Privacy Policy

1. What Information Do We Collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

The personal information we collect may include:

• Names
• Email addresses
• Usernames
• Academic status (for student discount verification)

Sensitive Information. We do not process sensitive information.

Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number and the security code associated with your payment instrument. Payments on the web are processed and stored by Stripe; you may find their privacy notice here: stripe.com/en-gb/privacy. Subscriptions bought in the mobile app are processed by Apple (App Store) or Google (Google Play) and managed through RevenueCat; we do not receive your card details for those purchases.

Information automatically collected

In Short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and other technical information.

The information we collect includes:

• Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services.
• Device Data. Information about your computer, phone, tablet, or other device you use to access the Services, including IP address, browser type, hardware model, operating system, and system configuration.

Chrome Browser Extension — Page Content Access

In Short: Our Chrome extension reads webpage content only when you explicitly request it, solely to generate your study materials.

The DueToday Chrome extension requires the "Access data on all websites" browser permission in order to function. This permission is used exclusively for the following purpose:

When you click "Import Page" inside the extension, a content script reads the visible text of the webpage you are currently viewing. This text is then sent to our servers to generate AI-powered study materials such as summaries, quizzes, and flashcards.

• No passive collection. Page content is never read or transmitted without an explicit action from you.
• No browsing history. We do not collect, store, or transmit a record of the websites you visit.
• No background scanning. The extension does not monitor or access pages you have not chosen to import.
• Sole purpose. Page content is used only to generate study materials requested by you and is not used for advertising, profiling, or any other purpose.

If you have questions about how the extension handles your data, please contact us at hello@duetoday.ai.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, including:

• Account creation and authentication. We may process your information so you can create and log in to your account.
• Delivering services. We may process your information to provide you with the requested service.
• User support. We may process your information to respond to your inquiries and solve any potential issues.
• Administrative communications. We may process your information to send you details about our products, services, changes to our terms and policies.
• Vital interests. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

3. What Legal Bases Do We Rely On to Process Your Information?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so.

If you are located in the EU or UK

The GDPR and UK GDPR require us to explain the valid legal bases we rely on. We may rely on the following:

• Consent. We may process your information if you have given us permission. You can withdraw your consent at any time.
• Performance of a Contract. We may process your personal information when necessary to fulfill our contractual obligations to you.
• Legal Obligations. We may process your information where necessary for compliance with our legal obligations.
• Vital Interests. We may process your information where necessary to protect your vital interests or those of a third party.

If you are located in Canada

We may process your information if you have given us specific permission (express consent) or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time by contacting us at hello@duetoday.ai.

In some exceptional cases, we may be legally permitted to process your information without your consent, including:

• For account security and fraud prevention
• To comply with legal obligations, court orders, or governmental requests
• To investigate violations of our Terms and Conditions
• To process and maintain records of your subscription payments
• To verify student status for discount eligibility
• To maintain the technical functionality and security of our Services
• To protect the rights, property, or safety of our users

4. When and With Whom Do We Share Your Personal Information?

In Short: We share information with the service providers that run DueToday's features, hosting, payments, email and analytics, only as needed for the purposes below, and in the specific situations described in this section.

AI and content-processing providers

DueToday's study tools are powered by AI. When you use a feature that needs it, we send the content you add (for example recordings, files, photos, web links, typed text and chat messages) to the providers below, which process it to provide that feature. Your content stays private to your account; it is not shared with other users unless you choose to share it.

Integrations you choose to connect

If you connect another service, we exchange data with it only to do what you ask: Google Calendar (calendar events you choose to sync), Notion (pages you choose to import) and Google Drive / Google Docs (documents you choose to export, connected through our integration provider Composio). You can disconnect these at any time. If you sign in with Google or Apple, they share your name and email address with us.

Hosting, email, notifications and payments

Analytics and advertising measurement

On our website and web app we use Google Analytics and Google Ads, the Meta Pixel, the OpenAI Ads pixel (for ads in ChatGPT), PostHog and Hotjar, and on our marketing website also Datafast. They receive device and usage information such as pages visited, clicks and interactions, referring pages, approximate location, IP address and conversion events (for example starting a trial). We use them to understand how DueToday is used, improve it and measure our advertising. If you allow marketing cookies and then start a trial or subscription on our website, our servers also send that event (and, for a trial, the first payment when it becomes a paid subscription) to Meta and to OpenAI (the Meta Conversions API and the OpenAI Ads Conversions API) with your email address and account ID in hashed (scrambled) form, your browser's IP address and user agent, and the Meta and OpenAI pixel cookie IDs, so the event still counts if your browser blocks the pixels. We don't send it if you decline marketing cookies or your browser sends Global Privacy Control. In the same situations, when you sign up or start a trial or subscription on our website, the Google tag sends your email address to Google Ads in hashed (scrambled) form with the conversion (Google's "enhanced conversions"), so Google can match it to the ad you clicked. See section 5 for cookies.

