Privacy Policy

1. Introduction

StudPulse ("we", "our", or "us") operates the StudPulse platform — an AI-native horse management system for breeding, boarding, and stud management.

This Privacy Policy explains what personal data we collect, why we collect it, and how we protect it. It is designed to comply with the General Data Protection Regulation (GDPR), the EU Artificial Intelligence Act (AI Act), and applicable US privacy laws including the California Consumer Privacy Act (CCPA/CPRA), the CAN-SPAM Act, COPPA, and the Nevada Privacy Law (SB 220).

StudPulse application servers and databases are hosted within the European Union. Some supporting services — including AI processing, website analytics, and email delivery — are operated from data centres in the United States. Section 5a describes exactly what is sent to AI services and who receives it, and Section 7 sets out which service is where and the safeguards that apply.

Data Protection Contact: StudPulse is a startup and, based on the nature and scale of our processing, is not required to appoint a formal Data Protection Officer (DPO) under GDPR Art. 37. Our designated privacy contact handles all data protection enquiries and can be reached at support@studpulse.com.

2. Data Controller & Processor Roles

For the purposes of the GDPR, StudPulse acts as the Data Controller for your account information. For the equine and farm data you input into the platform regarding your clients, boarders, or staff, you act as the Data Controller and StudPulse acts as the Data Processor.

3. Data We Collect

We collect the following categories of information:

• Account data — your name, email address, password (hashed with bcrypt), and organisation name provided during registration.
• Mobile phone number — optional. You can give it when you create an account or later in your profile. If you give it, we confirm it with a one-time code sent by SMS. It is used so that a stable can contact you about your bookings, and to limit the number of accounts that can be registered with one number, which keeps fake accounts off the platform. The number is not used for marketing, and giving it is not consent to marketing calls or text messages. You can change it in your profile.
• Horse & Farm records — all data you enter into the platform: horse profiles, medical records, breeding records, training logs, stable and stall assignments, feed plans, and event history.
• Usage data — pages visited, features used, AI agent queries, and timestamps of actions within the application.
• Device & technical data — browser type, operating system, IP address, and service worker state for PWA functionality.
• Push notification tokens — a delivery address for your device, stored to send booking confirmations and care reminders. In a web browser this is a VAPID push subscription object; in the Android and iOS apps it is a Firebase Cloud Messaging registration token, which is a device identifier.
• Voice recordings and transcriptions — when you dictate a note or speak to the AI Barn Agent, the audio recording itself is transmitted to an AI service (Microsoft Azure, through OpenRouter — see Section 5a) to be converted to text; we store the resulting transcript, not the audio. Voice works only after you have agreed to the AI features in the app (Section 5a) and allowed your device to use the microphone, and the microphone is used only while you are recording. Your conversations with the AI assistant, including their voice transcripts, are deleted when you delete your account. The transcript of a voice note that became a barn record (for example a care entry) stays part of that barn's records and no longer carries your name once your account is deleted.
• Photographs and files — images and documents you attach to records: horse photographs, receipts, veterinary documents, ultrasound scans and similar. In the mobile apps these may be taken with the camera or chosen from your photo library, in both cases only after you grant permission and choose to attach something. We do not scan your photo library and we do not access photographs you have not attached.
• Ride routes (location) — when you record a ride with the mobile app, or import a ride file (GPX or TCX, for example exported from a Garmin watch) into a training session: the route as a series of points (time, latitude, longitude, altitude and speed), the device name stored in the file, and a summary computed from it (distance, duration, speeds and an estimated split into gaits). See Section 3c.
• Heart rate — only if a ride file you import contains heart-rate readings and you tick the option to keep them. Heart rate is health data, a special category under GDPR Art. 9; without that tick it is discarded during the import and never stored.

Location is collected only for ride routes. The mobile app uses your device's location only while you are recording a ride that you started yourself, and stops when you stop the recording. The apps do not use location at any other time, we do not use it for advertising, and we never sell it.

3a. Mobile Applications (Android & iOS)

The StudPulse mobile apps handle the same data as the web application, described above. They additionally ask your device for the following permissions. Each is optional, each is requested only at the moment the feature is first used, and the app remains usable if you decline:

Permission	Why it is requested	What leaves your device
Microphone	Dictating notes and speaking to the AI Barn Agent	The recording, sent for transcription to Microsoft Azure through OpenRouter (Section 5a), and only after you have agreed to the AI features. We keep the text, not the audio.
Camera & photo library	Attaching photographs to horse records, expenses and events	Only the images you explicitly choose to attach.
Notifications	Lesson reminders, booking requests and horse care alerts	A device registration token, used solely as a delivery address.
Location	Recording the route of a ride that you start yourself, also while the screen is locked. For as long as the recording runs, your phone shows that location is in use.	The points of the ride (time, position, altitude, speed), sent to our servers in parts during the ride and saved to the training session when you finish it. Nothing is sent when you are not recording.

