Privacy Policy

Introduction

Savantli (“Savantli,” “we,” “us,” or “our”) operates as the data controller for personal information collected through the Savantli platform, website, and related services (collectively, the “Service”). This Privacy Policy describes how we collect, use, disclose, store, and protect your personal information, and your rights in relation to that information.

We are committed to transparency about our data practices and to protecting the privacy of all users, with particular care for Student data given the educational context of the Service.

This Privacy Policy applies to all users of the Service. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

Savantli is the data controller responsible for the personal information described in this Privacy Policy. This means we determine how and why your personal information is processed. Our contact information for privacy matters is:

Privacy Contact: privacy@savantli.com
Legal Contact: legal@savantli.com
Website: savantli.com

We have appointed a privacy contact who can be reached at privacy@savantli.com for any questions, requests, or complaints regarding our handling of your personal information.

2. Information We Collect

2.1 Information You Provide Directly

Account Registration Data: Name, email address, password (stored as a one-way cryptographic hash — your plaintext password is never stored or accessible), and account role (Mentor or Student).

Profile Data: Any optional profile information you choose to add, such as a display name or profile photo.

Classroom Data (Mentors): Classroom name, description, niche category, and configuration settings you provide when creating a Classroom.

Assignment Content (Mentors): All Assignment content you create, including questions, answer options, correct answers, grading rubrics, instructions, hints, and any media files uploaded. This content is stored on your behalf to provide the Service.

Submission Content (Students): Written responses, uploaded photographs, quiz answers, and any other content you submit in response to Assignments. This content is stored to enable grading, grade history, and leaderboard calculations.

Payment Data: When subscribing to a paid plan, your payment is processed directly by Stripe. We receive only limited payment summary data from Stripe: last four digits of your card, card brand, and expiration date. We never store, transmit, or have access to your full card number, CVV, or bank account details.

Communications Data: Content of emails, support requests, or other communications you send to us.

2.2 Information Collected Automatically

Log and Technical Data: IP address, browser type and version, operating system, referring URLs, pages accessed, timestamps, and other standard server log information.

Usage Data: How you interact with the Service, including features accessed, Assignments created or completed, submission timing, and similar behavioral data used to improve the Service.

Device Information: Device type, operating system version, and browser characteristics.

Authentication Data: Session tokens and authentication state necessary to maintain your logged-in status.

2.3 Information from Third Parties

Stripe: Payment status, subscription status, billing history, and dispute data.

Supabase: Database operation metadata and authentication event logs.

3. How We Use Your Information and Our Legal Basis

We process your personal information only when we have a valid legal basis to do so. The following describes our processing purposes and the legal basis for each:

Contract Performance (necessary to provide the Service you have contracted for)

• Creating and maintaining your account
• Enabling Mentors to create and manage Classrooms and Assignments
• Enabling Students to join Classrooms and complete Assignments
• Processing grades, leaderboard calculations, and achievement card generation
• Processing subscription payments and managing billing
• Delivering transactional emails (assignment notifications, grade alerts, grading reminders)

Legitimate Interests (processing necessary for our or your legitimate interests, where those interests are not overridden by your rights)

• Analyzing usage patterns to improve the Service
• Detecting and preventing fraud, abuse, and security threats
• Enforcing our Terms of Service and Acceptable Use Policy
• Maintaining Service security and integrity
• Communicating with you about significant changes to the Service

Legal Obligation

• Complying with applicable laws, regulations, and valid legal process
• Retaining payment records for tax and accounting purposes
• Responding to lawful government requests

Consent (where you have given us specific consent)

• Sending marketing or promotional communications
• Processing data in any other manner disclosed at time of collection with your consent

You may withdraw consent at any time where consent is the basis for processing, without affecting the lawfulness of processing before withdrawal.

