Privacy Policy

1. Introduction

AC3 ("we", "us", "our") is an AI-powered study assistant that helps university students learn more effectively. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website, Chrome extension, and related services.

We are based in Australia and comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you have questions about this policy, contact us at support@ac3app.com.

2. Information We Collect

Account Information

When you create an account, we collect your name and email address. If you sign up through a third-party provider (such as Google), we receive your basic profile information from that provider.

LMS Data

When you connect your Canvas or Moodle account through our Chrome extension, we collect course content that you choose to sync. This includes assignment details, course materials, grades, syllabi, and other academic content available through your LMS. We only access data from courses you explicitly choose to connect.

Usage Data

We collect information about how you interact with AC3, including pages visited, features used, study sessions completed, and general usage patterns. This helps us improve the product and your experience.

Payment Information

Payment processing is handled by Stripe. We do not store your credit card number, CVC, or full card details on our servers. Stripe provides us with a tokenised reference to your payment method, along with your billing email and subscription status.

3. How We Use Your Information

• Providing the service: Displaying your courses, generating study materials, creating flashcards, and powering AI-assisted study features.
• AI processing: Your course content is sent to OpenAI and Anthropic APIs to generate summaries, answer questions, create practice exams, and provide other AI-powered study tools. See Section 4 for details on how AI providers handle your data.
• Improving AC3: Analysing usage patterns to fix bugs, improve features, and develop new functionality.
• Billing: Processing subscription payments and managing your account status through Stripe.
• Communication: Sending you important account notifications, such as subscription changes or service updates. We do not send marketing emails without your consent.

4. AI Processing and Third-Party AI Providers

AC3 uses AI models from OpenAI and Anthropic to power its study features. When you use AI-powered features, relevant portions of your course content are sent to these providers for processing.

Both OpenAI and Anthropic process your data to generate responses but do not use data submitted through their APIs to train their models. Your content is processed in real time and is not persistently stored by these providers beyond what is needed to complete the request.

We take care to send only the content necessary for each request, and we do not send your personal account details (such as your email or name) to AI providers.

5. Data Storage

Your structured data (account info, course metadata, grades, assignments) is stored in Supabase, which runs on PostgreSQL and is hosted on secure cloud infrastructure.

To power search and AI retrieval features, we create vector embeddings of your course content and store them in Pinecone. These embeddings are mathematical representations of your content used for similarity search — they are not human-readable copies of your materials.

Both Supabase and Pinecone employ encryption at rest and in transit. Access to your data is restricted to your authenticated account.

6. Chrome Extension

Our Chrome extension accesses your LMS pages to extract course content. The extension only activates on Canvas and Moodle domains that you have connected. It reads page content from your LMS to sync assignments, materials, and grades with AC3.

The extension does not track your browsing activity on other websites, inject ads, or collect data outside of your connected LMS pages.

7. Cookies and Local Storage

We use minimal cookies. Specifically, we use authentication tokens to keep you signed in and maintain your session. We do not use third-party advertising or tracking cookies.

The Chrome extension may use local storage in your browser to cache sync preferences and authentication state.

8. Data Sharing

We share your information only with the following parties:

• OpenAI and Anthropic: Course content sent for AI processing (see Section 4).
• Stripe: Payment and billing information for subscription processing.
• Supabase and Pinecone: Your data is stored on their infrastructure as described in Section 5.

We do not sell your personal information to third parties. We do not share your data with advertisers.

9. Your Rights

Under the Australian Privacy Act and general best practice, you have the right to:

• Access your data: Request a copy of the personal information we hold about you.
• Correct your data: Ask us to update or correct inaccurate information.
• Delete your account: Request deletion of your account and all associated data. You can initiate this from your account settings or by contacting us at support@ac3app.com. Upon deletion, we remove your data from Supabase and Pinecone within 30 days.
• Export your data: Request an export of your data in a portable format.
• Complain: If you believe we have breached your privacy, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

10. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access. This includes encryption of data in transit (TLS) and at rest, role-based access controls, and regular security reviews.

However, no system is completely secure. If you become aware of any security issues, please contact us immediately at support@ac3app.com.

11. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal information and course data within 30 days, except where we are required by law to retain certain records.

Anonymised, aggregated usage data that cannot identify you may be retained indefinitely for analytics and product improvement.

12. International Data Transfers

AC3 is based in Australia, but our service providers (Supabase, Pinecone, OpenAI, Anthropic, Stripe) may process data in other countries, including the United States. By using AC3, you consent to the transfer of your data to these providers. We take reasonable steps to ensure that overseas recipients handle your data in accordance with the Australian Privacy Principles.

13. Children's Privacy

AC3 is designed for university students and is not intended for children under the age of 16. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected data from a person under 16, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you via email or through the AC3 app. Your continued use of AC3 after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

AC3
Email: support@ac3app.com