Learning Companion — Privacy Policy Version 1.0 • Last updated 25 October 2026 Operator: GENERATIONX TECHNOLOGY LTD Company number: 14787956 (England and Wales) Registered office: Unit 312, 1 Quality Court, London, WC2A 1HR, United Kingdom Contact: gxtechuk@gmail.com 1. Who is responsible GenerationX Technology Ltd operates Learning Companion and is responsible for the personal data described here. Contact gxtechuk@gmail.com for privacy questions, complaints and rights requests. This notice covers the Android app and its account, learning, subscription and support services. 2. Information we process Account and profile: our backend stores your account identifier, sign-in email and verification status, display name, age group, learning interests, optional contact email and its verification status, onboarding status, access role and account-reset controls. Authentication is handled by Supabase, including identity records, session/refresh-token records and security/audit metadata such as times, IP addresses and device/browser information. Verification records may include hashed verification codes, delivery status, failed-attempt counters and expiry times. Learning: your device holds learning content, quizzes, answers and settings. We synchronise journey-level information: selected subjects/topics and goals, level, recommendation reason, journey status, preferred duration, planned/completed learning counts and time, current stage/moment position, and creation/update/completion times. It does not store full lesson-card text or individual quiz answers as separate cloud records. Relevant content or answers can still be processed during an online AI request, as explained below. Subscriptions and service use: backend records can include plan/status, product and base-plan identifiers, trial and entitlement dates, renewal status, order references, purchase-token hashes, verification attempts, allowance reservations and consumption/refund records. AI service records include account-linked request/session identifiers, provider/model/route, counters, timing and temporary request permits. These are not a separate database archive of every AI prompt and response. Google Play handles payment details; we do not receive your full card details. Deletion and recovery: we retain request identifiers/status/times, ownership-verification and recovery records, public recovery keys, attempt limits, operator review/evidence references and execution/audit records to process requests securely and record what happened. Some of these can remain associated with the former account identifier after the live account has been deleted. Public recovery keys are different from private keys kept on your device. Support and technical operations: we process the correspondence and attachments you send us. Support correspondence is processed through our support email systems. Providers also process technical network/error/security logs. Local diagnostic logs may include app-use or learning context. Optional features process their corresponding information when you use them. 3. Optional Android access The overlay permission allows a learning bubble or card to appear over other apps. It does not itself grant access to their content. If enabled, Accessibility-based detection uses foreground-app/window package identifiers to recognise selected apps and trigger learning. The implemented detector does not read message bodies, passwords, keystrokes or screen images. Usage Access provides app-use events/statistics for foreground detection and optional learning-interest recommendations. The app can list launchable apps for your selected-app controls. Raw app-use history is used on the device. Derived interest categories can be included in learning personalisation sent to our backend and AI providers. App identifiers and timing can also appear in local diagnostic logs. You can disable optional access or personalisation through the app and Android Settings. Declining access limits the corresponding trigger or personalisation feature; it does not authorise unrelated collection. 4. Why we use data and our lawful bases We use account, learning and entitlement data to provide the service you request and perform our contract with you. Required account and subscription information is needed for online learning and paid access; optional profile choices can be left out where the app permits. We rely on legitimate interests to protect accounts, prevent fraud, enforce fair-use limits, maintain service reliability, investigate faults and handle support. We weigh these interests against your rights and limit the information used. We process records where necessary to meet legal obligations and resolve legal claims. Where a feature requires consent, we ask separately before that processing. Android permissions are device controls and are not blanket consent to every use described here. You may withdraw consent for optional processing without affecting earlier lawful processing. Reading this notice is not consent to marketing or AI training. 5. AI learning and recommendations For online generation, our backend sends learning-request information to configured AI providers, Google Gemini and/or Groq. Requests may contain topics, learning goals, age group, derived interests and relevant learning/quiz continuity. Generated content is returned to the app and may be saved with your learning state. Avoid putting sensitive, confidential or third-party personal information in free-text requests. Google Gemini and Groq receive relevant learning-request information to produce content. Google documents 55-day retention of prompts, context and outputs for abuse monitoring, with restricted human review of flagged content. Its terms explain the restrictions on other uses of this information, including regional protections. Groq does not use inputs or outputs to train models without customer permission. Ordinary inference content is not retained by default, but reliability or abuse logs may retain it for up to 30 days, or longer if legally required. Groq retains usage metadata separately; retained customer content is stored in the United States. These periods concern provider records, not our learning-history records. We do not promise zero provider retention. Read the applicable provider information at https://ai.google.dev/gemini-api/terms , https://ai.google.dev/gemini-api/docs/usage-policies and https://console.groq.com/docs/your-data . Recommendations personalise educational content. We do not use them to make decisions about employment, credit, healthcare or other matters with legal or similarly significant effects. 