; see Section 5.

We send only the information necessary for the AI to process a given request (e.g. your message, relevant context, excerpts from documents you upload, and notes about what helps you learn). We do not add your name, email address, or payment details to these requests.
Your data is not used to train AI. We do not use your inputs, your uploaded materials, or the AI's outputs to train AI models, and we do not permit our AI providers to use them to train or improve their models. Your content is processed only to answer your request.
Your materials are isolated to your account. Only you (and, for child accounts, the parent of the family account) can access your uploaded materials and the tutoring generated from them. We do not use your content for other users' sessions.
We do not intentionally send special categories of personal data (e.g. health, biometric, religious, or political information) to AI providers. Please do not include such information in uploads or messages.
AI-generated outputs are suggestions to support learning. They are not professional advice and are not used to make automated decisions that produce legal or similarly significant effects about you.
AI systems can occasionally generate incorrect, incomplete, or biased information. We encourage you, parents, and teachers to critically review AI outputs and verify important information with authoritative sources.
Your tutor conversations are stored in your account so that you can continue them, and so that a parent can read their child's conversations. Our internal reporting works with usage figures and does not show conversation content. We do not use conversations for targeted advertising and do not sell data.
The app does not record or process audio. If you dictate an answer with your device's keyboard microphone, speech recognition is performed by your device or keyboard provider, and we receive only the resulting text.

3. Legal Basis for Processing

3.1 European Economic Area and United Kingdom (GDPR/UK GDPR)

If you are located in the EEA or UK, our legal basis for collecting and using your personal information depends on the data and the context:

Consent: You have given explicit consent for specific purposes
Contract Performance: Processing is necessary to provide our services
Legitimate Interests: We have legitimate interests that do not override your rights
Legal Obligations: We need to comply with legal requirements

3.2 Brazil (LGPD)

If you are located in Brazil, we process your personal data based on legal bases under LGPD: consent, contract performance, legal obligation, legitimate interests, protection of life or physical safety, and credit protection.

3.3 Canada (PIPEDA)

If you are located in Canada, we collect, use, and disclose your personal information in accordance with PIPEDA principles: consent, limited collection, limited use and disclosure, accuracy, and safeguards.

4. How We Share Your Information

4.1 Service Providers

We share your information with service providers who perform services on our behalf:

Railway: Hosting of our website, app, and database, in a European Union region (Netherlands)
Amazon Web Services (S3): Storage of uploaded files until they have been processed, and of the figures cut out of them (diagrams, maps, labelled drawings) for as long as the material exists, in Switzerland (Zurich)
OpenRouter, with Anthropic, Google, and OpenAI: AI processing as described in Section 2.1
Resend: Sending account emails and the optional weekly summary
Paddle: Checkout, payments, invoices, and refunds. Paddle is the Merchant of Record for our orders and processes your payment details under its own privacy policy.
Cloudflare: Delivering our website and app and protecting them against attacks

These service providers are contractually obligated to protect your data and use it only for the purposes we specify. We do not use third-party analytics or advertising services, and we do not sell your personal information.

4.2 Within a Family Account

The parent or guardian who manages a family account can see their children's subjects, materials, study plans, tutor conversations, mock exam results, and progress, and receives the weekly summary for their children if it is switched on.

4.3 Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities (e.g. court orders, subpoenas).

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

5. International Data Transfers

Your account and learning data are stored in the European Union (Netherlands), and uploaded files and the figures cut out of them are held in Switzerland. Some of our service providers—in particular the AI providers, our email provider, our payment provider, and Cloudflare—may process data in the United States and other countries. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission and other legally approved transfer mechanisms.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account Data: Retained until you delete your account, or until we delete an account that has stayed without a subscription for six months (see below)
Uploaded Material Originals: Original uploaded files are deleted once they have been processed into text chunks, embeddings and the figures used for learning
Derived Learning Data: Chunks, embeddings, figures cut out of the material, and metadata needed to provide tutoring are retained until you delete the topic or subject they belong to, the child account, or your account, and for legal obligations where applicable
Conversations and Learning Data: Retained while the related study plan and account exist
Sign-in Sessions: Expire automatically and are removed when you sign out
Usage Data: Retained while your account exists; afterwards we keep only records that no longer identify you, such as what an AI request cost, upgrade statistics and the number of deleted accounts
Demo Requests and Support Messages: Retained as long as needed to respond and follow up
Legal Data: Retained as required by applicable laws and regulations (for example billing records)

You can delete your account yourself at any time in the app under Settings > Delete account, after confirming twice and entering your password. This permanently deletes the account and everything stored in it from our database and file storage: your profile and sign-in, subjects, topics, uploaded materials with their chunks, embeddings and figures, study plans, tutor conversations, mock exams, progress and tutor notes, and every child account of a family account. An active trial or subscription is cancelled at the same time. A parent can delete a child account on the Family page, which permanently deletes the child's sign-in and all of the child's data. Deletion takes effect immediately and cannot be undone. If a trial or subscription ends and the account then stays without a subscription for six months, we email the account holder that it will be deleted 30 days later, remind them 7 days before, and then delete it in the same way, unless a subscription is started in the meantime. We keep only statistics that can no longer be linked to you (see Usage Data above). Deletion does not affect records that Paddle keeps as merchant of record, such as invoices, or records we are required by law to keep. If you have forgotten your password, reset it by email first; if you cannot use the app at all, contact us at [email protected] and we will delete the account for you.

