StudyPal — Privacy Policy

Effective Date: August 2, 2026 Last Updated: August 2, 2026

This Privacy Policy explains how WATULAB DIGITAL ("StudyPal," "we," "us," or "our"), a company registered in Tanzania Mainland, collects, uses, shares, and protects your personal data when you use the StudyPal platform — including our website, applications, and all related services (collectively, the "Service").

Reading this policy matters. StudyPal is an AI-powered learning tool, and some of your data — including materials you upload — may be processed by third-party AI systems to deliver the Service. This policy explains exactly how that works.

If you have questions, contact us at info@watulab.com.

1. Who This Policy Applies To

This policy applies to:

• Individual users who create a StudyPal account and use the Service directly.
• Minor users (under 18, or under the age of majority in their jurisdiction), who must have parental or guardian consent to use the Service. Parents and guardians who have provided consent for a minor's account are also covered by this policy.

If you are a teacher or educational institution administrator using StudyPal with your students, please note that our Terms of Use require individual user accounts only at this time. Institutional procurement features are not currently available.

2. What Data We Collect

2.1 Account Data

When you create an account, we collect:

• Your display name
• Your email address
• Your phone number (used for payment and identity verification)
• Your password (stored as a secure, one-way cryptographic hash — we never store the plain-text password)
• Your account creation date and last login date

If you sign in or sign up using "Sign in with Google," Google shares your name, email address, and profile picture (if available) with us, in accordance with your Google Account settings and Google's own privacy policy. We use this information only to create and manage your StudyPal account, exactly as we would for an email/password account. We do not request or receive access to your Gmail, Google Drive, contacts, or any other Google data beyond this basic profile information.

2.2 Uploaded Content (User Content)

When you use the Service, you may upload:

• Text documents, notes, and study materials
• PDF files
• Images
• Audio and video files

This User Content is stored on our servers and may be transmitted to third-party AI providers for processing (see Section 6).

2.3 AI Usage Data

We collect data about your interactions with AI features, including:

• Prompts and questions submitted to the AI tutor
• Quizzes generated from your materials
• Your answers to quiz questions
• AI tutor conversation history

2.4 Learning and Performance Data

We collect data about how you use learning features, including:

• Quiz scores and performance over time
• Topics or concepts you have been assessed on
• Identified areas where your performance suggests a knowledge gap ("blind spots")
• Time spent on quizzes and tutoring sessions

2.5 Payment Data

When you purchase a Subscription, payment is processed by ClickPesa, our third-party mobile money payment processor. We collect:

• The mobile number you used to authorize payment
• Payment confirmation status, amount, and timestamp
• Your subscription plan and billing history

We do not store your PIN or any sensitive mobile money credentials. ClickPesa handles payment authorization directly on their secure platform.

2.6 Device and Technical Data

We automatically collect certain technical data when you use the Service, including:

• IP address
• Browser type and version
• Operating system
• Device type
• Pages and features visited within the Service, and the time and duration of visits
• Referring URLs (how you arrived at the Service)
• Error logs

2.7 Communications Data

If you contact our support team, we retain records of that communication.

3. How We Collect Your Data

We collect data in the following ways:

• Directly from you: When you create an account, upload content, interact with AI features, participate in contests, or contact support.
• Automatically: Through cookies, log files, and similar tracking technologies when you use the Service (see Section 10).
• From payment processors: We receive payment confirmation and status data from ClickPesa after you authorize a payment.

4. Why We Use Your Data (Legal Bases)

We use your data for the following purposes:

If you are in the European Economic Area (EEA) or United Kingdom, the legal bases above also correspond to the GDPR bases of contract, legitimate interest, legal obligation, and consent, as noted.

You may withdraw consent for marketing communications at any time by clicking "Unsubscribe" in any email or updating your notification preferences.

5. Children's and Minors' Privacy

5.1 Age Minimum and Parental Consent

We do not knowingly collect personal data from children under 13 years old without verified parental or guardian consent. Users between 13 and 17 may use the Service with the active consent and supervision of a parent or guardian, as described in our Terms of Use.

If you are a parent or guardian and believe your child has created an account without your consent, contact us immediately at info@watulab.com. We will investigate and, if confirmed, delete the account and associated data promptly.

