Privacy Policy

NILA (“NILA”, “we”) operates the service at nilastudy.com and is the controller of the personal data described here. For anything about your data, write to [email protected].

• Account. Your name, email address and a hashed password. If you sign in with Google or Apple, we receive your name, email address and that provider’s identifier for you — never your password with them.
• Your material. The files and text you upload to make cards from: PDFs, slides, Word documents, photographs of notes, audio and video recordings, and whatever personal data they happen to contain.
• Your study data. Decks, cards, tags, every answer you give and when, scheduling state, exam dates, settings and questions you put to Ask AI.
• Subscription. Your plan, its renewal date and your Stripe customer identifier. Card numbers and other payment details go to Stripe directly; we never see or store them.
• Education discount. The university email address you ask us to verify.
• Support and reports. Messages you send us and cards you report.
• Technical data. IP address, browser type, timestamps and error logs, kept to run and secure the service.

• To provide the service — create your account, turn your material into cards, schedule reviews, show statistics, take payment (performance of our contract with you).
• To keep the service secure, prevent abuse, fix faults and understand in aggregate how it is used (our legitimate interest).
• To send service email: address verification, password reset, receipts and notices about your subscription (contract). We do not send marketing email without your consent.
• To meet legal duties such as tax and accounting records (legal obligation).

Cards are generated by sending the relevant parts of your material to AI model providers, who process it on our behalf to return the result. Depending on the file, these are OpenAI, Google (Gemini), Anthropic, Mistral AI, Inception Labs, Baseten, Nebius and TypeSafe. We use their business API services rather than consumer products, and we do not permit them to use your content to train their models where their terms give us that choice.

We do not use your material to train models of our own, and we do not sell it or share it for advertising. Do not upload material you are not allowed to share with a processor, such as confidential documents or other people’s sensitive data.

• Railway — application hosting, database and file storage (EU region).
• Stripe — payments, invoices and the customer portal.
• Brevo — delivery of service email.
• Google and Apple — sign-in, if you choose it.
• The AI providers named in the previous section.

Each acts under a data-processing agreement. We disclose data to authorities only when the law requires it.

Some of these providers are in the United States or process data there. Where that happens, the transfer relies on the EU–US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

• Account, material and study data: for as long as your account exists.
• After you delete your account: removed from the live service within 30 days, and from backups within a further 30 days.
• Intermediate generation files: deleted automatically, normally within 30 days.
• Invoices and payment records: as long as tax and accounting law requires.
• Server logs: up to 90 days.

We set only the cookies the service needs: one that keeps you signed in, and your language and interface preferences stored in your browser. We use no advertising or cross-site tracking cookies. Stripe sets its own cookies on its checkout and portal pages.

Under the GDPR you may ask us for access to your data, its correction, its deletion, a copy in a portable format, and restriction of or objection to processing based on legitimate interest. You can export your decks and delete cards and decks from inside the app; to delete your account, or for anything else, write to [email protected] and we will answer within one month.

You may also complain to your local data-protection authority, or to the Hungarian authority (NAIH, naih.hu).

NILA is meant for people aged 16 and over. If you are younger, use it only with the consent of a parent or guardian. If we learn that we hold data of a child without that consent, we delete it.

Traffic is encrypted in transit, passwords are stored only as hashes, and access to production systems is limited to the people who run them. No system is perfectly secure; if a breach affects your data, we will tell you and the authority as the law requires.

When this policy changes in a way that matters, we will say so in the app or by email before the change takes effect. The date at the top shows the current version.