Privacy Policy
Last updated: 18 October 2026
This Privacy Policy explains how RY Studies collects, uses and protects your personal data when you use our website (rystudies.com), our learning platform (practice.rystudies.com) and related services (the “Service”).
Who is responsible for your data (the controller): RY Studies is a trade name of Iana Golovanova, a sole proprietor (eenmanszaak) established in the Netherlands, registered with the Netherlands Chamber of Commerce under number 42080594, VAT number NL005484505B49, registered address De Peppels 28, 1402 KV Bussum, the Netherlands.
Contact for any privacy question or request: [email protected]
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Dutch data-protection law.
1. What data we collect
You give us:
- Account data — name, email address, password (stored hashed), language preference, and the ACCA paper(s) you study.
- Payment data — handled by Stripe. We receive confirmation of payment, the last four digits and type of card, billing country and amount; we do not store full card numbers.
- Content you create — your written answers, practice attempts, mock results, and the messages you exchange with Asya (your AI tutor).
- Communications — emails and support messages you send us.
- Optional — an ACCA student number, if you choose to provide it (for example, to verify a Pass Guarantee claim or to use an exam-result service).
We collect automatically:
- Usage and learning data — questions attempted, scores, your mastery map, time on tasks, and similar analytics used to personalise your study.
- Technical data — IP address, device and browser type, and approximate location (used for security, fraud prevention, and to determine the correct VAT and sanctions status).
- Cookies and similar technologies — see our Cookie Policy.
2. Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account; provide the courses, practice, AI marking and Asya | Performance of a contract |
| Process payments and prevent payment fraud | Performance of a contract; legitimate interests |
| Personalise your study (mastery map, weak-area analysis) | Performance of a contract |
| Send service emails (e.g. receipts, account notices) | Performance of a contract |
| Send marketing emails about RY Studies | Consent (you can unsubscribe at any time) |
| Website analytics cookies (advertising tracking is currently off) | Consent (via the cookie banner) |
| Keep tax and accounting records | Legal obligation (Dutch law requires 7 years) |
| Security, prevent abuse, prevent refund/Pass-Guarantee abuse, sanctions screening | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have balanced them against your rights; you may object (see §7).
3. The AI tools (Asya and AI marking) and your data
3.1 When you use Asya or submit a written answer for AI marking, the text you provide (your message or answer), together with relevant study context (such as the current question and your progress), is sent to our third-party AI provider to generate a response or a mark.
3.2 We currently use Anthropic (Claude) for this, via its commercial API. Under Anthropic’s commercial terms, your inputs and outputs are not used to train Anthropic’s models by default, and Anthropic applies short operational retention. We may use additional or alternative AI providers in future and will keep this Policy updated.
3.3 International transfer. Our AI provider may process this data outside the EEA (including in the United States). Where that happens, the transfer is protected by appropriate safeguards — Standard Contractual Clauses and/or a recognised adequacy mechanism — under a data-processing agreement.
3.4 AI marking is formative. AI-generated marks and feedback are study aids, not authoritative assessments, and do not produce legal or similarly significant effects. You can flag any AI mark, give your own view and ask us to review it (see also our Terms, clause 4).
3.5 Please don’t put other people’s data into the AI tools. Asya is for your studies. Do not enter other people’s personal data or confidential information.
4. Who we share data with (our processors)
We do not sell your personal data. We share it only with service providers (“processors”) who help us run the Service, under contracts that require them to protect it:
| Provider | Purpose | Location / transfer safeguard |
|---|---|---|
| Vercel | Website/app hosting | EU/US — SCCs where applicable |
| Supabase | Database and authentication (account, learning data) | EU region (Germany/Ireland) |
| Anthropic | Asya and AI marking | US — SCCs / DPA; not used for training |
| Stripe | Payment processing | EU/US — SCCs; PCI-DSS certified |
| Resend | Transactional and account emails | US — SCCs |
| Cloudflare | Marketing website hosting and delivery | Delivers rystudies.com pages and assets; processes connection and security data. |
| Google (Analytics & Ads — when enabled) | Google Analytics 4 page views and selected action clicks, only with your analytics consent. Advertising storage and personalisation are currently disabled on this marketing site | US — SCCs; Google Consent Mode v2 |
We may also disclose data where required by law, to enforce our Terms, to prevent fraud or harm, or in connection with a business transfer.
5. International transfers
Your core account and learning data are stored in the EEA (Supabase EU region). Some processors are based outside the EEA (for example in the US). Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses, recognised adequacy decisions (such as the EU–US Data Privacy Framework where a provider is certified), and additional safeguards as appropriate. You can ask us for more detail at [email protected].
6. How long we keep your data
Marketing-site analytics cookies expire no later than 180 days after creation and are not renewed on every visit. Our consent-choice cookie lasts 12 months. Google Analytics is configured for two-month user-level and event-level retention, without renewal on new activity; aggregated standard reports may remain longer. Cookie expiry and server-side retention are separate. You can request information about or deletion of identifiable analytics data by contacting us; withdrawing consent stops future collection but does not automatically erase earlier data.
- Active accounts — for as long as your account is open.
- Asya chat history and learning data — kept while your account is active and deleted 12 months after your last login.
- If you ask us to delete your data (erasure) — we delete your personal data, except that we retain your email address for 12 months to prevent abuse (for example, repeated purchase-and-refund cycles), based on our legitimate interests.
- After a refund — we retain the related account data for 12 months and then delete it; during that period we may decline to sell to the same email address.
- Tax and accounting records (invoices, payments) — 7 years, as required by Dutch law.
- Backups — purged on a rolling cycle.
7. Your rights
Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data (“right to be forgotten”); restrict or object to processing; data portability; and to withdraw consent at any time (for marketing or cookies) without affecting prior processing.
To exercise any right, email [email protected]. We will respond within one month. As noted in §6, after an erasure request we keep only your email address, for 12 months, to prevent abuse.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.
8. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls and EU-based storage of core data. No system is completely secure; if a data breach affects your rights, we will notify you and the supervisory authority where the law requires.
9. Children
The Service is for users aged 16 and over and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to this Policy
We may update this Policy. If changes are material, we will notify you (for example by email or a notice on the Service). The “Last updated” date shows the current version.
RY Studies — a trade name of Iana Golovanova · KvK 42080594 · VAT NL005484505B49 · De Peppels 28, 1402 KV Bussum, the Netherlands · [email protected]