4. Automated Decision-Making and Profiling

4.1 Auto-Grading

The Service uses automated processes to grade multiple-choice quiz Submissions and to apply fallback grades to unreviewed written and photo Submissions after 72 hours. These automated decisions directly affect your grade records. We take the following safeguards:

• (a) Multiple-choice grading logic is transparent — the correct answers are configured by the Mentor and the algorithm is a straightforward comparison;
• (b) The 72-hour fallback grade of 70 is a fixed, published rule applied uniformly;
• (c) Grade history is accessible to you at any time through your account;
• (d) Errors in Mentor quiz configuration that result in incorrect auto-grading should be reported to the Mentor for correction.

4.2 Your Rights Regarding Automated Decisions

If you are located in the European Economic Area, you have the right under GDPR Article 22 to not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you. Where our auto-grading constitutes such processing, you have the right to: (a) request human review of an automated grade decision by contacting your Mentor; (b) express your point of view regarding the automated decision; and (c) contest the decision. Please note that Savantli's role in this process is limited — grade disputes are ultimately between you and your Mentor, and we can only provide grade history data to support such discussions.

4.3 Leaderboard Ranking

Leaderboard rankings are calculated automatically from grade data. Rankings are visible to Classroom members and are used for motivational purposes. Rankings do not constitute any professional, academic, or certified assessment.

5. How We Share Your Information

We do not sell, rent, or trade your personal information to any third party for their own marketing or commercial purposes. We share information only as described below.

5.1 Within the Service

Mentor-Student Data Sharing: When a Student joins a Classroom, the Mentor can access the Student's name, email address, grade history, Submission content, and leaderboard standing for that Classroom. Mentors may use this data only for legitimate educational purposes within the Classroom context. Mentors may not export, sell, or otherwise use Student data obtained through Savantli for any purpose other than operating their mentorship program through the Service.

Classroom Leaderboard: Student display names and overall grade averages are visible to all members of the same Classroom, including the Mentor and all enrolled Students.

5.2 Third-Party Service Providers

We share personal information with the following carefully selected providers under binding data processing agreements that require them to protect your information and prohibit them from using it for any independent purpose:

Supabase, Inc. — Database infrastructure, authentication, and file storage. Savantli's primary data storage provider. Privacy policy: supabase.com/privacy. Data may be processed in the United States.

Stripe, Inc. — Payment processing. We share your name, email, and subscription details with Stripe as necessary to process payments. Privacy policy: stripe.com/privacy. Data may be processed in the United States.

Resend, Inc. — Transactional email delivery. We share your email address and the content of transactional emails with Resend to deliver notifications. Privacy policy: resend.com/privacy. Data may be processed in the United States.

Vercel, Inc. — Web application hosting and infrastructure. Processes request data including IP addresses in connection with hosting the Service. Privacy policy: vercel.com/legal/privacy-policy. Data may be processed in the United States.

5.3 Embedded Third-Party Content

The Service may embed video content from YouTube (operated by Google LLC) and Vimeo, Inc. for educational purposes. When you interact with embedded video content, those platforms may independently collect viewing data, cookies, and usage information subject to their own privacy policies (policies.google.com/privacy for YouTube; vimeo.com/privacy for Vimeo). We do not control or receive this data. We recommend reviewing those privacy policies if you have concerns about their data practices.

5.4 Business Transfers

If Savantli undergoes a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of its assets, your personal information may be transferred as part of that transaction. We will notify you by email and prominent notice on the Service at least 30 days before your information is transferred to a different privacy policy.

5.5 Legal Disclosure

We may disclose personal information if we believe in good faith that disclosure is reasonably necessary to: comply with applicable law, regulation, or valid legal process; enforce our Terms of Service; protect the rights, property, or safety of Savantli, our users, or the public; or respond to an emergency involving risk to life.

6. Student Data Protections

6.1 Our Commitment to Student Privacy

We recognize the particular sensitivity of Student educational data. We take the following specific steps to protect Student information:

• (a) Student Submission content (written responses, photos) is accessible only to the submitting Student and the Mentor who owns the Assignment. Other Students in the same Classroom cannot view another Student's Submission content or detailed grade breakdown — they can only see overall grade averages on the leaderboard.
• (b) We do not sell Student data to any third party under any circumstances.
• (c) We do not use Student personal information for targeted advertising.
• (d) We do not use Student data to build profiles for commercial purposes unrelated to providing the Service.