The apps are not advertising-supported. We do not use advertising identifiers, we do not track you across other companies' apps or websites, and we do not sell or share personal data for advertising purposes.

Deleting your account from the app: open your profile menu → Account → Delete account (or your profile menu → Security → Delete account tab) → Delete my account, then confirm with your password and by typing the confirmation word. The account is anonymised immediately. This permanently deletes your name, email address, phone number, password and profile photo, your devices and push notification tokens, your two-step verification data, all your conversations with the AI assistant (including their full text and your voice transcripts), your personal activity log and your access to every barn. Invoices and payment records, the barn's own operating records, and technical AI usage counters (token counts and cost, no content) are kept with your name removed. If you are the only administrator of a barn, deleting your account also closes that barn: nobody can sign in to it any more, and its records are kept (for example invoices, which the law requires us to retain). To keep the barn running, first make somebody else its administrator. Full details of what is deleted and what is retained are on the account deletion page.

3b. Informational Listings in the Stud Directory

Our public directory of equestrian facilities on studpulse.com also includes informational listings: profiles we prepared ourselves for facilities that do not use StudPulse, so that riders can find stables, riding schools and studs in one place. Each of these is clearly labelled on its page as an informational listing.

• Source — the facility's own public website. We do not buy data, and we collect nothing from social networks or review platforms.
• Purpose — a directory of equestrian facilities for riders.
• Legal basis — our legitimate interest in running that directory, and riders' interest in finding a facility (GDPR Art. 6(1)(f)). We publish only business contact details that the facility itself makes public.
• What is shown — the facility's name, its locality, a short description written in our own words from the content of its website, and its public business contact details: phone number, email address and website.
• What is not shown — no ratings or reviews, no photographs or logos, and no names of individual people.
• Taking over a listing — the facility can take the listing over with the “This is my stable” link on its profile. We confirm the request with a code sent only to the phone number or email address shown on the listing, and every takeover is approved by our team. The details given in a request are used only to handle it (and, once approved, to set up the account); they are deleted from the request record 180 days after it is decided.
• Removal — the facility can have the listing removed at any time with the “Report an error or remove this listing” link on its profile, or by writing to support@studpulse.com. A removed listing leaves the directory immediately; we keep only the facility's name and an internal reference so that it is not listed again.

We do not contact listed facilities on our own initiative: a message is sent only when someone uses the takeover or removal form. You can also object to this processing under GDPR Art. 21 by writing to the address above.

3c. Ride Routes and the Live Ride View

A ride route shows where a person rode, so we treat it as personal data of the rider, even though it is saved in the horse's training records.

• Sources — a ride file you import (GPX or TCX; we read it once and do not keep the original file), or a recording made with your phone's GPS in the StudPulse app. During a recording every position is first saved on your phone, so a lost signal or a closed app loses nothing; that copy is removed from the phone once the ride has been saved or discarded. Positions less accurate than 25 metres are discarded.
• Who sees the route — the barn's administrators and staff, the person who recorded or imported the ride, the rider, the person who created the training session or is assigned to it, and the horse's owner (a client paying for its boarding). Everyone else who can see the training session sees only the summary (distance, duration and gaits), without the map and without heart rate.
• Live ride view — off by default. If the rider switches it on before starting a recording, the people listed above can follow the ride's current position while it is in progress. It ends when the recording ends and is never shown to anyone outside the barn.
• Heart rate — stored only with your explicit consent, given by ticking the option during the import (GDPR Art. 9(2)(a)), and shown only to the people who see the route. You can withdraw that consent by deleting the route from the training session.
• Deletion — the person who added a route, and anyone allowed to edit the training session (such as the barn's staff), can delete the route at any time. When you delete your account, we erase the route and heart rate of every ride you uploaded or rode, and any ride you were still recording; the summary stays in the horse's training record without them.

