Privacy Policy

1. Who we are

NaomiStudy is an AI teacher for exam preparation, run by NaomiStudy in Indonesia ("we"). For the data described on this page we are the data controller. You can reach us at support@naomistudy.com.

2. What we collect

• Account: your email address, display name, and your password as a hash (never the password itself). If you sign in with Google, we receive your Google account ID, email, name, and profile photo. We never receive your Google password.
• Learning profile: your chosen language, learning style and depth, and any background you write yourself.
• Learning content: the exams and learning spaces you create (title, course, exam type and date), your answers while setting up an exam, the materials you upload or paste (photos, PDFs, slides, links, text), your conversations and answers with Naomi, notes, and whiteboard sketches. It also includes the study plans, explanations, quizzes and diagrams Naomi makes for you.
• Learning activity: for example which quizzes you answered and which parts you opened, with timestamps. We use it to continue your lessons and measure your progress.
• Exam pass payments (Rupiah) through Xendit: when you open the payment page we send your name and email to Xendit. We keep the amount, time, status, promo code and transaction ID. We never receive your card number, PIN, or bank or e-wallet details.
• Pro subscriptions (US dollars) through Polar: we receive your customer and subscription IDs, plan, status and billing period. Polar, not us, handles your card.
• Analytics: the pages you open, the buttons you press, where you came from (for example a TikTok link or campaign parameters), browser and device type, and your IP address (which can be used to estimate your country or city). We use PostHog for this.
• Session recordings: recordings of how you use a page (movement, clicks, scrolling and what is on screen) so we can find confusing or broken parts. What you type into fields is masked and passwords are never recorded. Text shown on screen, including your materials and lesson conversations, may be recorded.
• Notifications: the email choices you set in Settings → Notifications (exam reminder emails, and news and offers emails with the time you agreed to them), the reminders we show in the app or send by email (type, time, content, and whether you opened them), and your answer to "How did the exam go?".
• Testimonials: the story you write after an exam, the name you choose to show (first name or Anonymous), and the consent text you ticked with its time.
• Invite a friend: your personal invite code, who you invited or who invited you, the status, and reward codes. To prevent abuse we also keep a fingerprint (hash) of the invited account's email address (see section 6).
• Messages to us: if you contact us by email or WhatsApp, we keep the message and the contact you used.
• Technical logs: IP address, time and the address requested from our servers, for security and abuse prevention.

We do not ask for specific (sensitive) personal data such as health, biometric or criminal-record data. Please do not upload that kind of data, or other people's personal data, in your study materials.

3. Why we use it, and on what basis

• Running your account and the service: signing in, storing your learning spaces, and picking up where you stopped. Basis: performance of our agreement (the Terms).
• Teaching: building your study plan, writing explanations and quizzes, and grading your answers. The relevant parts of your learning content are sent to AI model providers for this. Basis: performance of our agreement.
• Processing payments and unlocking passes. Basis: performance of our agreement.
• Keeping transaction records. Basis: legal obligation under tax law.
• Improving the product through analytics and session recordings, and learning where users come from. Basis: legitimate interest. You can object (see section 7).
• Keeping the service secure, for example by limiting request rates and investigating abuse. Basis: legitimate interest.
• Reminding you of your exam: reminders 7, 3 and 1 day before, a nudge when you have not studied for a few days, and "How did the exam go?" the day after, in the app and by email. Basis: legitimate interest, because it helps you stay ready until exam day. You can turn reminder emails off at any time with the "Stop reminder emails" link in every email, or in Settings → Notifications.
• Running the invite-a-friend programme: recording who invited whom, giving rewards once the invited friend finishes their first topic, and preventing abuse (for example inviting yourself or signing up again with the same email). Basis: performance of our agreement and legitimate interest.
• Sending news and offers by email or WhatsApp, and showing your testimonial on our website and social media. We only do this with your separate consent: ticking "News and offers by email" in Settings, and ticking the consent box when you send a testimonial. You can withdraw that consent at any time.

Naomi grades your answers automatically to decide which parts you have mastered and what comes next. These grades only steer your lessons in NaomiStudy and are not official marks. If you think a grade is wrong, tell Naomi in that lesson or contact us.

We do not sell your personal data, we do not use your learning content for advertising, and we do not train AI models of our own on your data.

4. Who else processes your data

We use a few service providers. They process data on our instructions, and we try to send each one only what its task needs.

