Privacy

What Curioscape holds about you, why, and what you can do about it.

Version 2026-10-28.

1. Introduction

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you access or use Curioscape, including our website, applications, and AI‑powered educational services (together, the “Platform”).

The “Platform” described in this Privacy Policy refers to the same services described as the “Services” in our Terms of Service.

We are committed to protecting your privacy and handling your personal data in a transparent and secure manner, in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy applies to all users of the Platform, including individual learners, parents or guardians, and users accessing the Platform through schools or other educational institutions.

2. Who we are (data controller)

Curioscape is operated by Singularity Studio Ltd, a company registered in England and Wales.

  • Company name: Singularity Studio Ltd
  • Company number: 16719376
  • Trading name: AI Study Studio
  • Role: Data Controller (for the purposes of UK GDPR)
  • Registered office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom
  • Contact email: info@aistudystudio.com
  • ICO registration number: ZC061864

3. Information we collect

We collect different categories of personal data depending on how you interact with the Platform.

3.1 Account and identity data

When you create and use an account, we collect:

  • Your email address, and whether it has been verified. We do not ask for your name.
  • Your unique user identifier (UID)
  • Sign-in and session information needed to keep you signed in, including the IP address and browser each session was started in
  • If you sign in with Google or Microsoft, their own identifier for you and whether they have verified your email address. We keep none of the tokens they return.
  • Which versions of our Terms of Service and this Privacy Policy you accepted, when, and how you signed in

Important note on passwords: if you sign up with a password, we store only a salted one-way hash of it, never the password itself.

If you sign in with Google or Microsoft, they send us your email address, whether they have verified it, and their own identifier for you, by which we know you when you next sign in. We do not accept an email address they have not verified. They also send:

  • From Google, where your Google account belongs to an organisation, such as a school, the organisation’s domain
  • From Microsoft, which organisation your account belongs to, or that it is a personal account, and your name and username, which Microsoft sends as part of the basic profile we ask it for

We neither use nor keep any of these.

3.2 Profile and preferences data

You may choose to provide, and we may store, profile and preference information such as:

  • The subjects, courses, and exam boards you choose, and your preferences
  • Your guardian’s name and email address, where you provide them
  • Subscription tier/status metadata (see Section 3.5)

3.3 Learning and study data

When you play and study, we collect and generate learning and usage data, which may include:

  • What you do in each island: the steps you take and your progress
  • Your answers, as you gave them, and how each was marked: the numbers you give and the choices you make
  • The Echoes you review, and how you did

Questions that take an answer in your own words are not offered yet. Before they are, this notice will say how long those words are kept.

This data is used to provide and personalise the learning experience, track progress, and operate core Platform features.

3.4 The narrator

If you talk to the narrator, we process:

  • What you write or say to the narrator (and any context you include)
  • Conversation history (your messages and the narrator’s replies)
  • Session metadata (for example, which island and step you were on)
  • System outputs generated to support these features (for example, safety classifications)

This data is stored in our database to provide conversation continuity, session history, safety monitoring, and debugging. The written text of a conversation is kept for 12 months, or, where it raised a safety flag, until that flag has been dealt with if that is later. Audio is never kept.

3.5 Subscription and billing data

If you start a paid subscription, we (and our payment processor) may process:

  • Subscription tier and status (for example, active or canceled)
  • Stripe customer/subscription identifiers and billing-related metadata
  • Payment status and billing events

Card details: Payment card details are handled by Stripe. We do not store full card numbers or CVV in our systems.

3.6 Technical, device, and log data

We automatically collect certain technical information when you access the Platform, including:

  • Device type, operating system, browser type, and version
  • IP address
  • Usage and diagnostic data (for example, performance logs, error reports, and how smoothly the islands run on your device)
  • Rate-limiting/security signals (for example, request counters, kept against a keyed hash of your IP address or account rather than the address or account itself)

3.7 Cookies and similar technologies

We use cookies and similar technologies to operate the Platform. In particular:

  • A strictly necessary cookie named __Secure-better-auth.session_token keeps you signed in. It is httpOnly and lasts five days from when you sign in, renewed once a day while you use the Platform, or until you sign out. After a sign-in that asks not to be remembered, it lasts until you close your browser, and keeps you signed in for a day at most.
  • While you sign in with Google or Microsoft, a strictly necessary cookie named __Secure-better-auth.state ties their answer to your browser, for five minutes at most.
  • If a sign-in asks not to be remembered, a cookie named __Secure-better-auth.dont_remember says so until you close your browser or sign out.
  • When you sign out, a strictly necessary entry named curioscape.sign-out-owed is kept in your browser’s local storage until our server confirms the sign-out. If it does not, your browser sends the sign-out again, before anything else, the next time you open a page that uses your account. The entry holds a random value that identifies no one. It is also removed when you sign in again, or when you clear your browser’s storage for the Platform.

