Privacy Policy

Who We Are

The controller of your personal data is Artificially Educated Ltd, a company registered in England and Wales (company number 16183501), registered office 50a Clifford Way, Maidstone, Kent, ME16 8GD, England. ICO registration number: ZB897883.

For anything about your personal data, including access and deletion requests, email privacy@artificiallyeducated.com.

If you are in the EU, the EEA or Switzerland, you can also contact our representative there, DataRep. See Our Representative in the EU and Switzerland.

Summary

• We hold the data needed to run your account and your study tools: your email address, your study activity and the content you create.
• Our AI study features send your question, the relevant course material and, where the request needs it, your own study data to our AI providers (OpenAI and Google). We never send your email address or password.
• Progress tracking and AI features are switched on when you create an account. You can turn either off at any time in Settings > Privacy.
• Payments are handled by Stripe. We never see your full card details.
• Our servers are in the United States (AWS, US East). Transfers are protected by the safeguards described below.
• You can download your data from Settings and ask us to delete your account by email.

What We Collect and Why

For each type of data we list what it is, why we use it and our lawful basis under UK GDPR Article 6(1).

• Account and sign-in. Your email address, a unique account identifier and your password. Sign-in is run by Amazon Cognito, part of AWS: your password is held by Cognito and is never visible to us. If you sign in with Google or Apple, that provider tells us your email address and an account identifier. If you turn on two-factor authentication, Cognito stores the authenticator key and we record only whether it is on. Basis: contract (we need this to provide your account).
• Free Access week. When a new account starts its free week, we record the CAIA level you chose, when the week starts and ends, when you last studied (to time its reminders) and the link you signed up from. We also keep a one-way code derived from your email address, so we can see when the same mailbox starts more than one free week. The code cannot be turned back into your email address, we do not use it to identify you elsewhere, and it is deleted with your account. Basis: contract (providing the free week), and legitimate interests (preventing misuse of the free offer).
• Study activity and progress. The lessons and notes you complete, question and past-paper attempts (answers, scores and time taken), flashcard and list reviews, weekly planner items and daily mood check-ins, study streaks and points, and time spent on study pages. This powers your dashboard, progress charts, study plan and review scheduling. Basis: contract (personalised study tracking is a core part of the Service). Progress tracking is on by default. You can turn it off in Settings > Privacy. We then stop recording new progress data. Data already recorded stays in your account until you ask us to delete it or you delete your account.
• Content you create. Personal notes, highlights, flashcards, lists, essay answers and drafts, calendar items, display preferences (theme, layout, profile icon), and saved study records such as Test Me results, recall attempts and mistake log entries (with progress tracking on). Basis: contract.
• AI study features. These are the Cortex study assistant, essay marking, note explanations and summaries, mnemonics and study plans. When you use one, we send the AI provider your request and the course material it relates to. Where the request needs it, we also send relevant parts of your own study data, for example your notes, flashcards, progress, saved Cortex memories, your timezone and an internal account number. We do not send your email address, name or password. Your Cortex conversation is kept in your browser tab, not on our servers, unless you choose Save to note: the saved answer, chart or table, and the question it answered, are then stored in your notes like anything else you write. We store the results the features produce for you (such as essay feedback, generated flashcards and summaries) and usage counts so we can apply fair-use limits. Some features also keep a record of the request for troubleshooting. Basis: contract, and our legitimate interest in running and safeguarding the AI features. AI features are on by default; turn them off in Settings > Privacy and no further data is sent to AI providers.
• Cortex memory. Short notes you ask Cortex to remember (for example your exam date or a preferred explanation style). Cortex may suggest a memory; nothing is saved unless you accept it. You can view, edit, delete or switch off memory in Cortex or in Settings. Entries with an expiry date stop being used once they expire and stay visible to you until you delete them. Basis: contract.
• Payments. Checkout is provided by Stripe through its Managed Payments service. You enter your card and billing details directly with Stripe. We receive your subscription status, payment and invoice records, a Stripe customer reference and the billing details Stripe includes in its notifications to us (such as name, email address and country). We never receive your full card number. Basis: contract, and legal obligation (we must keep transaction records for tax and accounting).
• Account security. Sign-in, sign-out, consent-change and two-factor events with the IP address and browser details used. A security cookie recognises browsers you have signed in from before (see our Cookie Policy). We email you when two-factor authentication is turned on or off, and when your account signs in from a new browser. You can switch the new-browser alert off in Settings. Basis: legitimate interests (protecting your account and the Service).
• Server logs, rate limiting and regional pricing. Our servers record technical request data such as IP address, pages requested and time. To show prices in the right currency we look up your approximate country from your IP address using a database held on our own servers (MaxMind GeoLite2). Nothing is sent to MaxMind and we do not store the result. Basis: legitimate interests (security, preventing abuse and showing correct prices).
• Support and feedback. Messages you send through the in-app feedback form or by email, and our replies. Basis: legitimate interests (helping you and improving the Service), or contract where your request is about the service we provide to you.
• Sign-up email codes. Amazon Cognito emails you a verification code when you sign up and a code when you reset your password. Basis: contract.