In our mobile app we use the Meta SDK to measure our advertising, only if you allow it. When it's on, Meta receives an advertising identifier for your device (on iPhone only if you tap "Allow" on Apple's tracking prompt), your IP address, basic device information, and the fact that you installed or opened the app. RevenueCat also sends Meta your trial and subscription events with Meta's anonymous ID for your device (and, on iPhone, the advertising identifier), so we can see which ads lead to subscriptions. With the same permission, Google Analytics for Firebase tells Google when the app is installed or opened and when a subscription is bought in the app, with your device's advertising identifier, so Google Ads can measure our ads (ad personalisation stays off). It never includes your notes, recordings or other content, and there are no ads in the app. On iPhone it follows Apple's tracking setting (Settings > Privacy & Security > Tracking). On Android, if you are in the UK or the European Economic Area, we ask first; everywhere else it's on until you turn it off. You can change it at any time in the app under Settings > Ads measurement.

Google Ads without cookies (UK and EEA). If you are in the UK or the European Economic Area and haven't accepted marketing cookies, Google Ads' tag still loads on our website in a restricted "consent mode": it sets and reads no cookies, receives no identifiers from us (no email address or account ID, and ad-click identifiers are removed), and only tells Google that a visit, sign-up or purchase happened, so Google can estimate how its ads perform in aggregate. We don't do this if your browser sends Global Privacy Control, and outside the UK and EEA we don't load Google Ads at all once you've opted out. Meta and OpenAI receive nothing from us without your consent.

Our own campaign records. When you arrive on our website from one of our ads or from a link with campaign tags, we note the campaign (for example the utm_source and utm_campaign tags) and which ad platform the click came from, in your browser's session storage until you close the tab. If you then sign up, we save that note with your account so we can see which campaigns bring sign-ups, trials and subscribers. It stays with DueToday and is never shared with ad platforms, and we don't store ad-click identifiers.

Other situations

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

5. Do We Use Cookies and Other Tracking Technologies?

In Short: We use essential cookies to run DueToday, and analytics and advertising cookies only as your choices and your location allow. You can change your choice at any time.

We use cookies, browser storage and similar technologies (like pixels) for three purposes:

• Strictly necessary: keeping you signed in, keeping the Services secure and remembering your settings (for example your language and your cookie choice, which we store in a cookie called dt_consent for 12 months). The Services do not work without these, so they are always on.
• Analytics: understanding how the Services are used so we can improve them, using Google Analytics, PostHog, Hotjar and (on our marketing site) Datafast.
• Marketing: measuring whether our ads lead to sign-ups, using Google Ads, the Meta Pixel and the OpenAI Ads pixel. The mobile app uses the Meta SDK and Google Analytics for Firebase for the same purpose (see section 4).

Your choices

If you are in the UK or the European Economic Area, we ask first: analytics and marketing tools do not load until you accept them in the cookie banner, and "Reject all" is as easy as "Accept all". The only exceptions are Google Ads' cookieless consent mode and our own campaign note, both described in section 4; neither sets cookies or shares identifiers.

Everywhere else, analytics and marketing tools load by default and you can turn them off. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of marketing on every visit.

You can change or withdraw your choice at any time with Cookie settings (also at the bottom of every page). Your choice applies to the browser you make it in. You can also block or delete cookies in your browser settings; blocking strictly necessary cookies or browser storage will sign you out.

6. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law. No purpose in this notice will require us keeping your personal information for longer than three (3) months past the termination of the user's account, except the records described under "What we keep" in section 15 (such as payment records we must keep by law).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or securely store your personal information and isolate it from any further processing until deletion is possible.

7. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. You should only access the Services within a secure environment.

8. Do We Collect Information From Minors?

In Short: You must be at least 13 to use DueToday, and users under 18 need a parent or guardian's permission. We do not knowingly collect personal information from children under 13.

You must be at least 13 years old to use the Services. If you are under 18 (or under the age of majority where you live), you may only use the Services with the permission of a parent or guardian. Where the GDPR or UK GDPR applies, each country sets its own age of digital consent (between 13 and 16); if you are below the age that applies where you live, a parent or guardian must give consent for you before you use the Services.

We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will deactivate the account and take reasonable measures to promptly delete that information. If you believe we may have collected information from a child under 13, please contact us at hello@duetoday.ai.

9. What Are Your Privacy Rights?

In Short: In some regions, such as the EEA, UK, and Canada, you have rights that allow you greater access to and control over your personal information.

In some regions you have certain rights under applicable data protection laws, including the right to: (i) request access and obtain a copy of your personal information, (ii) request rectification or erasure, (iii) restrict the processing of your personal information, and (iv) if applicable, data portability.