For more information, see Section 12 (Cookies).

3.8 Communications and support

If you contact us or we contact you, we may process:

  • Messages you send to us (support requests, feedback)
  • Email delivery metadata (for example, delivery status), where we send transactional emails

3.9 Voice (optional features)

If you use voice features, what you say, or the text to be read aloud, may be processed by third-party speech providers in order to transcribe it or generate audio.

3.10 Data you provide about others

If you provide information about someone else (for example, a guardian’s email address), you must ensure you have the authority to do so. We will process that information for account management and safeguarding-related functionality where enabled.

3.11 Special category data / sensitive information

We do not ask you to provide special category data (such as health information). However, you may choose to include sensitive information in free-text fields (for example, when you talk to the narrator). If you do, we will process it in order to provide the service, and we recommend you avoid sharing sensitive personal information unless it is necessary.

4. How we use your information

We use personal data only where permitted by law and for the following purposes:

  • To provide, operate, and maintain the Platform
  • To personalise learning experiences and deliver educational content
  • To track learning progress and generate feedback
  • To improve our AI systems and educational features
  • To communicate with users about accounts, updates, and support matters
  • To ensure platform security, prevent misuse, and enforce our Terms of Service
  • To comply with legal and regulatory obligations

Any improvement of our systems is performed in accordance with applicable data protection law. We do not permit third-party providers to use personal data to train their own general-purpose models, and we do not use personal data to train general-purpose AI models unrelated to providing or improving the Platform.

Nothing you write or say to the narrator is ever used to train AI models: not your words, the audio of what you say, or its transcript.

We do not use personal data for purposes that are incompatible with those described in this Privacy Policy.

5. Legal bases for processing

Under UK GDPR, we rely on the following lawful bases to process personal data:

  • Performance of a contract – where processing is necessary to provide the Platform and related services
  • Legitimate interests – to improve our services, enhance learning outcomes, ensure security, and prevent abuse (balanced against user rights)
  • Consent – where required, such as for certain cookies or marketing communications
  • Legal obligations – where processing is necessary to comply with applicable laws

Where consent is required, you may withdraw it at any time.

6. Sharing and disclosure of personal data

We do not sell personal data.

We may share personal data with trusted third parties only where necessary to operate the Platform, provide our services, comply with legal obligations, or protect our rights.

6.1 Service providers (processors)

We use third-party service providers who process personal data on our behalf and under our instructions. These providers act as data processors and are contractually required to implement appropriate technical and organisational measures to protect personal data.

Categories of service providers may include:

  • Sign-in providers, Google and Microsoft (where you choose to sign in with them)
  • Cloud hosting and infrastructure providers (to host and operate the Platform)
  • Payment processing providers (to manage subscriptions and billing)
  • Email and communications providers (to send transactional and service-related emails)
  • AI and machine learning service providers (to deliver the narrator and other AI-powered educational features)
  • Analytics, monitoring, and error-tracking providers (to ensure performance, reliability, and security)
  • Speech providers (where users enable voice features)

These providers are permitted to process personal data only for the purposes of providing services to us and not for their own independent purposes.

6.2 Legal and regulatory disclosure

We may disclose personal data where required to do so by law, court order, or regulatory authority, or where disclosure is necessary to:

  • Comply with a legal obligation
  • Enforce our Terms of Service
  • Protect the rights, property, or safety of users, schools, or others
  • Detect, prevent, or investigate fraud, misuse, or security issues

6.3 Business transfers

If we are involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

7. International transfers

Some of our service providers may be located outside the United Kingdom, or may process personal data outside the UK (for example, where cloud infrastructure or support operations are based overseas).

Our primary infrastructure is hosted in the United Kingdom and/or the European Economic Area unless otherwise stated.

Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place to protect your data, in accordance with UK GDPR. These safeguards may include:

  • Transfers to countries that have been deemed to provide an adequate level of data protection by the UK government; or
  • The use of approved standard contractual clauses or equivalent legal mechanisms.

We take steps to ensure that any international transfers are lawful and that your personal data continues to be protected to a standard equivalent to that required under UK data protection law. Where applicable, we conduct transfer risk assessments.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide the Platform, comply with legal obligations, resolve disputes, and enforce our agreements.