• AI model providers: receive the relevant parts of your learning content (materials, questions, answers and lesson context) to produce explanations, quizzes and grades. Your password and payment data are not sent to them.
• Web search service: when Naomi researches a topic, search keywords made from your study topic are sent to a search service. Your account data is not sent.
• PostHog: analytics and session recordings.
• Google: if you choose to sign in with Google, Google verifies your sign-in and gives us the profile data listed in section 2.
• Xendit: exam pass payments in Rupiah (for example QRIS, e-wallets and virtual accounts).
• Polar: Pro subscription payments in US dollars.
• Email delivery provider: sends reminder and notification emails on our behalf. It only receives your email address, first name, and the content of that email.
• Hosting: our API and database servers are in Indonesia. The website and web app are served by Vercel.
• Cloud storage: the files you upload and database backups are stored with a cloud storage service whose servers are in South Korea.

We may also disclose data when the law or an authorised agency requires it.

5. Transfers outside Indonesia

Some of the providers above process data on servers outside Indonesia, for example AI model providers, PostHog, Google, Polar, Vercel, our email delivery provider, and our cloud storage in South Korea. This means your data may be sent to and stored in countries whose data protection rules may differ from Indonesia's. We choose providers that have security and privacy policies, and only send the data this service needs.

6. How long we keep it

• Account and learning content: for as long as your account exists. A learning space you delete is removed right away, together with its materials.
• When you delete your account: your account, learning spaces, materials (including uploaded files), plans, explanations, quizzes, answers, notes and activity are deleted right away from the database and file storage.
• Backups: database backups are kept for at most 30 days and then deleted on a rolling basis. Deleted data may remain in a backup until that backup is deleted. Backups are only used to restore the system.
• Transaction records (amount, time, status, promo code, transaction ID, and notifications from payment providers) are kept for as long as Indonesian tax rules require, including after your account is deleted. Once the account is deleted they are no longer linked to it, but they may still contain data sent to the payment provider at the time, such as your name or email.
• Notification choices, reminder records, your "How did the exam go?" answers and your invite code: for as long as your account exists, and deleted with the account.
• Testimonials: for as long as your consent stands. If you withdraw it in Settings → Notifications, we mark the testimonial as withdrawn, stop using it, and take it down from our website and social media. We keep that mark (with the testimonial text) so we know what to take down, until your account is deleted. When the account is deleted, the testimonial and its consent record are deleted too.
• Email fingerprint for the invite programme: if an invited account is deleted, we keep a fingerprint (a hash made with a secret key) of that account's email address, without the name or the address itself, for at most 24 months after the invite, and then it is deleted automatically. Its only purpose is to stop the same email from being invited and rewarded again. The fingerprint cannot be turned back into the email address.
• Analytics and session recordings are kept in PostHog for the retention period we set there. You can ask us to delete the analytics data linked to your account.
• Technical logs are kept for a limited time for security.
• Messages to us are kept for as long as we need to resolve your question.

7. Your rights

Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022), you have the right to:

• be informed about how your data is processed (this page);
• see your data and get a copy, including in a commonly used format;
• correct or complete inaccurate data. You can change your name and learning preferences yourself in Settings;
• delete your account and data, directly in Settings → Delete account, or by emailing us;
• withdraw consent you have given, for example for news and offers emails or testimonials, in Settings → Notifications;
• stop exam reminder emails, with the link in every email or in Settings → Notifications;
• object to or restrict processing for analytics and session recordings;
• object to decisions based solely on automated processing;
• complain to the authority responsible for personal data protection.

To use these rights, email support@naomistudy.com from your account email. To keep your account safe, we may ask you to confirm the request is yours. We respond within 3 x 24 hours of receiving the request, and tell you if something will take longer.

8. Cookies and browser storage

We do not use advertising cookies. The app stores your sign-in token, language choice, exam setup draft, whiteboard copies, your first visit source, and a friend's invite code (if you opened an invite link, kept for at most 30 days) in your browser's local storage. PostHog uses cookies and local storage to recognise your browser from one visit to the next.

When you delete your account, the sign-in token, draft and whiteboard copies in the browser you used are deleted too. On other devices you are signed out the next time the app opens.

9. Security

Connections to NaomiStudy are encrypted (HTTPS), passwords are only stored as hashes, and access to production systems is restricted. No system is 100% secure, so use a strong password you do not use elsewhere.

If a personal data protection failure affects your data, we will notify you and the competent authority within 3 x 24 hours of becoming aware of it, as required by the PDP Law.

10. Users under 18

For now NaomiStudy is meant for users aged 18 and over, such as university students and civil-service (CPNS) applicants. If you are under 18, please do not create an account yourself. A flow with parent or guardian consent is in preparation.

If we learn that an account belongs to someone under 18 and was created without a parent's or guardian's consent, we will delete it. Parents or guardians can contact us at support@naomistudy.com.

11. Changes to this policy

If the way we process your data changes, we will update this page and the date above. Important changes are also announced in the app before they take effect.

12. Contact

Questions or requests about your data: support@naomistudy.com.