6.2 FERPA

To the extent the Service is used in connection with educational institutions subject to the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, we agree to comply with FERPA requirements applicable to school officials with legitimate educational interest. Mentors who are educational institutions or act on behalf of educational institutions are responsible for ensuring their use complies with FERPA, including obtaining necessary authorizations.

6.3 COPPA Compliance

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take immediate steps to delete that information. If you believe a child under 13 has provided us with personal information, contact privacy@savantli.com immediately.

6.4 Mentor Obligations Regarding Student Data

Mentors agree that they:

• (a) will use Student data obtained through Savantli only for legitimate educational purposes within the context of their Savantli-based program;
• (b) will not export, sell, disclose, or otherwise share Student data obtained through Savantli with any third party;
• (c) will comply with all applicable laws regarding the privacy of minor students if their Classroom includes users under 18; and
• (d) will obtain any necessary parental consent before sharing or publishing Student achievement cards that identify individual Students by name.

7. Data Retention

Active Accounts: We retain personal information for as long as your account is active or as needed to provide the Service.

Closed Accounts: Upon account closure, we retain personal data in active systems for 30 days to facilitate data export requests. After 30 days, personal data is deleted from active systems. Residual copies in encrypted backup systems are deleted within 90 days after deletion from active systems.

Payment and Transaction Records: Retained for 7 years as required by tax and accounting regulations.

Inactive Accounts: Accounts with no login or usage activity for 24 consecutive months may be deactivated. We will send email notice 60 days and again 14 days before deactivation. Data from deactivated inactive accounts is deleted within 30 days of deactivation.

Legal Holds: We may retain information beyond standard retention periods where necessary for establishing, exercising, or defending legal claims, or where required by applicable law.

8. Your Privacy Rights

Depending on your location, you have certain rights regarding your personal information. We honor these rights for all users regardless of location.

8.1 Right to Access

Request a copy of the personal information we hold about you. Most account information is accessible directly through your account settings.

8.2 Right to Correction

Correct inaccurate or incomplete information. Most account information can be updated directly in your account settings.

8.3 Right to Deletion

Request deletion of your personal information. Contact privacy@savantli.com. Some information may be retained as required by law or our retention policy.

8.4 Right to Data Portability

Receive a copy of your personal information in a structured, machine-readable format (JSON or CSV). Contact privacy@savantli.com to request an export.

8.5 Right to Restriction

Request that we restrict processing of your information in certain circumstances.

8.6 Right to Object

Object to processing based on legitimate interests, including direct marketing. To opt out of marketing emails specifically, click the “Unsubscribe” link in any marketing email or contact privacy@savantli.com.

8.7 Rights Regarding Automated Decisions

As described in Section 4 above.

8.8 California Residents (CCPA/CPRA)

California residents have the right to: know what personal information we collect and how we use and share it; delete personal information (subject to exceptions); correct inaccurate personal information; opt out of the sale or sharing of personal information (we do not sell personal information); non-discrimination for exercising privacy rights; and limit use of sensitive personal information. To exercise California rights, contact privacy@savantli.com with “California Privacy Request” in the subject line.

8.9 European Residents (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have rights under the GDPR or applicable equivalent, including access, rectification, erasure, restriction, portability, and the right to object. You also have the right to lodge a complaint with your national data protection authority. Our lawful bases for processing are described in Section 3. To exercise GDPR rights, contact privacy@savantli.com with “GDPR Request” in the subject line.

8.10 Responding to Requests

We will respond to privacy rights requests within 30 days. We may need to verify your identity before fulfilling a request. We will not discriminate against you for exercising your privacy rights.

9. International Data Transfers

Savantli is based in the United States. Our service providers operate in the United States and potentially other countries. If you access the Service from outside the United States, your personal information will be transferred to, stored, and processed in the United States and potentially other countries that may have different data protection laws than your home country.

