Privacy

CARDSTOCK PRIVACY POLICY Last updated: 30 August 2026 1. Who we are Cardstock is operated by William Stämdal, a private individual based in Sweden ("Cardstock", "we", "us" or "our"). William Stämdal is the controller of the personal data described in this Privacy Policy. Privacy and data-protection enquiries can be sent to support@cardstock.se. 2. Scope This Privacy Policy explains how we collect and use personal data when you visit cardstock.se, create or use a Cardstock account, submit study material, generate or edit a study kit, use learning and AI-tutor features, share a study kit, purchase or manage a subscription, submit a withdrawal request, or contact support. 3. Where the data comes from Most personal data comes directly from you when you create an account, submit material, use study features, ask the AI tutor a question, make a purchase, or contact us. We also generate data from your use of Cardstock, such as review schedules, quiz results, mastery estimates, usage records and security logs. Stripe provides subscription and payment-status information. Google, YouTube and other service providers may return generated content, transcript information, source links, status information or technical metadata needed to provide the Service. 4. Personal data we process Account and preference data We process your name, email address, hashed password, email-verification status, account role and status, plan, usage allowance, account creation time, last-login time, language preference and daily review goal. Password-reset and verification tokens are stored in hashed form where applicable. We do not store your password in readable form. Study inputs and generated content Depending on what you submit, we process pasted notes, images, PDF files, YouTube links, transcripts, filenames and source URLs. We store the study kits generated from that material, including titles, summaries, key concepts, definitions, important facts, simplified explanations, study recommendations, flashcards, accepted typed answers, quiz and short-answer questions, explanations, and cards you create or edit yourself. Uploaded image and PDF files used to generate a study kit are stored temporarily on our server while the request is processed and are deleted from that temporary upload location after the AI request finishes. Extracted and generated study content remains associated with your account until you delete the relevant study kit or account, subject to backups and legal retention requirements. Image-occlusion exception If you deliberately create an image-occlusion flashcard, the image used for that card must remain stored on Cardstock's server so the card can be displayed. It is retained until you delete that card, its study kit or your account, subject to backups and legal retention requirements. This is different from a temporary image uploaded only to generate a study kit. Learning and organisation data We process courses and folders you create, course names, descriptions and icons, kit-to-course assignments, exam-plan titles and dates, selected study kits, planned daily study time, and plan update times. We also process flashcard review ratings, review times, previous and next due dates, intervals, repetitions, lapses, typed-answer results, card-quality feedback, quiz answers, quiz scores, mistake records, generated corrective-practice quizzes, study streaks and daily-goal progress. Cardstock uses these records to calculate review schedules, readiness and mastery estimates, weak areas and suggested study sessions. These are learning aids and estimates, not formal academic assessments. Ask Cardstock AI tutor data When you use Ask Cardstock, we store your questions, the tutor's replies, the requested help style, the relevant study-kit identifier and timestamps. To provide a contextual reply, Cardstock sends relevant generated study-kit content, your current question and a limited number of recent tutor messages to the Google Gemini API. When Google Search grounding is enabled, the tutor may also send the prompt, relevant context and generated output to Google's search-grounding systems to verify current or outside information and return source links. Google's current documentation states that prompts, contextual information and generated output used with Grounding with Google Search are retained by Google for 30 days for grounded-result, debugging and testing purposes, and that this retention cannot be disabled for that feature. Do not include unnecessary personal, confidential or sensitive information in tutor questions. Sharing data If you enable private-link sharing, Cardstock stores that sharing is enabled and stores a cryptographic hash of the share token. Anyone who obtains the private link can view the generated kit content exposed on the shared page without signing in. The shared page does not intentionally expose your account identity, original upload, tutor conversation, quiz history, review progress, mastery data or exam plans. Access to a shared page may nevertheless appear in ordinary web and security logs. You can disable a share link, and deleting the study kit also ends access. AI usage information We process request type, model, input and output size, processing time, whether a request succeeded, limited error information and a cryptographic hash used to detect duplicate submissions. The hash is not intended to reproduce the submitted content. Billing data Stripe processes payment-card information, billing address, tax information and payment authentication. Cardstock does not receive or store your complete card number. We receive and store limited billing references and status information, such as your