This Privacy Policy explains how Affectly, a product of Origae ("Affectly," "we," "our," or "us"), collects, uses, discloses, and safeguards your information when you use our emotion-aware learning platform (the "Service"). Please read it together with our Terms of Service.

Our approach to your privacy

Privacy should mean staying in control, not hiding. We collect only what we need to help you learn, we are clear about what that is, and we never sell your personal information. You choose what to share (including whether to share how you feel), you can see and delete your data at any time, and we deliberately keep your learning preferences separate from any idea of a medical diagnosis. The full detail is below.

1. Who We Are (Data Controller)

The data controller responsible for your personal information is Origae (trading as Affectly), 329/98-100 Elizabeth Street, Melbourne, VIC 3000, Australia. You can contact us about privacy at origae.dev@gmail.com.

For users in the United Kingdom and European Economic Area (EEA), our representative for data-protection matters can be contacted at origae.dev@gmail.com. Details of any appointed UK/EU representative are available on request.

2. Who the Service Is For (General Audience)

Affectly is a general-audience learning service. It is not directed to children, and use of the Service by anyone under the age of 16 is strictly prohibited. You must be at least 16 to create an account and use the Service, and at least 18 (or have a parent or guardian's consent) to make a purchase.

We do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has provided us personal information, contact us at origae.dev@gmail.com and we will delete it promptly.

3. Information We Collect

3.1 Personal Information

We may collect personal information that you voluntarily provide, including:

Name and email address when creating an account
Profile information and preferences
Payment information for premium services (processed by secure third-party providers; we do not store full card details)
Communications you send to us

3.2 Learning Preferences and Emotional Indicators

To personalize how the Service teaches you, we process:

Emotional-state indicators that you voluntarily share (for example, selecting how you feel before a lesson)
Learning progress, session data, and performance metrics
Interaction patterns with the Service
Flashcard reviews and study habits
"How I learn" preferences that describe how you like content presented

Important — we do not collect medical or diagnostic data. Affectly does not ask for, require, or store medical diagnoses. Our "How I learn" feature captures learning-style preferences (such as a preference for shorter chunks, more structure, or read-along audio) — not health conditions or disability status. Any preset you choose to pre-fill those preferences is used transiently to configure your settings and is not stored as a label or as a record of any diagnosis. We designed the Service this way specifically to keep your preferences about how you learn separate from any information about a diagnosis.

Emotional indicators are used only to adapt the tone, pace, and structure of your lessons. You can use the Service without providing them, and you can delete this data at any time (see Section 8).

3.3 Automatically Collected Information

We automatically collect certain information, including:

Device information (type, operating system, browser)
IP address and general (city/country-level) location data
Usage data and analytics
Cookies and similar technologies (see Section 9)

4. How We Use Your Information and Our Legal Bases

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

Contract: to create and manage your account, deliver the Service, and process transactions.
Consent: to process emotional-state indicators you choose to share and to send optional marketing. You may withdraw consent at any time without affecting prior processing.
Legitimate interests: to secure the Service, prevent fraud and abuse, and improve and analyze our features, balanced against your rights.
Legal obligation: to comply with applicable law, tax, and record-keeping requirements.

We do not use your personal information to make decisions producing legal or similarly significant effects about you by solely automated means. Ari's responses adapt content but do not make such decisions.

5. AI Processing

Our AI tutor ("Ari") is powered by third-party AI providers. Messages you send to Ari are transmitted to these providers to generate a response. Your messages are not used to train their models and are not retained by them for that purpose. Do not share sensitive personal information, credentials, or third-party personal data in your messages. AI-generated content is for general educational purposes and may be inaccurate; see our Terms of Service.

6. Data Sharing and Disclosure

We do not sell your personal information. We may share it with:

Service providers: third parties who process data on our behalf under contract (hosting, database, AI processing, analytics, payment processing).
Legal requirements: where required by law, court order, or a governmental authority, or to protect our rights, users, or the public.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
With your consent: for any other purpose you explicitly agree to.

7. Data Security

We implement industry-standard safeguards, including encryption in transit, access controls, and secure infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify affected users and the relevant supervisory authority as required by applicable law (including the GDPR/UK GDPR 72-hour rule and the Australian Notifiable Data Breaches scheme).

8. Data Retention and Deletion

We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods include:

Account data: retained until you delete your account
Learning sessions: retained for 3 years after last activity, then archived
Flashcard data: retained until you delete it or your account
Uploaded documents: retained for 1 year after upload unless deleted earlier
Analytics data: aggregated and anonymized after 90 days
Audit logs: retained for up to 7 years for security and legal compliance

You may request deletion at any time. Upon account deletion we will delete or anonymize your personal data within 30 days, except where retention is required by law.

9. Cookies and Tracking

We use cookies and similar technologies that are strictly necessary to operate the Service, and — with your consent where required (including in the UK and EEA) — cookies for analytics and personalization. Where consent is required, non-essential cookies are not set until you agree, and you can change your choice at any time. You can also manage cookies through your browser settings.

10. International Data Transfers

We and our service providers may process your information in countries other than your own, including the United States. Where we transfer personal data out of the UK, EEA, or Australia, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement/Addendum, adequacy decisions, or the EU-US and UK-US Data Privacy Framework, as applicable. Details are available on request.

11. Your Rights and Choices

Depending on where you live, you may have the right to:

Access, correct, or delete your personal information
Object to or restrict certain processing
Data portability
Withdraw consent at any time
Lodge a complaint with a supervisory authority

To exercise any right, email origae.dev@gmail.com. We will respond within the timeframe required by applicable law.

11.1 UK & EEA (GDPR / UK GDPR)

If you are in the UK or EEA, you have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent. You may complain to your local supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in Ireland, the Data Protection Commission at dataprotection.ie.

11.2 Australia (Privacy Act 1988)

If you are in Australia, you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including access, correction, complaint, anonymity where lawful and practicable, and opting out of direct marketing. Your data may be processed by service providers outside Australia (including in the United States), who are subject to contractual obligations to protect it. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.

11.3 Canada, New Zealand & South Africa

If you are in Canada (PIPEDA), New Zealand (Privacy Act 2020), or South Africa (POPIA), you have rights of access and correction and may complain to your national privacy regulator. Contact us to exercise these rights.

11.4 United States (California)

California residents have rights under the CCPA/CPRA to know, access, correct, delete, and limit the use of sensitive personal information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by law. We will not discriminate against you for exercising your rights.

12. Third-Party Services

Our platform integrates with the following third-party processors:

Supabase (Database & Authentication): stores account data, learning progress, and session history; processes data in the United States. Privacy Policy
Groq (AI Processing): powers the AI tutor; your messages are processed to generate responses and are not stored or used for training. Privacy Policy
Vercel (Hosting): hosts the application and may collect basic performance and analytics data. Privacy Policy
Payment providers: subscriptions are processed by Apple (in-app purchases) and/or our web payment processor. Full payment-card details are handled by them, not stored by us.

The Service may link to external websites. We are not responsible for their privacy practices and encourage you to review their policies.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on this page and update the "Last updated" date, and for material changes we will provide additional notice where required by law.

14. Contact Us

For privacy questions or to exercise your rights, contact:

Origae (Affectly)
329/98-100 Elizabeth Street
Melbourne, VIC 3000, Australia
Privacy & Terms: origae.dev@gmail.com