6. Who receives information Supabase supplies account authentication, database and backend hosting. Brevo supplies transactional verification emails. Google Gemini and Groq supply configured AI generation. Google Play supplies billing and purchase validation, and handles its own Google-account/payment information. Authorised support and technical operators access information only as needed for their responsibilities. We may disclose information where required by law, to protect rights or to professional advisers subject to appropriate confidentiality. We do not sell your personal data or use the app to deliver targeted advertising. We do not send verification codes, account session tokens or payment-card details to AI models as learning content. 7. Storage locations and international processing Our currently selected backend region is Ireland. This does not mean all processing stays in Ireland: email, AI, billing and support providers may process information in other countries. International transfers must use the safeguards required by applicable law, such as adequacy decisions or approved contractual measures. Ask gxtechuk@gmail.com for information about the safeguards applicable to your data. 8. How long information is kept We keep account/profile and synchronised journey information while your account is maintained to provide learning continuity, and remove owned app data when account deletion is fulfilled, subject to the limited reasons below. Local content can remain until you clear it or uninstall, subject to Android behaviour. Signing out alone does not necessarily erase it. Verification codes, temporary request permits and allowance reservations have validity or activity windows. Those windows prevent expired records being used; expiry does not necessarily erase the stored verification record. For example, successful contact-email verification clears the pending verification email and hashed code after successful verification while retaining limited status/counter information. Other expired or failed verification records may remain until replaced or cleaned up as part of account/deletion processing. Subscription verification, usage counters and allowance records support current access, fraud prevention and dispute handling. Deletion/audit evidence may survive the live account's removal to demonstrate fulfilment, resolve a dispute and prevent inappropriate restoration. The applicable criteria are the continuing operational/security purpose, any legal duty and whether a dispute or recovery risk remains; records must not be retained merely because storage is available. We review those purposes and handle requests to restrict or erase information where the law requires. Support correspondence is retained for resolving your request and relevant follow-up or disputes. Provider technical logs and recovery copies have separate retention rules. We do not promise a single fixed automatic purge period for every category or immediate removal from all recovery copies. Where information is retained following a deletion request, we will explain the relevant category and reason. Recovery copies must not be used to restore a deleted account to ordinary service without reconciling its deletion. 9. Account deletion and subscriptions Use Delete account in account settings or request deletion at https://learning-companion-account-deletion.mizanurrahmanshakil.chatgpt.site/ . You can also contact gxtechuk@gmail.com. We verify account ownership before acting. A request or verification code alone is not confirmation that deletion has finished. Our support team may need to process the request and guide you through device cleanup. We remove the account and its owned app data, subject to the limited retention reasons above. We will explain any lawful refusal or retained category. Deleting the app or account does not by itself cancel a Google Play subscription. Cancel separately through Google Play to stop renewal. Google retains its own billing records. We cannot remotely erase independent copies you exported or data on a device that is unavailable for cleanup. 10. Your rights Depending on applicable law, you may request access, correction, erasure, restriction, portability or object to processing, including processing based on legitimate interests. You may withdraw consent where we rely on it. Contact gxtechuk@gmail.com; we may request proportionate proof of identity and respond within the applicable legal period, normally one month for UK data-rights requests, subject to lawful extensions. You can complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or your local supervisory authority. Contacting us first is optional. 11. Age, security and changes Learning Companion's public release is for adults aged 18 or older. Do not create an account if you are under 18. Contact us if you believe a child's information has been supplied. We use access controls, authenticated backend checks, encrypted network connections and protected device storage. No service can guarantee absolute security. Keep your email, device and verification codes secure. We will update this notice when data practices change and bring material changes to your attention before a new use requires it. The version above identifies this copy. You can save a copy using Share in the document viewer.