Privacy Policy

Written By Simone (CPO)

Last updated 11 months ago

Effective: October 30, 2024

We at Flashka respect Your privacy and are strongly committed to keeping secure any information We obtain from or about any person who utilizes the Flashka Platform ("You" or the "User"), in compliance with the Regulation (EU) 2016/679 ("GDPR") and any other applicable data protection laws.

This Privacy Policy describes our practices with respect to Personal Data We collect from or about You when You use our website and services (collectively, "Services").

Data controller

Flashka OÜ, with registry code 16813828 ("Flashka", the "Platform" or "We") and with its registered office at Harju maakond, Tallinn, Kesklinna linnaosa, F. R. Faehlmanni tn 6-12, 10125, is the controller and is responsible for the processing of Your Personal Data as described in this Privacy Policy.

Introduction

The Platform functions as an independent learning environment. Flashka operates as a dynamic AI-driven learning platform, primarily focusing on flashcards, quizzes, and personalized learning materials. We do not develop any AI models internally. We rely on third party AI model services. The content and scope of learning resources available on Flashka are constantly evolving, driven by AI technology developed by OpenAI. We may rely on other providers in the future.

Your voluntary learning. You can use the Platform for free or either by paying a monthly fee. For this, You must create a user account on the Platform and link a payment card to the account. By adding a payment card, the You confirm that You are of legal age or have the approval of Your legal guardian to add the payment card.

How the Platform works. Starting from the User's PDF, an AI digital tutor provides explanations and answers when needed. To facilitate memorization, flashcards are generated from simple highlights, ensuring trustworthiness and active student engagement. During the creation of flashcards, quizzes and personalized learning materials the only sources used are those uploaded by the User.

You shall disclose only correct and complete information about Yourself on the Platform. Flashka shall not be obliged to further verify the accuracy of the information disclosed by You and shall not be liable for the disclosure of inaccurate or incomplete information on the Platform.

You shall keep confidential the access credentials of Your account. In case of unauthorized access to an account, Flashka shall be notified immediately.

For further information about our Platform and its terms of use, please refer toT&Cs.

Personal Data We collect

We collect personal data relating to You ("Personal Data") as described below:

Personal Data You provide: We collect the following Personal Data when You create an account or communicate with us.

Account Information: When You create an account with us, We collect information associated with Your account, including Your email and account credentials and, in the case of a Master account, also payment card information, and transaction history (collectively, "Account Information").

User Content: When You use our Services, We collect Personal Data that is included in the input, file uploads, or feedback that You provide to our Services ("Content"). This data is collected through Your interactions with the Platform and, where applicable, through Google services. Moreover, in the "Tell me more about Yourself" step, We collect information such as Your country, role and school/university/profession.

Communication Information: If You communicate with us, We collect Your name, contact information, and the contents of any messages You send (collectively, "Communication Information").

Social Media Information: We have pages on social media sites like Instagram, TikTok, LinkedIn, YouTube and Discord. When You interact with our social media pages, We may collect Personal Data that You choose to provide to us, such as Your contact details (collectively, "Social Media Information").

Other Information You Provide: We collect other information that you may provide to us, such as when you participate in our events or surveys or provide us with information to establish your age or identity (collectively, "Other Information You Provide").

Personal Data We receive automatically from Your use of the Services: When you visit, use, or interact with the Services, we receive the following information:

Log Data: Information that your browser or device automatically sends when you use our Services. Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interact with our Services.

Usage Data: We may automatically collect information about your use of the Services, such as the types of content that you view or engage with, the features you use and the actions you take, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, and your computer connection.

Device Information: Includes name of the device, operating system, device identifiers, and browser you are using. Information collected may depend on the type of device you use and its settings.

For the sake of completeness, given that our Platform does not rely on any in-house generative AI model, it does not entail any web scraping activity nor carry out any kind of processing that is typical of generative AI model developing, such as fine-tuning data processing activities.

How We use Personal Data

We may use Personal Data for the following purposes:

To provide and maintain our Services;
To improve and develop our Services and new features and conduct research;
To communicate with You, including to send You information or marketing about our Services;
To prevent fraud, criminal activity, or misuses of our Services, and to protect the security of our systems and Services; and
To comply with legal obligations and to protect the rights, privacy, safety, or property of our Users and of the Platform.
To collect payments.