4. How We Use Your Data & Legal Basis (GDPR Art. 6)

Under the GDPR, we process your personal data only when we have a valid legal basis. The table below maps each processing activity to its specific lawful basis:

Processing Activity	Legal Basis (Art. 6)
Provide and operate the StudPulse platform (account creation, authentication, core features)	Contract performance — Art. 6(1)(b)
Power the AI Barn Agent (your messages, conversation history and barn records sent to the AI services described in Section 5a)	Consent — Art. 6(1)(a) (given in the app's AI consent screen before anything is sent; you can withdraw it at any time with the "AI features" switch in your Account settings)
Send push notifications for bookings, reminders, and care alerts	Consent — Art. 6(1)(a) (you explicitly opt in to push notifications)
Voice transcription and storage for AI Barn Agent commands	Consent — Art. 6(1)(a) (the same AI consent, plus your device's microphone permission; nothing is recorded until you press record)
Generate AI-powered dashboard summaries and analytics	Consent — Art. 6(1)(a) (generated only for users who have given the AI consent; the summary a barn's dashboard prepares overnight is generated only if one of the barn's administrators has given it)
Send transactional emails (password resets, invitation links, account notifications)	Contract performance — Art. 6(1)(b)
Send marketing or promotional emails (if any)	Consent — Art. 6(1)(a) (opt-in required; every marketing email includes an unsubscribe link in compliance with the CAN-SPAM Act)
Detect and prevent fraudulent or abusive use	Legitimate interests — Art. 6(1)(f) (securing the platform and its users)
Improve and develop new features	Legitimate interests — Art. 6(1)(f) (only anonymised, aggregated data is used for analysis)
Website analytics via Google Analytics 4	Consent — Art. 6(1)(a) (cookie consent banner shown to EU/EEA visitors; GA loads only after consent is given)
Verifying a mobile phone number, if you give one, with a one-time SMS code; the related records of verification attempts (time, IP address, number of attempts); limiting the number of accounts per phone number	Legitimate interest — Art. 6(1)(f) (security of the service and prevention of fake accounts). The number is not used for marketing
Recording and importing ride routes, and showing them to the people described in Section 3c	Contract performance — Art. 6(1)(b) (you start the recording or the import yourself)
Live ride view (sharing the current position of a ride in progress within the barn)	Consent — Art. 6(1)(a) (off by default; the rider switches it on before a ride and can leave it off for the next one)
Storing heart rate from an imported ride file	Explicit consent — Art. 9(2)(a) and Art. 6(1)(a) (the option is unticked by default)

5. Artificial Intelligence & EU AI Act Compliance

StudPulse is an AI-native platform. We adhere to the transparency and safety requirements of the EU AI Act:

• Consent First: No data is sent to any AI service until you have agreed to the AI features in the app. Section 5a lists what is sent, to whom and why.
• Where AI Processing Happens: AI requests are processed by OpenRouter, Inc. and the model providers it forwards them to, in the United States. These transfers outside the EEA are covered by the safeguards described in Section 7.
• No Storage, No Foundation Model Training: Every AI request is routed only to Zero Data Retention endpoints: the provider does not store the request or the response after returning it, and does not use them to train its models. Your voice transcripts, farm records, and personal data are used solely to answer your own organisation's requests.
• Risk Categorisation: The StudPulse AI Barn Agent qualifies as a "Minimal/Limited Risk" AI system under the EU AI Act. It assists with farm administration and data structuring — it does not perform biometric identification, affect legal eligibility, or produce legally binding decisions.
• Human Oversight: The AI does not make autonomous medical, legal, or financial decisions. All AI-generated suggestions (e.g., breeding dates, health alerts) require human-in-the-loop validation. You retain full ability to edit, override, or delete any AI-generated data.
• Data Processing Agreements: Every AI provider we use is bound by a Data Processing Agreement under GDPR Art. 28, restricting them to processing your data solely to provide the service to us.

5a. AI Services: What We Send, to Whom, and Why

The AI features of StudPulse — the AI assistant (Barn Agent), voice notes, spoken replies and the AI-written dashboard summaries — are provided by third-party AI services. Nothing is sent to them until you agree in the consent screen the app shows before you first use an AI feature; that screen explains what is sent and to whom. Your consent is personal to your account and is recorded on it together with its date. You can withdraw it at any time with the AI features switch in your Account settings; from then on no AI request is made for you. The summary a barn's dashboard prepares overnight is generated only if one of the barn's administrators has given consent.

