Privacy Policy

1. What we collect

When you use BexE we collect:

• Account data: email, name, and (if you sign in with Google) your Google profile photo.
• Profile data you enter: country, curriculum, exams you're studying, and school (all optional).
• Study activity: practice sessions, battle history, flashcard reviews, ELO, and uploaded PDFs and notes.
• Billing data: handled by Paddle. BexE receives the subscription status and last four digits of the card only — we never see or store full card numbers.
• Technical data: IP address, browser, and basic device info, used for security and abuse prevention.

2. How we use it

• To provide the Service — practice sessions, battles, flashcards, notes, classrooms, and leaderboards.
• To personalize study recommendations and generate AI content you request.
• To bill you and prevent fraud, in cooperation with Paddle.
• To communicate service updates and support responses.

3. Who processes your data

BexE relies on the following subprocessors:

• Supabase — database, authentication, and file storage.
• Paddle.com Market Ltd. — merchant of record, checkout, and subscription billing.
• Google — Google Sign-In and Gemini AI models for flashcard and study-note generation.
• Cloudflare — hosting and edge delivery.

We do not sell your personal data and we do not use your uploaded study material to train third-party AI models.

4. Sharing inside classrooms

If you join a teacher's classroom, that teacher can see your name, submissions, and scores in that classroom. Friends you add can see your public profile (display name, country, curricula, and ELO).

5. Your rights

You can access and edit your profile, delete uploaded content, and request account deletion at any time from your profile page or by emailing ceo@bexedu.org. If you are in the EEA, UK, or a jurisdiction with similar rights (California, Brazil, Korea), you can also request a copy of your data or restrict processing.

6. Children

BexE is intended for students aged 13 and above. Teachers who invite students under the age of digital consent in their country must obtain any required parental consent before doing so.

7. Retention

We retain account and study data while your account is active. If you delete your account, we remove your personal data within 30 days, except where we must keep billing records for tax and accounting purposes.

8. Security

We use industry-standard measures — encrypted transport (HTTPS), row-level security on our database, and least-privilege access controls. No system is perfectly secure; please use a strong, unique password.

9. Contact

Privacy questions: ceo@bexedu.org.