For transfers of personal information from the European Economic Area, United Kingdom, or Switzerland to the United States or other countries without an adequacy decision, we rely on Standard Contractual Clauses approved by the European Commission as the transfer mechanism. Copies of applicable Standard Contractual Clauses are available upon request at privacy@savantli.com.

10. Cookies and Tracking Technologies

10.1 Essential Cookies

These are strictly necessary for the Service to function and cannot be disabled. They include:

• Authentication session cookies that maintain your logged-in state
• Security cookies that protect against cross-site request forgery
• Preference cookies that remember your settings

10.2 Analytics

We use privacy-respecting analytics tools to understand aggregate usage patterns and improve the Service. These tools are configured to minimize personal data collection, do not share data with advertising networks, and do not create cross-site user profiles.

10.3 No Advertising Cookies

We do not use advertising or tracking cookies. We do not serve targeted advertisements through the Service.

10.4 Cookie Control

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in and using the Service. Disabling analytics cookies will not affect your ability to use the Service.

10.5 Do Not Track

There is currently no binding industry standard for Do Not Track signals. We do not currently alter our data collection practices in response to browser DNT signals, but we do not use advertising tracking in any event.

11. Security

We implement technical, administrative, and organizational security measures proportionate to the risks of processing your personal information:

Technical Measures

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for database storage
• One-way cryptographic hashing of passwords (bcrypt or equivalent)
• Row-level security policies restricting database access by user role
• Secure session management with token rotation

Administrative Measures

• Access to personal data limited to personnel who require it to perform their duties
• Contractual security requirements imposed on all third-party processors
• Regular review of access permissions

Organizational Measures

• Incident response plan for data security events
• Vendor security assessment process

No security system is impenetrable. We cannot guarantee absolute security. In the event of a data breach that is reasonably likely to result in risk to your rights and freedoms, we will notify you without undue delay and in any event within 72 hours of becoming aware, as required by GDPR Article 33, or as required by other applicable breach notification laws. Notification will include the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed to address the breach.

12. Marketing Communications

We may send you marketing communications about new Savantli features, offers, or related products if you have opted in or if permitted by applicable law. You can opt out of marketing emails at any time by:

• Clicking the “Unsubscribe” link in any marketing email
• Emailing privacy@savantli.com with “Unsubscribe” in the subject line
• Updating your notification preferences in your account settings

Opting out of marketing does not affect transactional emails required to operate your account, such as grade notifications, payment confirmations, and assignment alerts.

13. Children's Privacy

13.1 Age Limit

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

13.2 Students Ages 13-17

Students between 13 and 17 may use the Service with parental consent. Mentors who enroll minors in their Classrooms are responsible for: (a) ensuring they have obtained necessary parental consent; (b) ensuring their Assignment content is appropriate for minors; (c) maintaining appropriate professional boundaries; and (d) complying with all applicable laws regarding minors in their jurisdiction.

13.3 Parental Rights

Parents or legal guardians of minor users may contact privacy@savantli.com to: review personal information collected about their child; request correction or deletion of their child's information; or revoke consent for their child's continued use of the Service.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will update the “Last Updated” date when we do. For material changes, we will notify you by email to your account address and by prominent notice on the Service at least 14 days before the changes take effect. We encourage you to review this Policy periodically. Continued use of the Service after changes take effect constitutes acceptance.

15. Contact and Complaints

General Privacy Questions: privacy@savantli.com
Data Deletion or Export Requests: privacy@savantli.com (include “Data Request” in subject line)
Security Concerns or Breach Reports: security@savantli.com
Legal and Compliance: legal@savantli.com
General Support: support@savantli.com
Website: savantli.com

We will acknowledge privacy requests within 5 business days and will respond substantively within 30 days.

If you are located in the European Economic Area and believe your GDPR rights have been violated, you have the right to lodge a complaint with your national supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en.