We do not ask for your name, date of birth or postal address to create an account, and the Service is not designed to collect special category data. Please do not include sensitive personal information in notes, feedback or AI requests.

CAIA Exam Candidates Who Receive Our Emails

The CAIA Association^® (Chartered Alternative Investment Analyst Association^®, Amherst, Massachusetts) shares with approved preparation providers, including us, the email and mailing addresses of registered exam candidates who agreed when registering with CAIA to be contacted by third-party service providers.

• What we receive: your email address and mailing address.
• What we use it for: emails about AnalyticalMind, including access codes for free study summaries. We do not contact candidates by phone or text message.
• Basis: the consent you gave CAIA to be contacted by third-party exam preparation providers, and our legitimate interest in telling candidates about our Service.
• Opting out: every email includes a simple way to stop further emails from us. As our licence requires, a copy of each email we send to candidates also goes to CAIA.
• How long: we stop using the list, and delete it, when you opt out or when our agreement with CAIA ends, whichever comes first. If you opt out, we keep your email address on a suppression list so that we do not email you again.

Who We Share Data With

We use the service providers below to run the Service. They act on our instructions under contracts that protect your data, except where we say they act as an independent controller.

• Amazon Web Services (AWS): hosting, database, sign-in (Amazon Cognito), background processing and content delivery. US East (N. Virginia) region.
• OpenAI: AI model provider for our study features (United States). Requests are made through OpenAI's API with storage switched off, and API data is not used to train OpenAI's models.
• Google: Gemini AI models for some study features (United States), under API terms that do not allow your data to be used for training. Google Fonts are also loaded by your browser, and Google receives your data if you choose to sign in with Google.
• Apple: only if you choose to sign in with Apple.
• Stripe: payments, tax calculation, receipts and subscription management. Under Managed Payments, Stripe sells the subscription to you as merchant of record and acts as an independent controller of the payment data it collects, under the Stripe Privacy Policy.
• Mailjet (Sinch): sending security emails, and emails to CAIA exam candidates (European Union).
• Slack: internal alerts about billing events. These carry internal account and payment identifiers and amounts, never your name or email address.
• Cloudflare (cdnjs) and jsDelivr: deliver standard web libraries (icons, maths rendering and charts) to your browser, so they receive your IP address.
• Proton AG: our email inbox, if you email us (Switzerland).

We may also share personal data:

• with the CAIA Association where our licence requires it, for example to report attempts to share actual CAIA exam questions;
• with the CAIA Association for pass-rate reporting: if your email address was on a candidate list CAIA sent us and you also have an AnalyticalMind account, we may send CAIA that email address so it can tell us the pass rate of candidates who prepared with us. We do not send names or study data, and CAIA returns only aggregated pass rates, never individual results. Basis: legitimate interests (measuring how well the Service helps candidates). You can object by emailing us;
• with professional advisers, or where the law requires it, for example in response to a valid court order;
• with a buyer or successor if our business or the Service is sold or restructured, under equivalent protections.

International Transfers

We are a UK company, but our servers are in the United States and some providers process data in the US or elsewhere. When personal data leaves the UK or EEA, we rely on one of the following:

• the UK-US Data Bridge and the EU-US Data Privacy Framework, for recipients certified under them;
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses;
• the EU Standard Contractual Clauses;
• adequacy decisions (for example for Switzerland and the European Union).

Contact us for more information about the safeguard that applies to a particular provider.

How Long We Keep Data

• Account, Free Access, study, content and security data: kept while your account is active. When you ask us to delete your account, we delete it from our live systems within 30 days.
• Server request logs (including IP addresses): deleted automatically after 90 days.
• Backups: deleted data can remain in our backups for a limited period until they are replaced on their normal cycle. We do not restore deleted data from backups.
• Payment and invoice records: kept for six years after the end of the financial year they relate to, as UK tax law requires, even after account deletion.
• Support emails and feedback: kept for as long as needed to deal with your request and any follow-up, and deleted with your account.
• Cortex conversations: held in your browser tab only, and cleared when you close the tab or sign out. Answers you save to your notes are kept with your notes.
• Notes in Trash: kept for at least 30 days, then removed.
• Note history: earlier versions of a note (up to 50) are kept while the note exists; older ones are removed when you next edit it.
• CAIA candidate list: see the section on CAIA exam candidates above.

Your Rights

Depending on where you live, you have the right to:

• Access your data. You can download a copy of your account and study data, including your personal notes, highlights, note history dates, study records and mistake log, at any time from Settings > Privacy > Download My Data. For anything the download does not cover, email us.
• Rectify inaccurate data.
• Erase your data. Email privacy@artificiallyeducated.com from the address linked to your account (or use Settings > Account > Request Account Deletion). We cancel any active subscription and delete your account within 30 days, keeping only the records we must keep by law.
• Restrict or object to processing based on legitimate interests. You can always object to marketing emails, and we will stop.
• Data portability for data you gave us.
• Turn off progress tracking, AI features, Cortex memory and new-browser sign-in alerts in Settings at any time.
• Human review. Essay marks and other AI feedback are automated study aids. They have no legal or similarly significant effect, and they never affect your access, billing or official CAIA results. If you would like a person to look at an AI mark, contact us.

