Privacy Policy

Last updated: 3 September 2026

This Privacy Policy explains what personal data ImpulsiQ collects about you, why we collect it, who we share it with, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018). It applies to the ImpulsiQ website and web application (the "Service").

Who We Are

ImpulsiQ is operated by Arafat Rais ("ImpulsiQ", "we", "us", "our"), based in the United Kingdom. For the purposes of UK data protection law, we are the data controller of the personal data described in this policy.

If you have any questions about this policy or want to exercise your rights, contact us at hello@impulsiq.co.uk.

Data We Collect

We collect and process the following categories of personal data:

Account data — your first and last name, email address, and a password (stored only in hashed form by our authentication provider; we never see your plain-text password).
Profile & curriculum data — your university, year of study, subscription tier and in-app settings, so we can load the right content for your course.
Learning & performance data — the exams you generate, your answers, marks and scores, mistake-bank entries, topic statistics, and any questions you choose to share to the community bank.
Content you submit — text or lecture material you upload or type in to generate questions. This content is sent to our AI provider (see below) to produce and mark questions.
Payment data — if you buy a paid tier, your payment (a one-time charge — we don't operate subscriptions) is processed by Stripe. We do not receive or store your full card details; we store a Stripe customer reference and payment status (amount, date, tier).
Technical & usage data — IP address, browser and device type, pages visited, and API/usage logs (including AI token usage), collected automatically to run, secure and improve the Service.

We do not intentionally collect special-category data (e.g. health data). Please do not submit such data when generating questions.

How & Why We Use It, and Our Lawful Basis

Under the UK GDPR we must have a lawful basis for each use of your data:

To provide the Service — creating and managing your account, generating and marking questions, and saving your progress. Lawful basis: performance of our contract with you.
To take payment — processing one-time purchases and keeping financial records. Lawful basis: contract, and legal obligation (tax/accounting).
To secure and improve the Service — preventing fraud and misuse, diagnosing problems, and understanding how features are used. Lawful basis: our legitimate interests in running a safe, reliable service.
To contact you — service and account emails (e.g. confirmations, security notices). Any optional marketing email is sent only with your consent, which you can withdraw at any time.
To comply with the law — responding to lawful requests and enforcing our Terms. Lawful basis: legal obligation / legitimate interests.

We do not sell your personal data. We share it only with service providers ("processors") that help us run the Service, under contracts that require them to protect it:

Supabase — database, authentication and storage of your account and learning data.
Google (Gemini API) — processes the content you submit to generate and mark questions. Calls are routed through our proxy hosted on Cloudflare.
Cloudflare — our AI proxy, content delivery, security/anti-abuse protection, and privacy-friendly, cookieless web analytics (aggregate traffic).
Vercel — hosting of the website and application, and privacy-friendly, cookieless web analytics (aggregate traffic and page-load performance).
Stripe — payment processing for one-time purchases.

We may also disclose data if required by law, or to protect our rights, users or the public.

International Transfers

Some of our providers are based in, or process data in, countries outside the UK (including the United States). Where personal data is transferred outside the UK, we rely on appropriate safeguards — such as UK "adequacy" regulations, the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum — so your data receives an equivalent level of protection.

Retention

We keep your personal data only for as long as we need it:

Account & learning data — for as long as your account is active. If you close your account (or request deletion), we delete or anonymise it within a reasonable period, except where we must keep it for the reasons below.
Payment & financial records — retained for up to 6 years to meet UK tax and accounting requirements.
Backups & logs — residual copies in backups are overwritten on our providers' normal backup cycles.

Your Rights

Under the UK GDPR you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — have inaccurate or incomplete data corrected.
Erasure — ask us to delete your data ("right to be forgotten"), subject to legal exceptions.
Restriction — ask us to limit how we use your data.
Portability — receive certain data in a portable, machine-readable format.
Object — object to processing based on our legitimate interests, and to any direct marketing.
Withdraw consent — where we rely on consent, withdraw it at any time.

To exercise any of these, email hello@impulsiq.co.uk. We will respond within one month. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk — though we'd appreciate the chance to resolve your concern first.

Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS), authentication safeguards, access controls, and reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Age & Children

The Service is intended for university-level students and is not directed at children. You must be at least 18 years old (or the age of majority where you live) to create an account and subscribe. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, take reasonable steps to notify you (for example, by email or an in-app notice).

Contact Us

For any privacy question or data-protection request:

Email: hello@impulsiq.co.uk