Who receives the data. Every AI request goes from our servers to OpenRouter, Inc. (United States), an AI gateway, which forwards it to the provider that runs the model:

AI feature	Why it is used	Provider that receives the data
AI assistant (Barn Agent) chat	Answering your questions and, when you ask for it, adding or updating barn records	Open-weight (open-source) models run by Baseten, DeepInfra, Fireworks or Novita; if those are unavailable, a fallback model from Google (Gemini) or Microsoft (Azure, which serves OpenAI models)
AI-written dashboard summaries	Summarising what needs attention in the barn	The same as for the AI assistant
Safety check of each chat message	Checking that a message is a genuine barn-management request before it is answered	Google (Gemini)
Speech-to-text	Turning your voice recordings into text	Microsoft (Azure AI speech model)
Text-to-speech	Reading the assistant's replies aloud	Google (Gemini)
Search embeddings	Finding a past conversation when you ask the assistant to recall it, and searching the knowledge base	Google (Gemini)

What is sent. Only what the feature needs:

• your questions and messages, and the history of the conversation;
• voice recordings (audio), when you speak to the assistant or dictate a note;
• the barn records the assistant needs to answer you — horses, health and care, breeding, feeding, the calendar and bookings, and finances (finances only if your role in the barn can see them);
• names and roles of barn members (with an internal random identifier that tells apart people with the same name), when a question is about them — their email addresses and phone numbers are never sent to AI services, unless you type one into your question yourself;
• for dashboard summaries: aggregated figures about the barn — for example overdue care with horse names, pending bookings, foaling dates, revenue, expenses and costs per horse (only for roles that can see finances), training activity and service names.

Zero Data Retention. Every AI request — to the chat model, the safety check, the search embeddings, speech-to-text and text-to-speech — is routed only to Zero Data Retention endpoints: the provider does not store the request or the response after returning it, and does not use them to train models. Providers may keep technical metadata that does not include the content of the request, such as timestamps and usage, for billing and security. OpenRouter and the model providers receive the data only to produce the answer to that request.

Audited providers. Baseten, DeepInfra, Fireworks and Novita are each SOC 2 audited. Google and Microsoft operate under their own security certifications, including SOC 2 for Google Cloud and Microsoft Azure.

Equal protection. OpenRouter and the model providers process the data in the United States, outside the EEA. These transfers are covered by data processing terms and the European Commission's Standard Contractual Clauses (GDPR Art. 28 and 46), which require the recipients to protect your data at a level equivalent to the protection described in this policy. See Section 7.

6. Cookies & Analytics

We use Google Analytics 4 (property ID: G-G9WWE3TGC6) on our marketing website to understand visitor behaviour. In compliance with the ePrivacy Directive and GDPR, a cookie consent banner is displayed to visitors from the EU/EEA on their first visit. Google Analytics is only loaded after you have given explicit consent. You can withdraw consent or opt out at any time via the Google Analytics Opt-out Browser Add-on.

We also set functional cookies strictly necessary for authentication (JWT session management) and your language preference (studpulse_lang). These cookies do not track you across other websites and are set on the lawful basis of contract performance; they cannot be disabled without breaking the service.

Our marketing homepage embeds a promotional film hosted on YouTube (Google Ireland Limited). The film is not loaded when the page opens: you see a still image served from our own servers, and nothing is requested from Google until you press play. Pressing play loads the YouTube player from youtube-nocookie.com, which transmits your IP address to Google and may store information on your device; the lawful basis is your consent (GDPR Art. 6(1)(a)), given by that click. If you never press play, no data reaches YouTube. See Google's Privacy Policy.

The stable directory and the stable profiles on our website show a map. Its map tiles are loaded from tile.openstreetmap.org, operated by the OpenStreetMap Foundation (St John’s Innovation Centre, Cambridge, United Kingdom), as soon as such a page opens. Each tile request transmits your IP address, the map tile requested and your browser’s User-Agent and Referer headers to the OpenStreetMap Foundation, which uses them to deliver the tiles and to protect its service against abuse. No cookies are set for the map and no consent is requested for it: showing where a stable is located is part of the page you opened, so the lawful basis is our legitimate interest (GDPR Art. 6(1)(f)). The United Kingdom is covered by an EU adequacy decision. See the OpenStreetMap Foundation Privacy Policy.

The route map in the web application and in the mobile apps uses the same OpenStreetMap tiles. Opening the map of a ride sends the OpenStreetMap Foundation your IP address and requests for the tiles covering the route, and with them the area where the ride took place. The route itself is drawn on your device and is never sent to the OpenStreetMap Foundation. Here the lawful basis is contract performance (GDPR Art. 6(1)(b)): the map is the feature you opened.

