Privacy Policy

CapyIT AI ("we", "us", or "our") operates this learning platform (the "Service"). This Privacy Policy explains how we collect, use, store, and share personal information when you use the Service.

1. Who we are

Data controller: CapyIT AI
Website: https://capyit.com
Contact: [email protected]

For privacy-related requests, contact us using the email above or our contact form.

2. Information we collect

Account and profile information

When you create an account, we collect:

• Email address, username, and password (stored in hashed form)
• Name and profile details you provide (bio, avatar, role as student or teacher)
• Learning preferences from onboarding (study habits, goals, learning style, motivation level)

Authentication data

If you sign in with Google, we receive your Google account email address and basic profile information (name and profile picture) as permitted by your Google account settings. We do not receive your Google password.

For email verification and password reset, we send one-time passcodes (OTPs) to your email address. OTP codes are stored temporarily and expire after a short period.

Learning and academic content

When you use learning features, we may collect and store:

• Documents you upload (PDFs, images, presentations, text files, and similar formats)
• Text extracted from your documents and related search embeddings
• Course enrollments, lesson progress, flashcards, quiz attempts, and task data
• AI tutor conversations, questions, answers, and generated learning plans
• Personality and learning assessments you complete

Communication and collaboration

If you use chat or collaboration features, we store:

• Messages you send in chat rooms and direct messages
• Files, images, and other media you share in chats
• Room membership and moderation data

Usage and gamification data

We collect information about how you use the Service, including XP, streaks, achievements, focus sessions, token wallet balances, subscription plan selection, and interface preferences.

Information you send us directly

If you contact us, join a waitlist, or submit feedback, we collect the information you provide (such as your name, email address, and message content).

Technical information

Like most web services, our servers may automatically log technical data such as your IP address, browser type, device information, pages visited, and timestamps. We use this data for security, troubleshooting, and service operation.

3. How we use your information

We use personal information to:

• Create and manage your account and authenticate you
• Provide AI tutoring, document analysis, quizzes, flashcards, and other learning tools
• Personalize your learning experience and generate study plans
• Enable real-time chat and collaboration between users
• Process subscription plans and manage token usage
• Send transactional emails (welcome messages, verification codes, password resets, support replies)
• Maintain security, prevent abuse, and improve the Service
• Respond to your enquiries and support requests

4. AI processing and third-party providers

To power AI features, we send relevant content (such as your prompts, uploaded document text, and conversation context) to third-party AI providers. Depending on configuration, these may include:

• OpenAI
• Google (Gemini)
• Anthropic (Claude)
• Groq

These providers process data on our behalf to generate responses. We recommend not submitting highly sensitive personal information in AI chats or uploads unless necessary for your learning goals.

We also use the following service providers:

• Google OAuth — social sign-in
• ZeptoMail (Zoho) — transactional email delivery
• Cloudflare R2 — secure file and media storage
• Cloudflare Turnstile — invisible bot protection on our contact form. Turnstile may collect device and interaction signals to distinguish humans from bots. Use of Turnstile is subject to Cloudflare's Turnstile Privacy Policy Addendum.
• PostgreSQL and Redis — database and real-time infrastructure (hosted on our servers or cloud infrastructure)

We may load fonts and styling resources from third-party content delivery networks (such as Google Fonts). Those providers may collect technical data according to their own policies.

5. Legal bases for processing (EEA/UK users)

Where applicable data protection law requires a legal basis, we rely on:

• Contract — to provide the Service you sign up for
• Legitimate interests — to secure, maintain, and improve the platform
• Consent — where required, such as for optional communications or certain cookies
• Legal obligation — where we must comply with applicable law

6. How we share information

We do not sell your personal information. We may share information:

• With service providers listed above, under contracts that limit their use of your data
• With other users when you participate in shared chat rooms or collaborative features
• When required by law, regulation, legal process, or to protect rights and safety
• In connection with a merger, acquisition, or sale of assets (with notice where required)

7. International data transfers

We and our service providers may process data in countries other than your own, including the United States. Where required, we take steps designed to ensure appropriate safeguards for cross-border transfers.

8. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated data by contacting us.

9. Security

We use technical and organizational measures to protect your information, including encrypted connections (HTTPS), secure session cookies in production, and encrypted storage for uploaded files where supported by our infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information
• Object to or restrict certain processing
• Request a portable copy of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise these rights, contact [email protected]. We will respond within the timeframes required by applicable law.

11. Children's privacy

The Service is intended for students and learners but is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

12. Cookies and similar technologies

We use cookies and browser storage for essential functionality and preferences. For details, see our Cookie Policy.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

14. Contact us

Questions about this Privacy Policy? Contact us at [email protected] or via our contact page.