5.2 Data We Collect from Minor Accounts

For verified minor accounts (ages 13–17 with parental consent), we collect and use data in the same way as described in this policy. We apply additional protections to minor accounts:

• Minor accounts are not used for targeted advertising.
• Minor accounts' quiz performance and learning data are not shared publicly.
• We do not send marketing communications to minor accounts without explicit parental consent.

5.3 Parental Access and Control

A parent or guardian who has consented to a minor's account may request access to, correction of, or deletion of their child's data by contacting us at info@watulab.com.

5.4 Schools, Teachers, and FERPA

StudyPal currently operates as an individual-signup service only. Teachers may use the Service for their own purposes, but we do not currently offer school-wide procurement or administration features. As a result, FERPA (the U.S. Family Educational Rights and Privacy Act) does not currently apply to us as a direct service provider to schools. If institutional features are added in the future, this section will be updated accordingly.

6. AI Data Processing — How It Works

This section is important. Please read it carefully.

6.1 How AI Features Work

StudyPal's quiz generation, AI tutoring, and related features are powered by third-party AI providers — technology companies that operate large AI models. When you use an AI-powered feature:

1. Your User Content (the materials you uploaded) and/or your prompts are transmitted over an encrypted connection to the AI provider's servers.
2. The AI provider processes your content and returns a generated response (a quiz, an explanation, a tutoring answer).
3. The generated response is delivered to you in the Service.

6.2 Who Receives Your Data

We transmit your User Content and AI prompts to third-party AI providers solely for the purpose of generating the AI-powered features you requested. We do not sell your content to these providers. We do not permit them to use your content for any purpose other than processing your requests.

We refer to these providers generically in this policy rather than by name, as our provider relationships may change over time. Current provider information is available on request at info@watulab.com.

6.3 Model Training Disclosure

We use standard enterprise API agreements with our third-party AI providers. Under these agreements, your User Content and prompts are not used to train or improve their underlying AI models. We do not allow AI providers to use your data for model training.

6.4 AI Data Retention

• During processing: Your content is transmitted to the AI provider, processed, and a response is returned. Providers may retain a copy for up to 30 days strictly for operational and security reasons (e.g., detecting abuse or debugging), after which it is automatically deleted.
• In StudyPal's systems: Your uploaded content and AI-generated outputs are stored for as long as your account is active and for a period after deletion, as described in Section 11.

6.5 Minimization

We transmit only the content necessary to generate the response you requested. We do not transmit your full account profile, payment data, or unrelated User Content to AI providers.

7. How We Share Your Data

We do not sell your personal data. We share your data only in the following circumstances:

7.1 Service Providers

We share data with companies that provide services on our behalf, including:

Each provider is contractually required to process your data only for the purposes we specify and to maintain appropriate security measures.

7.2 Other Users (Social Features)

Certain data may be visible to other users as described in Section 8.

7.3 Legal Compliance

We may disclose your data if we believe in good faith that disclosure is necessary to:

• comply with applicable law, regulation, or a valid legal process (such as a court order or subpoena);
• protect the rights, property, or safety of StudyPal, our users, or the public;
• prevent or investigate fraud, security breaches, or illegal activity.

7.4 Business Transfers

If WATULAB DIGITAL undergoes a merger, acquisition, sale of all or substantially all of its assets, or similar corporate transaction, your data may be transferred to the successor entity. We will notify you via email and in-app notice before your data is transferred and becomes subject to a different privacy policy.

7.5 With Your Consent

We may share your data with third parties when you give us explicit consent to do so.

8. Social Features and Data Visibility

When you use group contests, study groups, or other social features:

• Your display name and profile badge are visible to other members of your study group and contest participants.
• Your leaderboard ranking and score are visible to other participants in the same contest.
• Your uploaded materials are only visible to members of groups you have explicitly chosen to share them with. Materials in your personal (private) library are not visible to other users.
• Your quiz performance and progress data are private by default and not visible to other users unless you share them.
• Group activity (such as who joined a group or contest) may be visible to other group members.

You can review and manage your sharing preferences from your account settings.

9. International Data Transfers

StudyPal is based in Tanzania Mainland. However, some of our service providers — including cloud infrastructure, AI providers, and analytics tools — may process your data in other countries, including countries outside Tanzania and East Africa.

Where we transfer your data internationally, we take steps to ensure appropriate safeguards are in place to protect your data, including contractual data processing agreements and ensuring equivalent legal data protection standards with each provider.