Stripe customer and subscription identifiers, selected plan, subscription status, payment status, subscription start and renewal date. Support and withdrawal data When you contact support or submit a statutory-withdrawal request, we process your name, email address, ticket subject, messages, replies, declarations, account reference, ticket status and relevant timestamps. Logged-out visitors may submit support information as guests. Technical, cookie and security data Our server and security systems may process IP address, date and time, requested page, response status, browser or user-agent information, referring page, session identifiers and rate-limit information. We use strictly necessary session and security cookies to keep you signed in, protect forms and remember essential preferences such as language. We do not currently use personal data for behavioural advertising and do not sell personal data. Externally loaded website resources The website currently loads fonts from Google Fonts. Study pages also load the MathJax mathematical-rendering library through the jsDelivr content-delivery network. Those providers and their delivery partners may receive technical request information such as IP address, browser or user-agent, referring domain, requested resource and time of access. These resources are used to display the website and mathematical notation; they are not intended by Cardstock for behavioural advertising. 5. Why we process data and our legal bases We process account, study, learning, tutor, sharing, support and subscription data where necessary to enter into or perform our contract with you, including authenticating your account, generating and storing study materials, personalising review schedules, providing tutor replies, applying plan and safety limits, processing purchases and providing support (Article 6(1)(b) GDPR). We process records where necessary to comply with legal obligations, including accounting, tax, consumer-protection and lawful-authority requirements (Article 6(1)(c) GDPR). We process limited technical, security, fraud-prevention, service-reliability, support and private-link information for our legitimate interests in protecting Cardstock, preventing abuse, diagnosing faults, enforcing reasonable limits and operating the Service effectively, provided those interests are not overridden by your rights (Article 6(1)(f) GDPR). Where we specifically ask for consent for an optional purpose, you may withdraw that consent at any time without affecting processing that occurred before withdrawal (Article 6(1)(a) GDPR). A safety acknowledgement shown before opening the AI tutor is intended to explain AI limitations; it is not relied on as consent for unrelated processing. 6. AI processing Cardstock uses the Google Gemini API to generate study kits, transform flashcards, create corrective-practice questions and provide the Ask Cardstock tutor. The material and context necessary for the feature you request is transmitted to Google for processing. Google may process data outside Sweden or the EEA under its applicable terms and data-transfer safeguards. Google's treatment of prompts and responses depends on the API service, billing setup, feature, location and current Google terms. Google's current terms state that prompts and responses processed through Paid Services are not used to improve Google's products, although limited logging may occur for abuse monitoring and legal or operational purposes. Unpaid services may be treated differently. Grounding with Google Search has the separate 30-day retention described above. Cardstock must use a service configuration permitted for its EEA production use. AI-generated output and web-grounded answers may be inaccurate or may cite an unsuitable source. Cardstock does not use Gemini output, mastery scores, readiness estimates or study recommendations to make decisions producing legal or similarly significant effects about you. If you provide a YouTube URL, Cardstock contacts YouTube to attempt to retrieve the video's transcript. Your use of YouTube content remains subject to YouTube's own terms and privacy information. 7. Who receives personal data We disclose personal data only where needed to operate the Service, process a transaction, protect the Service or comply with law. Recipient categories currently include: - Google, for Gemini AI processing, Google Search grounding, YouTube-related transcript retrieval and externally loaded fonts; - Stripe, for checkout, subscriptions, billing, payment authentication, tax-related checkout features and the customer portal; - Simply.com and relevant hosting and email-delivery infrastructure, for hosting, storage and transactional or support email; - jsDelivr and its CDN infrastructure providers, to deliver the MathJax library on study pages; - professional advisers or service providers where reasonably necessary and subject to appropriate duties; and - courts, regulators, law-enforcement bodies or other authorities where disclosure is legally required. We do not make your original uploads available to other Cardstock users. Generated kit content becomes available to anyone holding a private share link only when you deliberately enable that link. 8. International transfers Some providers may process data in countries outside the EEA. Where required, we rely on an applicable adequacy decision, the European Commission's Standard Contractual Clauses, a provider's valid participation in an approved data-transfer framework, or another lawful transfer mechanism, together with supplementary safeguards where appropriate. You may contact us for more information about safeguards relevant to your data. 9. How long we