Withdrawing your consent

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. This will not affect the lawfulness of processing before its withdrawal.

Account Information

To review or change your account information, log in and open your account settings. To delete your account, see section 15.

Cookies

You can accept, reject or change analytics and marketing cookies at any time with Cookie settings. See section 5.

If you have questions or comments about your privacy rights, please email us at hello@duetoday.ai.

10. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. We do honour the Global Privacy Control (GPC) signal: when your browser sends it, we do not load our marketing tools (Google Ads, the Meta Pixel and the OpenAI Ads pixel), as described in section 5 and section 11.

11. Do California Residents Have Specific Privacy Rights?

In Short: Yes, if you are a resident of California, you are granted specific rights regarding access to your personal information.

California Civil Code Section 1798.83 ("Shine The Light" law) permits our users who are California residents to request information about categories of personal information we disclosed to third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please submit your request in writing using the contact information provided below.

CCPA Privacy Notice

We have collected the following categories of personal information in the past twelve (12) months:

Your rights with respect to your personal data

• Right to request deletion. You can ask for the deletion of your personal information, subject to certain exceptions provided by law.
• Right to be informed. You have a right to know whether we collect and use your personal information and for what purposes.
• Right to Non-Discrimination. We will not discriminate against you if you exercise your privacy rights.
• Right to Limit Use of Sensitive Personal Information. We do not process consumers' sensitive personal information.

Do not sell or share my personal information

We do not sell personal information. We use Google Ads, the Meta Pixel and the OpenAI Ads pixel on our website and web app, and the Meta SDK and Google Analytics for Firebase in our mobile app, to measure our advertising (section 4); under California law this may count as "sharing" personal information (identifiers and internet activity) for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16.

You can opt out of this sharing at any time by selecting Do not sell or share my personal information (also at the bottom of every page), or by turning on Global Privacy Control in your browser, which we honour automatically. Your opt-out applies to the browser you use; if you clear your cookies, select it again or use Global Privacy Control.

To exercise these rights, contact us at hello@duetoday.ai.

12. Do Virginia Residents Have Specific Privacy Rights?

In Short: Yes, if you are a resident of Virginia, you may be granted specific rights regarding access to and use of your personal information.

Virginia CDPA Privacy Notice

Under the Virginia Consumer Data Protection Act (CDPA), you have the following rights with respect to your personal data:

• Right to be informed whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of personal data you previously shared with us
• Right to opt out of the processing of your personal data for targeted advertising or sale

DueToday Inc has not sold any personal data to third parties for business or commercial purposes and will not sell personal data in the future. To opt out of the use of the Meta Pixel, the OpenAI Ads pixel and Google Ads to measure our advertising, select Do not sell or share my personal information or turn on Global Privacy Control in your browser. In the mobile app, turn off Settings > Ads measurement (on iPhone, turn off tracking for DueToday in the Settings app).

Right to appeal

If we decline to take action regarding your request, you may appeal by emailing hello@duetoday.ai. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response. If your appeal is denied, you may contact the Attorney General to submit a complaint.

To exercise these rights, contact us at hello@duetoday.ai or visit www.duetoday.ai.

13. Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be effective as soon as it is accessible. If we make material changes, we may notify you by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently.

14. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you can reach us at:

We aim to respond to all privacy-related inquiries within 5–7 business days.

15. How Can You Review, Update, or Delete the Data We Collect From You?

You have the right to request access to the personal information we collect from you, change that information, or delete it. To request to review, update, or delete your personal information, please contact: hello@duetoday.ai

Deleting your account

• In the mobile app: open Settings (tap your profile picture) and choose Delete account, then confirm. Your account is deleted straight away.
• On the web: open Settings and choose Delete next to Delete account. This opens an email to hello@duetoday.ai; send it from your account's email address and we will confirm and delete your account. You can also email us directly if you can't sign in.

What is deleted: your profile and sign-in, and everything you created or uploaded in DueToday, including recordings, files, notes, transcripts, flashcards, quizzes, chats and other generated material. Any DueToday subscription you pay for on the web through Stripe is cancelled. If you signed in with Apple, we also revoke DueToday's access to your Apple ID sign-in, and we delete your purchase record at RevenueCat. Deletion is permanent and can't be undone, so export anything you want to keep first.

Subscriptions bought through the App Store or Google Play are billed by Apple or Google, and deleting your account does not cancel them. Cancel them in your App Store or Google Play subscription settings so you aren't charged again.

What we keep: payment and invoice records held by Stripe (and by Apple or Google for in-app purchases), which we must keep as required by tax and accounting law; a fingerprint of the payment card used for a free trial (not linked to your account), to prevent repeat free trials; and, if you unsubscribed from our emails (or our emails to you bounced or were reported as spam), your email address on our suppression list, so we don't email you again.