We respond within one month and may need to confirm your identity first. Exercising your rights is free. If you are unhappy with how we handle your data, please tell us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk), to your local data protection authority in the EU or EEA, or in Switzerland to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

US residents: we do not sell your personal information or share it for cross-context behavioural advertising. You may ask to know, access, correct or delete your personal information using the contact details above, and we will not treat you differently for doing so.

Cookies and Browser Storage

We use only cookies and browser storage needed to run the Service, keep you signed in and protect your account. There are no analytics or advertising cookies. Details are in our Cookie Policy.

Security

Connections to the Service are encrypted, secrets are kept in managed secret stores, and access to personal data is limited to the people who need it to run the Service. You can add two-factor authentication to your account in Settings. If a personal data breach puts your rights at risk, we will tell you and the ICO as the law requires.

Children

The Service is for adults preparing for professional examinations. You must be 18 or over to create an account, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

Changes to This Policy

We will update this policy when our practices change and show the date of the latest version at the top. For material changes, we will tell account holders by email or with a notice in the Service before the change takes effect.

Our Representative in the EU and Switzerland

Artificially Educated Ltd (trading as AnalyticalMind) has appointed Data Protection Representative Limited (trading as DataRep) as its data protection representative in the European Union and European Economic Area, for the purposes of the EU General Data Protection Regulation (EU 2016/679), and in Switzerland, for the purposes of the Federal Act on Data Protection (AS 2022 491).

If you are in the EU, the EEA or Switzerland, you can contact DataRep in your home country with questions about how we process your personal data, or to exercise your rights. Data protection authorities can also reach us through DataRep. You can:

• email datarequest@datarep.com, quoting "AnalyticalMind" in the subject line;
• use DataRep's online form at datarep.com/data-request; or
• write to DataRep at the address for your country below.

Address your letter to "DataRep", not to AnalyticalMind, or it may not reach them. Please mention AnalyticalMind in your letter. We may ask you to confirm your identity before we act on a request, so that your personal data is not given to anyone else.

• Austria: DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
• Belgium: DataRep, Rue des Colonies 11, Brussels, 1000
• Bulgaria: DataRep, 25 Vitosha blvd. Fl. 2, office 4, 1000, Sofia, Bulgaria
• Croatia: DataRep, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia
• Cyprus: DataRep, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus
• Czech Republic: DataRep, Platan Office, 28. Října 205/45, Floor 3&4, Ostrava, 70200, Czech Republic
• Denmark: DataRep, Lautruphøj 1-3, Ballerup, 2750, Denmark
• Estonia: DataRep, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia
• Finland: DataRep, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland
• France: DataRep, 72 rue de Lessard, Rouen, 76100, France
• Germany: DataRep, 3rd and 4th floor, Altmarkt 10 B/D, Dresden, 01067, Germany
• Greece: DataRep, Ippodamias Sq. 8, 4th floor, Piraeus, Attica, Greece
• Hungary: DataRep, 1054 Honved street, 8 1/2, Budapest, Hungary
• Iceland: DataRep, Laugavegur 13, 101 Reykjavik, Iceland
• Ireland: DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland
• Italy: DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy
• Latvia: DataRep, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia
• Liechtenstein: DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
• Lithuania: DataRep, 44A Gedimino Avenue, 01110 Vilnius, Lithuania
• Luxembourg: DataRep, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg
• Malta: DataRep, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta
• Netherlands: DataRep, De Nieuwe Erven 3 Unit – 15162, 5431 NV Cuijk, Netherlands
• Norway: DataRep, C.J. Hambros Plass 2c, Oslo, 0164, Norway
• Poland: DataRep, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland
• Portugal: DataRep, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061, Portugal
• Romania: DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857, Romania
• Slovakia: DataRep, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia
• Slovenia: DataRep, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia
• Spain: DataRep, Calle de Manzanares 4, Madrid, 28005, Spain
• Sweden: DataRep, S:t Johannesgatan 2, 4th floor, Malmo, SE - 211 46, Sweden
• Switzerland: DataRep, Leutschenbachstrasse 95, ZURICH, 8050, Switzerland

DataRep handles data protection matters only. For questions about your account, subscription or the Service, email support@analyticalmind.ai. You can also send privacy requests to us directly at privacy@artificiallyeducated.com. DataRep's privacy notice explains how it handles the personal data it receives.

Contact

Artificially Educated Ltd, 50a Clifford Way, Maidstone, Kent, ME16 8GD, England.
Email: privacy@artificiallyeducated.com