Retention periods may vary depending on the type of data and how it is used. In general:

  • Account data is retained for as long as your account remains active.
  • Learning and study data, as Section 3.3 lists it, is retained while your account is active, unless you request deletion earlier or a longer retention period is required by a legal obligation. The written text of a conversation with the narrator is kept only as long as Section 3.4 says.
  • Subscription and billing records are retained for as long as required for accounting, tax, and regulatory purposes.
  • The record of a session, with the IP address and browser it was started in, is deleted when you sign out, or within a day of the session expiring.
  • Our server logs are kept for one month, and the counters that limit sign-in attempts for no more than a day.
  • A guardian’s name and email address are kept until you change them, the guardian chooses “this isn’t me” in the email we send them, or your account is deleted. A guardian who has not confirmed within a fortnight is deleted.
  • If a guardian chooses “this isn’t me”, we keep their email address, with the account it may not be added to again, until that account is deleted.
  • When an account is deleted, everything our database holds under it is deleted at once, in a single step. It remains in our backups for up to 35 days, until they expire. We keep the deleted account’s identifier, and nothing else, for a little longer than that, so that if we ever restore a backup, we delete the account from it again.

Where data is no longer required, it is securely deleted or anonymised.

9. Security of your information

We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include:

  • Access controls and authentication mechanisms
  • Encryption of data in transit and, where appropriate, at rest
  • Secure configuration of databases and infrastructure
  • Monitoring and logging to detect misuse or security incidents
  • Regular review of security practices and controls

No system is completely secure, and we cannot guarantee absolute security. However, we take reasonable and proportionate steps to protect personal data in line with industry standards and the risks involved.

Users are responsible for keeping their account credentials secure and for notifying us promptly of any unauthorised use of their account.

10. Children and educational accounts

Curioscape is designed for use by students, including children, in educational settings.

10.1 Use by children

Where the Platform is used by children:

  • Each learner holds their own account. A learner may add a guardian’s name and email address, which is where a safety email goes.
  • We do not knowingly require children to provide more personal data than is necessary to use the Platform.
  • We do not use children’s personal data for marketing purposes.
  • The Platform is not for children under the age of 13.

10.2 Safeguarding and wellbeing features

The Platform may include safeguarding or wellbeing-related features (for example, alerts based on certain types of user activity or content).

Where enabled, such features are designed to support student safety and educational oversight. Any data processed for these purposes is handled with appropriate care and is shared only with authorised parties (such as the relevant guardian), in accordance with the Platform’s configuration. To avoid unnecessary disturbance, certain safeguarding notifications may be rate-limited.

11. Your rights under UK GDPR

Under UK data protection law, you have certain rights in relation to your personal data. These rights may vary depending on the context in which your data is processed.

11.1 Your rights

Subject to applicable law, you may have the right to:

  • Access – request a copy of the personal data we hold about you
  • Rectification – request correction of inaccurate or incomplete personal data
  • Erasure – request deletion of your personal data (the “right to be forgotten”)
  • Restriction – request that we limit how your data is processed
  • Objection – object to processing based on legitimate interests
  • Portability – request a copy of certain data in a structured, commonly used format
  • Withdraw consent – where processing is based on consent, you may withdraw it at any time

11.2 Exercising your rights

To exercise your rights, please contact us using the details in Section 14. We may need to verify your identity before responding.

We aim to respond to valid requests within the time limits required by law.

12. Cookies and similar technologies

We use cookies and similar technologies to operate the Platform.

12.1 Strictly necessary cookies

Some cookies are strictly necessary for the Platform to function properly. These may include cookies used to:

  • Maintain user sessions
  • Keep you signed in
  • Enable core security and authentication features

These cookies do not require your consent. Section 3.7 lists the ones we set.

12.2 Optional cookies

We do not currently use cookies that are not strictly necessary. If we do (for example, analytics or preference-related cookies), we will obtain your consent where required by law.

You can block cookies in your browser, but parts of the Platform may not function correctly.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Platform.

When we make changes, we will update the version date shown at the top of this policy. Where changes are material, we may also notify users through the Platform or by other appropriate means.

We encourage you to review this Privacy Policy periodically.

14. Contact information and complaints

If you have any questions about this Privacy Policy or how we handle personal data, you can contact us at:

  • Email: info@aistudystudio.com
  • Company: Singularity Studio Ltd
  • Address: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom

For enquiries specifically relating to personal data or your data protection rights, please contact us at info@aistudystudio.com, with the subject line “Data Protection Request”.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk.

This Privacy Policy should be read together with our Terms of Service.