7. Data Sharing & Sub-Processors

We do not sell your personal data. We share it only with the sub-processors and recipients listed below, and only to the extent necessary to operate the service. All sub-processors are contractually bound by Data Processing Agreements (DPAs) under GDPR Art. 28.

Category	Purpose	Data Processed	Processing Location
Cloud hosting & database	Application servers and data storage	All application data	European Union
AI gateway	OpenRouter, Inc. — receives every AI request and forwards it to the model provider (Section 5a); only after you have agreed to the AI features	The content of AI requests described in Section 5a: messages, conversation history, voice recordings, barn records, names and roles of barn members (never their email addresses or phone numbers)	United States
AI model hosting	Baseten, DeepInfra, Fireworks or Novita (each SOC 2 audited) — run the open-weight (open-source) models for the AI assistant and the AI-written dashboard summaries	The content of AI assistant and dashboard summary requests (Section 5a)	United States
AI models (Google)	Google LLC (Gemini) — safety check of chat messages, text-to-speech, search embeddings, and fallback model for the AI assistant and summaries	Chat messages, the assistant's replies, conversation content and knowledge-base text (Section 5a)	United States
AI models (Microsoft)	Microsoft Corporation (Azure) — speech-to-text of voice recordings, and fallback model for the AI assistant and summaries (OpenAI models served by Azure)	Voice recordings; the content of AI assistant and summary requests when used as a fallback (Section 5a)	United States
Website analytics	Marketing website statistics (consent-gated)	Anonymised usage statistics, truncated IP address	United States
Email delivery	Transactional email (password resets, invitations)	Email address, message content	European Union or United States
Push notification delivery	Delivering notifications to mobile devices (Google Firebase Cloud Messaging; on iOS, onward to Apple Push Notification service)	Device registration token, notification title and body	United States
Payment processing	Subscriptions, client payments and payouts (Stripe)	Name, email address, payment details. Card numbers are handled by the payment provider and never reach our servers.	European Union or United States
Bot protection	Cloudflare, Inc. — Turnstile bot protection on the sign-in and sign-up forms	IP address and technical data about the browser and device	United States
SMS delivery	Sending the one-time code that verifies a mobile phone number, if you give one (SMSAPI, LINK Mobility Poland sp. z o.o.)	Phone number, text of the message with the code	European Union (Poland)
Map tiles	Displaying maps in the stable directory and on stable profiles (OpenStreetMap Foundation, independent recipient; privacy policy)	IP address, requested map tile, browser User-Agent and Referer	United Kingdom

Where your data is processed: Our application servers and database are located in the European Union. Some supporting services — in particular AI processing, website analytics and email delivery — are operated from data centres in the United States. Which location applies depends on the specific capability being used.

International Data Transfers: Where data is transferred outside the European Economic Area (EEA), we ensure an adequate level of protection through Standard Contractual Clauses (SCCs) approved by the European Commission, or by relying on the EU-U.S. Data Privacy Framework (DPF) where applicable (GDPR Art. 44–49). This includes the AI recipients listed above: OpenRouter and the model providers it forwards requests to are required to protect your data at a level equivalent to that guaranteed in the EEA.

The AI recipients are named individually above and in Section 5a. A current list of the other individual sub-processors we use is available on request from support@studpulse.com.

8. Data Retention

We retain data only as long as necessary for the purposes described in this policy:

Data Category	Retention Period
Account data (name, email, organisation)	Until account deletion + up to 90 days for deletion processing
Horse & farm records, event logs	Until account deletion + up to 90 days
AI conversation history (Barn Agent threads)	Deleted when you delete your account; users may delete individual threads at any time
Voice transcriptions	Transcripts in AI conversations are deleted with your account. The transcript of a voice note that became a barn record stays part of the barn's records, without your name once your account is deleted
Your consent to the AI features (and its date)	Until you withdraw it or delete your account
Push notification tokens	Until subscription is revoked by the user or browser, or on account deletion
Device & technical logs (IP addresses, error logs)	90-day rolling window
Google Analytics data	14 months (per GA retention settings); subject to Google's Privacy Policy
Anonymised aggregated statistics	Indefinite (cannot be linked back to any individual)
Mobile phone number	Until the account is deleted
SMS verification codes and the log of sent codes	A code is valid for 10 minutes and is stored only as a keyed hash; the log of sent codes (number, IP address, time, attempts) is kept for up to 30 days
Ride routes and heart rate	Kept with the training session, like the barn's other horse and farm records; erased earlier if the route is deleted from the session, or when the account of the person who uploaded or rode it is deleted
Positions sent during a ride recording	Deleted when the ride is saved. A recording with no signal for 12 hours is closed, and deleted together with its positions 7 days after it was closed
Positions stored on your phone during a ride recording	Removed from the phone once the ride has been saved to our servers or discarded