Aggregated or De-Identified Information. We may also aggregate or anonymise some Personal Data so that it can no longer be used to identify You and use this information to analyse the effectiveness of our Services, to improve and add features to our Services, to conduct research and for other similar purposes. Once such data are aggregated or de-identified, it does not qualify anymore as a Personal Data under applicable legislation. We collect this information through the Services and We will maintain and use de-identified information. There is no way to reidentify data subjects once data have been aggregated or anonymised.

Legal grounds for processing

When We process Your Personal Data for the purposes described above, We rely on the following legal bases:

	Purpose of processingLegal basis, depending on the process activity:
To provide and maintain our Services	Where necessary to perform a contract with You, such as processing a user's prompts to provide a response, pursuant to Article 6(1)(b) of GDPR.
To improve and develop our Services and new features and conduct research	Where necessary for our legitimate interests, including in developing, improving, or promoting our Services, such as when We train and improve our models, pursuant to Article 6(1)(f) of GDPR.
To communicate with You, including to send You information about our Services	Where necessary to perform a contract with You, such as processing Your contact information to send You a technical announcement about the Services, pursuant to Article 6(1)(b) of GDPR.
To send to You Marketing communications	Where necessary to send marketing communications using email as the point of contact only to already existing users on the ground of our legitimate interests pursuant to Article 6(1)(f) of GDPR.
To prevent fraud, criminal activity, or misuses of our Services, and to protect the security of our systems and Services	Where necessary to comply with a legal obligation, pursuant to Article 6(1)(c) of GDPR. Where We are not under a specific legal obligation, where necessary for our legitimate interests, including in protecting our Services from abuse, fraud, or security risks, such as processing data from security partners to protect against fraud, abuse and security threats in our Services, pursuant to Article 6(1)(f) GDPR.
To comply with legal obligations and to protect the rights, privacy, safety, or property of our Users and of the Platform	Where necessary to comply with a legal obligation, such as retaining transaction information to comply with record-keeping obligations, pursuant to Article 6(1)(c) of GDPR.
To collect payments	Where necessary to perform a contract with You, such as providing 3000 AI credits/month in the Master Account, pursuant to Article 6(1)(b) of GDPR.

Retention

We will retain Your Personal Data for only as long as We need in order to provide our Service to You, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long We retain Personal Data will depend on a number of factors, such as:

Our purpose for processing the data (such as whether We need to retain the data to provide our Services);
The amount, nature, and sensitivity of the data;
The potential risk of harm from unauthorized use or disclosure of the data;
Any legal requirements that We are subject to.

Data transfers

We will transfer Your Personal Data to recipients outside of the European Economic Area, including the United States of America ("USA"). When data is transferred to the USA, it may not be subject to the same data protection standards as in Your home country. Nevertheless, We transfer Personal Data in compliance with all applicable data protection laws. To transfer Your Personal Data outside of the EEA We rely on the European Commission's adequacy decisions on certain countries and, for other jurisdictions, We rely on the Standard Contractual Clauses as approved by the European Commission along with any applicable country addenda. For further details or to request a copy of the safeguards We have implemented, please contact us at stefandjokovic@flashka.ai.

By using our Services, You understand and acknowledge that Your Personal Data will be processed and stored in OpenAI's facilities and servers in the USA and may be shared with their service providers and affiliates in other countries.

Your rights

You have the following statutory rights in relation to Your Personal Data:

Access Your Personal Data and information relating to how it is processed.
Delete Your Personal Data from our records.
Rectify or update Your Personal Data.
Transfer Your Personal Data to a third party (right to data portability).
Restrict how We process Your Personal Data.
Lodge a complaint with Your local data protection authority (see below).

You have the following rights to object:

Object to our processing of Your Personal Data for direct marketing at any time.
Object to how We process Your Personal Data when our processing is based on our legitimate interests.

To exercise Your rights please submit Your request through stefandjokovic@flashka.ai.

Please note these rights may be limited, for example if fulfilling Your request would reveal Personal Data about another person, or if You ask us to delete information that We are required by law or have compelling legitimate interests to keep.

We hope that We are able to address any questions or concerns You may have. If You have any unresolved complaints with us, You can reach out to the Estonian Data Protection Inspectorate as our lead supervisory authority, or Your local supervisory authority.

How to contact us

For any questions or concerns regarding data privacy, Users can contact us at stefandjokovic@flashka.ai. Our team is available to provide assistance and address any data privacy issues.

Was this helpful?

Still need help? Ask the team