Legal Information

SummitAI is owned and operated by S&B Technologies LLC ("we," "our," or "us"), an AI-powered study platform. This Privacy Policy describes how we collect, use, store, and share your personal information when you access or use our website, mobile application, or any related services (collectively, the "Service"). By using the Service you consent to the practices described herein.

a. Account & Identity Data — name, email address, and hashed credentials provided at registration.

b. Study Content — notes, lecture slides, PDFs, and other documents you upload; AI-generated quizzes, summaries, and study plans derived from that content.

c. Usage & Performance Data — study session durations, question attempt logs, test scores, concept mastery ratings, and feature interaction events.

d. Technical Data — IP address, browser type, operating system, device identifiers, and session cookies used for security and analytics.

e. Communications — messages sent to our support team or AI support agent.

f. Your AI Choice — whether you allowed AI features, and when you last changed that choice.

g. Purchase Records — for a subscription bought in our iPhone app: Apple's transaction identifiers; the product; the purchase, renewal and expiry dates; its status, including whether it is a free trial, set to renew or in a billing grace period, and the reason Apple gives when it ends (for example, cancelled or a billing problem); refund or revocation details (date and reason); the App Store country or region of the purchase; the email address of the SummitAI account it belongs to; a random purchase ID that links it to your account; and a record of each move of the subscription between SummitAI accounts, made through Restore Purchases or a new purchase on the same Apple Account (the accounts involved, when, and which of the two). We never receive your payment details.

• Deliver, personalize, and improve the Service and its AI features
• Generate and refine adaptive study materials based on your performance
• Enforce daily and per-minute usage limits to maintain platform integrity
• Send transactional emails (account verification, streak reminders, billing receipts)
• Detect, investigate, and prevent fraud, abuse, or security incidents
• Comply with applicable laws and respond to lawful legal process
• Conduct aggregated, anonymized internal research and product analytics

We do not sell, rent, or exchange your personal data with third parties for marketing purposes.

SummitAI's AI features (reading your uploads, the AI Tutor, Study, practice tests, the Test Generator, the Study Planner, recommendations and the Support chat) send your content to third-party AI providers. We send nothing to them until you allow AI features on the AI permission screen, and you can turn them off at any time in your Profile.

When AI features are on, we send the notes, photos and files you upload, the questions and messages you type, and your scores and topics when you ask for recommendations or a study plan to:

• Anthropic (Claude) and Google (Gemini), to read what you upload and to write your study material, practice questions, presentations, plans and AI Tutor answers.
• OpenAI, to index your notes and AI Tutor questions for search.
• Anthropic (Claude), to answer your messages in the Support chat.

These providers process your content as our service providers, only to deliver these features to you. Turning AI features off stops anything new from being sent; it does not recall what was already processed.

What we keep: your AI Tutor conversations, your Support chat, and the study material the AI makes for you (your notes' text, titles and topics, questions, presentations and plans) are stored with your account so you can come back to them. The Support assistant also remembers details from your earlier support chats, for you only. Deleting a note also deletes what was made from it. All of this, your Support chat and what the Support assistant remembers included, is kept until you delete your account, and is then deleted as described in section 6. We do not keep a separate copy of the requests we send to AI providers; to track costs and prevent abuse we record which model ran and an estimate of the request's size and cost, without its content.

We do not sell your personal data. We share it only in these cases:

• Our app platform provider hosts the app and website, signs you in, and runs our database, file storage, the emails we send you (welcome, study reminder and group invite emails) and the gateway our AI requests pass through.
• Stripe handles payments on our website. It receives your email address and payment details; we never see your full card number.
• Apple handles payments for subscriptions bought in our iPhone app, under its own privacy policy. We send Apple a random purchase ID for your account with each purchase, and Apple tells us about the purchase and its renewals (see section 2g); we never see your payment details.
• Cloudflare runs our domain name and routes email sent to our support address.
• AI providers named in section 4, only after you allow AI features.
• Crash and incident logging: when the app hits an error while you are signed in, it records the type of error and where in our code it happened (never your notes, messages or anything you typed) in our own incident log, hosted by our app platform provider. If we turn on Sentry, an error-reporting service, it receives the same kind of report with a random account ID and no name or email address.
• Study groups: members of a study group you create or join can see each other's names and email addresses.
• Apps you connect: if you connect an AI assistant or another app to SummitAI through our MCP server, you sign in and approve that connection on a SummitAI permission screen first. That app can then read and act on your SummitAI data within the access you approved, and its own privacy policy covers what it receives. To disconnect it, remove the connection in that app, or email us and we will revoke it.
• When required by applicable law, subpoena, court order, or governmental authority
• To protect the rights, property, or safety of SummitAI, its users, or the public
• In connection with a merger, acquisition, or sale of assets — you will be notified in advance
• With your explicit consent

We share your data only with third parties that provide the same or equal protection of your data as described in this Privacy Policy, and only to the extent needed for the purpose above.

We retain your data for as long as your account is active or as needed to provide the Service. You may request deletion of your account at any time via the Profile page. Upon confirmed deletion, all personal data and uploaded content will be permanently purged from our production systems within 30 days and from backup systems within 90 days, except where retention is required by law.

Files uploaded before November 2026 that never became a note, such as Test Generator files, are not linked to your account, so account deletion cannot find them. Email support@mysummitai.net and we will remove them.

When you delete your account, your Support chat and what the Support assistant remembers are removed within 30 days; you do not need to ask. To have them removed without deleting your account, email support@mysummitai.net and we will do it within 30 days.

• Data in transit is encrypted with TLS 1.2 or higher
• Data at rest is encrypted using AES-256
• Passwords are stored as salted cryptographic hashes and never in plain text
• Access to production data is restricted to authorized personnel on a need-to-know basis
• We perform regular security reviews and vulnerability assessments

Despite these measures, no system is completely secure. You use the Service at your own risk.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure ("right to be forgotten") — exercised via account deletion
• Restrict or object to certain processing
• Data portability — receive a copy of your notes and study history in a common, machine-readable format
• Withdraw consent at any time without affecting prior lawful processing — for AI features, with the switch in your Profile
• Lodge a complaint with your local data protection authority (GDPR/EU users)
• Opt out of the "sale" of personal information (CCPA/California users — note we do not sell data)

To exercise any right, email us at support@mysummitai.net. We will respond within 30 days.

SummitAI is a tool used independently by students and is not directly subject to FERPA as a school official. However, we treat all educational records you upload with the same confidentiality standards required by FERPA and will not disclose them to third parties without your consent except as required by law.

The Service is intended for users aged 16 and older. We do not knowingly collect personal information from anyone under 16. If we learn that we have inadvertently collected such data, we will delete it promptly.

We use strictly necessary cookies for session management and security. We do not use third-party advertising cookies. You can disable cookies in your browser settings, but doing so may impair Service functionality.

We may update this Privacy Policy periodically. Material changes will be communicated via in-app notice or email at least 14 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

For privacy inquiries: privacy@mysummitai.net