📋 Summary: We collect only what we need to provide NexGen Study. We do not sell your personal data. Your academic content is processed to generate outputs and is not retained beyond your session unless you save it. You have full rights to access, correct and delete your data.
Corverxis Technologies Ltd ("Corverxis", "we", "us", "our") operates NexGen Study, an AI-powered academic companion platform. NexGen Study is available at nexgen-study.onrender.com and through the NexGen Study iOS application.
We are incorporated and operate under the laws of the State of Delaware, United States.
Data Controller: Corverxis Technologies Ltd
Contact: support@corverxis.com
Website: corverxis.com
This Privacy Policy applies to all personal data we collect and process when you:
| Category | Data Collected | Purpose |
|---|---|---|
| Account Registration | Full name, email address, password (bcrypt-hashed) | Account creation and authentication |
| OAuth Sign-in | Name, email, profile photo (from Google/Microsoft) | Alternative sign-in method |
| Academic Content | Text, documents and prompts you submit to tools | Generating AI outputs |
| Support Enquiries | Name, email, message content | Responding to support requests |
| Subscription | Payment method via Stripe (we do not store card details) | Processing subscription payments |
| Category | Data Collected | Purpose |
|---|---|---|
| Usage Data | Tools used, generation count, subscription plan | Service delivery, usage limits, analytics |
| Device Data | IP address, browser type, operating system | Security monitoring, fraud prevention |
| Authentication Logs | Login timestamps, IP addresses, failed attempts | Security (SOC 2 audit trail) |
| API Usage | Tool type, token counts, model used (not content) | Cost management, service improvement |
✅ We never use your academic content to train AI models. Prompts submitted to NexGen Study are passed to the Anthropic API for processing and are subject to Anthropic's data use policies. We do not retain or use your content for training purposes.
For users in the European Economic Area (EEA) and United Kingdom, our legal bases are:
| Processing Activity | Legal Basis |
|---|---|
| Providing the service, account management | Contract performance (Art. 6(1)(b)) |
| Security monitoring, fraud prevention, audit logs | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
| Legal compliance, responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data. We share data only with the following service providers under appropriate data processing agreements:
| Provider | Purpose | Data Shared |
|---|---|---|
| Anthropic PBC | AI text generation (NexGen Ultra) | Prompt text (session-only, subject to Anthropic's policies) |
| Stripe Inc. | Payment processing | Email, name, subscription details |
| Render Inc. | Cloud hosting and database | Application data, server logs |
| Google LLC / Microsoft Corp. | OAuth2 sign-in (optional) | Name, email, profile photo |
| Resend / SendGrid | Transactional email delivery | Email address, email content |
We may also disclose your data if required by law, court order, or to protect the rights and safety of our users or the public.
Corverxis Technologies Ltd is based in Delaware, United States. Your data may be processed in the United States and other countries where our service providers operate.
For users in the EEA or UK, transfers to the United States are made under:
| Data Type | Retention Period |
|---|---|
| Account data (name, email, password hash) | Until account deletion + 30 days |
| Usage/generation metadata (not content) | 365 days from creation |
| Security audit logs | 365 days (SOC 2 requirement) |
| Prompt/output content | Not retained (session only) |
| Stripe payment records | As required by financial regulations (7 years) |
| Deleted accounts | Anonymised immediately, hard-purged within 30 days |
When you delete your account, your personal data is immediately anonymised (name replaced with "Deleted User", email replaced with a non-identifiable token) and permanently purged within 30 days.
| Right | Description | How to Exercise |
|---|---|---|
| Access (Art. 15) | Obtain a copy of your personal data | Account → Settings → Export Data |
| Rectification (Art. 16) | Correct inaccurate data | Account → Settings → Edit Profile |
| Erasure (Art. 17) | Delete your account and all personal data | Account → Settings → Delete Account |
| Portability (Art. 20) | Receive your data in machine-readable format | Account → Settings → Export Data (JSON) |
| Restriction (Art. 18) | Restrict how we process your data | Email support@corverxis.com |
| Objection (Art. 21) | Object to processing based on legitimate interests | Email support@corverxis.com |
| Withdraw Consent | Withdraw marketing consent at any time | Account → Settings → Notifications |
See Section 12 for California-specific rights.
⚠️ We aim to respond to all data rights requests within 30 days. For complex requests we may extend this to 60 days and will notify you. To verify your identity, we may ask you to confirm your email address or answer security questions.
NexGen Study uses the following cookies:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| access_token | Strictly Necessary | Authenticates your session (httpOnly, Secure) | |
| refresh_token | Strictly Necessary | Refreshes authentication session (httpOnly, Secure) | 30 days |
| ns_used | Functional | Tracks daily trial usage count (localStorage) | Session |
We do not use advertising cookies, third-party tracking pixels or cross-site tracking technologies. We do not use Google Analytics or similar tracking services.
NexGen Study is designed for students aged 16 and over in further and higher education. We do not knowingly collect personal data from children under the age of 13 (US) or 16 (EEA/UK).
FERPA Alignment: We recognise that some users may be enrolled at US educational institutions covered by the Family Educational Rights and Privacy Act (FERPA). We align our practices with FERPA principles:
If you are a parent or institution and believe a child under 13 has registered, please contact us at support@corverxis.com and we will promptly delete the account.
California residents have the following rights under the California Consumer Privacy Act (CCPA) as amended by CPRA:
To exercise California privacy rights, email support@corverxis.com with the subject line "California Privacy Request".
We implement technical and organisational measures to protect your personal data, including:
Despite these measures, no system is 100% secure. If you believe your account has been compromised, contact us immediately at support@corverxis.com.
Security vulnerability reporting: security@corverxis.com. We ask that you responsibly disclose vulnerabilities and allow us a reasonable period to investigate before public disclosure.
NexGen Study is powered by NexGen Ultra, Corverxis Technologies' AI engine, which uses Claude models provided by Anthropic PBC via the Anthropic API.
When you submit content for AI generation:
⚠️ Academic Integrity Note: AI-generated content is a learning aid. Always ensure your use of AI-generated content complies with your institution's academic integrity policy. Submitting AI-generated work as entirely your own without appropriate acknowledgement may violate your institution's rules.
We may update this Privacy Policy from time to time. When we make material changes, we will:
Continued use of NexGen Study after the effective date of changes constitutes your acceptance of the updated policy.
For privacy-related enquiries, data rights requests or to report a security concern:
| Contact Type | Details |
|---|---|
| General Support | support@corverxis.com |
| Privacy / Data Rights | support@corverxis.com — Subject: "Privacy Request" |
| Security Vulnerabilities | security@corverxis.com |
| Postal Address | Corverxis Technologies Ltd, Delaware, United States |
| Website | corverxis.com |
If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.