9. Your Rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar data protection law, you have the right to:

• Access (Art. 15) — request a copy of the personal data we hold about you.
• Correction (Art. 16) — ask us to correct inaccurate or incomplete data.
• Deletion (Art. 17) — request that we delete your personal data ("right to be forgotten"). You do not have to ask: you can delete your own account at any time from your profile menu → Account → Delete account (or Security → Delete account) in the app or the web application. See the account deletion page for exactly what is removed and what we are legally required to retain.
• Portability (Art. 20) — receive your data in a structured, machine-readable format (JSON or CSV).
• Objection (Art. 21) — object to processing based on legitimate interests (Art. 6(1)(f)).
• Restriction (Art. 18) — request that we restrict processing in certain circumstances.
• Withdraw Consent — where processing is based on consent (e.g., the AI features, push notifications, voice transcription, GA cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing. Consent to the AI features is withdrawn with the AI features switch in your Account settings.
• Automated Decision-Making (Art. 22) — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The StudPulse AI Barn Agent provides suggestions only and never makes binding automated decisions; a human is always in the loop.
• Lodge a Complaint (Art. 77) — you have the right to lodge a complaint with your national data protection supervisory authority. A list of EU supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu.

To exercise any of these rights, contact us at support@studpulse.com. We will respond within 30 days and, in complex cases, within 90 days with advance notice of the extension.

10. Security

We protect your data using industry-standard measures:

• All data is transmitted over HTTPS (TLS 1.2+).
• Passwords are hashed with bcrypt and never stored in plain text.
• API access requires short-lived JWT access tokens (30-minute expiry) and rotating refresh tokens (7-day expiry).
• Strict data isolation ensures users can only access data belonging to their own organisation.
• Data Breach Notification: In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33). If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (GDPR Art. 34).

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it responsibly to support@studpulse.com.

11. Children's Privacy

StudPulse is a B2B and professional tool not directed at children. We do not knowingly collect personal data from minors.

• EU/EEA (GDPR Art. 8): Users must be at least 16 years of age (or have verifiable parental/guardian consent where applicable national law permits a lower age, with a minimum of 13). Where we become aware that data from a child under 16 has been collected without appropriate consent, we will delete it promptly.
• United States (COPPA, 16 CFR Part 312): We do not knowingly collect personal information from children under 13 years of age. If you believe a child under 13 has provided us with personal information, contact us at support@studpulse.com and we will delete it immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or a notice within the application at least 30 days before the changes take effect.

13. Contact & Governing Law

For privacy-related questions, data requests, or to exercise your rights, contact us at:
support@studpulse.com

This Privacy Policy and any disputes arising from it are governed by the laws of the European Union and the Republic of Poland (as the jurisdiction of the Data Controller). This does not affect your right to bring proceedings before your local supervisory authority or courts under applicable data protection law.

14. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

• Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete — request deletion of your personal information, subject to certain exceptions (e.g., completing a transaction, security purposes, legal obligations).
• Right to Correct — request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing — We do not sell your personal information and do not share it for cross-context behavioural advertising. You do not need to opt out, but you may contact us at support@studpulse.com to confirm this in writing.
• Right to Limit Use of Sensitive Personal Information — We do not use or disclose sensitive personal information beyond the purposes permitted by the CPRA.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive a different level of service or be charged different prices.

Categories of Personal Information Collected (CCPA categories): Identifiers (name, email address, IP address); Commercial information (subscription plan); Internet or other electronic network activity (usage logs, pages visited); Audio/electronic data (voice transcripts, if consented); Inferences drawn (AI-generated farm summaries).

Shine the Light (California Civil Code § 1798.83): California residents may request once per year a list of categories of personal information disclosed to third parties for direct marketing purposes. StudPulse does not disclose personal information for third-party direct marketing purposes.

To exercise any of your California rights, contact us at support@studpulse.com with the subject line "California Privacy Request". We will respond within 45 days (extendable by a further 45 days with notice).

15. Nevada Residents

Nevada Revised Statutes Chapter 603A gives Nevada residents the right to opt out of the "sale" of certain personal information to third parties. StudPulse does not sell personal information as defined by Nevada law. If you have questions or wish to submit a request, contact us at support@studpulse.com.