7. Your Privacy Rights

Depending on your location, you may have the following rights:

7.1 European Users (GDPR)

Access: Request copies of your personal data
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data (right to be forgotten)
Restriction: Request limitation of processing
Portability: Receive your data in a machine-readable format; you can download it yourself in the app under Settings > Your data
Objection: Object to processing based on legitimate interests
Withdraw Consent: Withdraw consent at any time

7.2 California Users (CCPA/CPRA)

Know: Request disclosure of data we collect, use, and share
Delete: Request deletion of your personal information
Opt-Out: Opt out of the sale of personal information (we do not sell data)
Non-Discrimination: Not be discriminated against for exercising your rights

7.3 United Kingdom (UK GDPR)

Your rights under UK GDPR are similar to those under the EU GDPR. You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk.

7.4 Brazil (LGPD)

Under LGPD you have rights including: confirmation of processing, access, correction, anonymization/blocking/deletion, portability, deletion, information about sharing, revocation of consent, and review of automated decisions. You may file a complaint with the ANPD: gov.br/anpd.

7.5 Canada (PIPEDA)

You have rights to access, correction, withdraw consent, and file a complaint with the Privacy Commissioner of Canada: priv.gc.ca. We respond in accordance with PIPEDA, typically within 30 days.

7.6 How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (or as required by applicable law).

8. Children's Privacy

AskCrates is designed for learners aged 7 to 17 and is built so that an adult account holder — a parent or legal guardian — is in charge of a child's account.

Parents create child accounts. A child account can only be created by a parent or legal guardian from within their own family account. Children cannot register themselves. By creating the account, the parent authorizes the child's use of the Services and the processing of the child's data described in this policy; no separate consent step is needed.
Minimal data. For a child account we ask only for a name and a PIN chosen by the parent. Children do not provide an email address or other contact details.
Parental control. For each child, the parent decides whether the child may upload materials and whether the AI may use general knowledge or only the uploaded materials. The parent can view the app as their child, read the child's tutor conversations, follow their progress, and change the child's settings or delete the child's account, with all of its data, at any time.
No advertising to children. We do not use children's data for behavioral advertising, do not sell it to third parties, and do not show children offers to buy anything.
Adult account holders only. Every account is a family account held by someone aged 18 or older, in every country; minors cannot register an account of their own. If you believe a minor has created an account, contact us and we will remove it.

Parents and guardians may contact us at [email protected] to review, correct, or delete their child's information.

9. Data Security

We implement appropriate technical and organizational measures:

Encryption of data in transit and at rest
Passwords and PINs stored only as hashes, with limits on repeated failed sign-in attempts
Access controls and authentication, with internal access limited to what each task requires
Regular security assessments and audits
Employee training on data protection
Incident response procedures

No method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

10. Cookies and Tracking Technologies

We use only cookies that are necessary to run the Services, such as keeping you signed in and remembering your language. We do not use analytics or advertising cookies. For detailed information, see our Cookie Policy.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to read their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you by posting the new policy on this page, updating the "Last Updated" date, and for significant changes, sending an email notification. Your continued use after changes constitutes acceptance of the updated policy.

13. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices (AskCrates is built and owned by Aquilup):

Aquilup 4123 Allschwil, Schweiz [email protected]

14. Data Protection Officer

For users in the EEA, UK, Brazil, or Canada, you may contact our Data Protection Officer at [email protected].

15. Supervisory Authorities

You have the right to lodge a complaint with your local data protection authority:

EEA: Your local supervisory authority; list at edpb.europa.eu
United Kingdom: ICO – ico.org.uk
Brazil: ANPD – gov.br/anpd
Canada: priv.gc.ca
California: CPPA – cppa.ca.gov

16. AI Governance and Responsible Use

We treat AskCrates as a limited-risk educational AI system under the EU Artificial Intelligence Act and take the NIST AI Risk Management Framework into account. We make clear to users that the tutor is an AI. Parents can read their children's tutor conversations and restrict the tutor to the uploaded materials; learners can view, correct, or remove what the tutor remembers about how they learn. We send AI providers only the data needed for each request and do not permit them to train on it. We do not deploy AI to make automated decisions that produce legal or similarly significant effects about individual users.