10. Cookies and Tracking Technologies

10.1 What We Use

We use cookies and similar tracking technologies (such as local storage and session identifiers) to operate and improve the Service. We use:

• Strictly necessary cookies: Required for the Service to function (e.g., keeping you logged in during a session). These cannot be disabled.
• Functional cookies: Remember your preferences and settings.
• Analytics cookies: Help us understand how users interact with the Service so we can improve it. These may collect anonymized usage data.

10.2 Third-Party Cookies

Some of our analytics and monitoring providers may set their own cookies. We do not control these cookies directly.

10.3 Managing Cookies

You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent the Service from functioning properly.

11. Data Retention and Deletion

11.1 Retention During Active Account

We retain your data for as long as your account is active and for a reasonable period afterward to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

11.2 Account Deletion

When you delete your account:

• We initiate deletion of your personal data from our active systems within 30 days of your request.
• Certain data may be retained in backup systems for a period before it is overwritten, consistent with our standard backup rotation schedule.
• We may retain anonymized and aggregated data derived from your usage that cannot identify you.
• We retain payment and transaction records for the legally required period.

11.3 How to Request Deletion

Delete your account from Settings, or contact us at support@watulab.com with the subject line "Account Deletion Request."

12. Your Rights and Choices

12.1 Rights Under Tanzania's PDPA 2022

As a user in Tanzania, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Ask us to delete your personal data (subject to legal retention requirements).
• Objection: Object to certain processing of your data.
• Portability: Receive a copy of your data in a structured, machine-readable format where technically feasible.

12.2 Rights Under GDPR (EEA/UK Users)

If you are located in the European Economic Area or United Kingdom, you have additional rights under the GDPR, including:

• The right to restrict processing while a dispute is resolved.
• The right to withdraw consent at any time (where processing is based on consent).
• The right to lodge a complaint with your local data protection authority.

12.3 California Users (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, and share.
• The right to delete your personal information (with certain exceptions).
• The right to opt out of the sale or sharing of personal information. We do not sell your personal information.
• The right to correct inaccurate personal information.
• The right to non-discrimination for exercising your privacy rights.

To exercise any California rights, contact us at info@watulab.com with "California Privacy Request" in the subject line.

12.4 How to Exercise Your Rights

To exercise any of the above rights, contact us at info@watulab.com. We will respond within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing your request.

12.5 Marketing Communications Opt-Out

You can unsubscribe from marketing emails at any time by clicking "Unsubscribe" in any marketing email or updating your communication preferences in account settings. You will still receive transactional messages (such as payment confirmations and renewal reminders) necessary to operate your account.

13. Data Security

We take the security of your data seriously. We implement technical and organizational measures designed to protect your personal data from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit: All data transferred between your device and our servers is encrypted using industry-standard TLS/HTTPS protocols.
• Encryption at rest: Data stored in our databases is encrypted at rest.
• Access controls: Access to personal data within our organization is limited to personnel who need it to perform their duties, and is subject to confidentiality obligations.
• Authentication security: Passwords are stored using strong one-way cryptographic hashing. We support and encourage strong authentication practices.
• Regular review: We review our security practices periodically and aim to keep them current with reasonable industry standards.

No security system is perfect. Despite our efforts, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@watulab.com.

14. Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant data protection authority within the timeframe required by applicable law;
• Notify affected users without undue delay when the breach is likely to result in a high risk to those individuals, providing information about what happened, what data was affected, and what steps we are taking.

Notifications will be sent to the email address on your account.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

(a) post the updated policy with a new "Last Updated" date; (b) notify you by email or prominent in-app notice at least 14 days before the changes take effect.

If you continue to use the Service after the updated policy takes effect, you accept the revised policy. If you do not agree, please stop using the Service and delete your account.

16. Tanzania-Specific Disclosures (PDPA 2022)

WATULAB DIGITAL operates under and complies with Tanzania's Personal Data Protection Act 2022 (PDPA). Under this Act:

• You have the rights described in Section 12.1 above.
• We are a Data Controller responsible for determining how and why your data is processed.
• Third-party service providers who process data on our behalf act as Data Processors under our instruction and are bound by data processing agreements.
• Cross-border data transfers are subject to the requirements of the PDPA 2022.

17. Contact Us

For privacy questions, requests, or concerns, please contact our Privacy Team:

WATULAB DIGITAL Email: info@watulab.com Website: https://studypal.watulab.com

We aim to respond to all privacy inquiries within 30 days.

StudyPal is a product of WATULAB DIGITAL. All rights reserved.