retain data We retain personal data only for as long as needed for the purposes described above, taking account of the service relationship, your choices, security needs, disputes and legal obligations. - Temporary images and PDFs used only to generate a study kit are deleted from Cardstock's temporary upload location after the relevant AI request finishes. - Images used in image-occlusion flashcards are retained until the card, study kit or account is deleted, subject to backups and legal retention requirements. - Account details, preferences, stored study kits, courses, exam plans, tutor conversations, review history, quiz answers and results, mastery evidence and practice quizzes are generally retained while your account remains active. Deleting a study kit deletes its associated generated content, cards, tutor messages and related kit records from the active database. Deleting the account deletes associated active-account learning data, subject to the exceptions below. - Disabling a private share link removes public access through that link and removes the active share-token hash. It does not delete the underlying study kit. - Billing and transaction records are retained for as long as required by accounting, tax, fraud-prevention and legal-claims requirements. Stripe may retain data under its own legal obligations and policies. - Support and withdrawal records are retained for as long as reasonably necessary to handle and follow up the matter. They may be retained longer where necessary to resolve disputes, investigate security incidents, establish or defend legal claims, or comply with legal obligations. Records are deleted or anonymised when no longer needed. - Nginx web-server logs are normally retained for up to 14 days. Application and system security logs are normally retained for up to 30 days, unless longer retention is necessary to investigate abuse, fraud or a security incident. - Database and deployment backups are normally retained for up to 30 days and are then overwritten or securely deleted. Deleted information may remain in protected backups until the relevant backup is overwritten. If a backup is restored, information that should already have been deleted will be deleted again where reasonably possible. - Google currently states that data used for Grounding with Google Search is retained by Google for 30 days as described in section 4. Other providers retain information according to their applicable terms and legal obligations. 10. What information is required Your name, email address, password and necessary security information are required to create and protect an account. Study material is required only when you ask Cardstock to generate content. Tutor questions are required only when you use the tutor. Payment and billing information is required only to purchase a paid plan. If required information is not provided, we may be unable to create an account, generate requested material, answer a tutor question, process a payment or provide the relevant support. Please avoid submitting personal information that is not needed. Do not submit special-category data, confidential examination material, trade secrets, medical records or information about another person unless you have a lawful basis and authority to do so. 11. Your rights Subject to the GDPR and applicable limitations, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it. You may delete individual study kits and your Cardstock account using the available controls. We may need to verify your identity before acting on other requests. Certain information may be retained where required by law or necessary for legal claims, fraud prevention or security. Send privacy requests to support@cardstock.se. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at https://www.imy.se, or with another competent supervisory authority. 12. Children and age limits Cardstock is currently intended only for people aged 18 or older. Do not create an account or submit personal data if you are under 18. This restriction reflects, among other things, the current terms governing the Gemini API used by Cardstock. If Cardstock later adopts a provider arrangement that permits access by younger users, the age rule, age-assurance measures and child-facing privacy information will be reviewed before that access is enabled. 13. Automated learning estimates Cardstock automatically uses review ratings, quiz answers and study activity to calculate due dates, streaks, mastery percentages, readiness indicators, weak areas and suggested study plans. These calculations are intended only to organise studying. They do not determine admission, grades, employment, credit, eligibility or any legal right, and they do not produce legal or similarly significant effects. 14. Security We use measures intended to protect personal data, including HTTPS, access controls, password hashing, secure cookies, CSRF protection, restricted upload types and sizes, rate limiting, temporary-upload deletion, hashed private-link tokens and server access controls. No online service can guarantee absolute security. Treat private share links as confidential and disable them if sent to the wrong person. If you believe your account or data has been compromised, contact support@cardstock.se promptly. 15. Changes to this Policy We may update this Privacy Policy to reflect changes to Cardstock, our providers or applicable law. We will publish the updated version and effective date. Where a change materially affects your rights or the way we use personal data, we will provide additional notice where required. 16. Contact William Stämdal Private individual operating Cardstock Email: support@cardstock.se