Smartby

Privacy Policy

Last Updated: May 2026

1. Definitions

  • Controller / Service Provider – Nearby Studio Łukasz Gola, a sole proprietorship with business address at Piaskowa 25, 47-134 Centawa, Poland, Polish tax ID (NIP): 7561994740, REGON: 541810208.
  • Smartby / Platform / Application – the website available at www.smartby.app and the related web or mobile application provided by the Controller.
  • User – a person using Smartby, including an account holder, subscriber, parent/guardian, or minor using the Platform with parental/legal guardian consent where required.
  • Account – an individual User profile enabling access to Platform features.
  • Services – Smartby educational features, including AI chat, math learning tools, notes, document analysis, generation of educational materials, family accounts, and other digital content or services.
  • Subscription – paid access to selected Platform features in a recurring billing model, handled with Stripe.
  • Service Providers – external technical providers supporting the Platform, such as hosting, database, payment, email, analytics, and AI providers.
  • Personal Data – information relating to an identified or identifiable natural person within the meaning of the GDPR.

2. Data Controller and Contact

The controller of personal data processed within the Platform is:

  • Business name: Nearby Studio Łukasz Gola
  • Address: Piaskowa 25, 47-134 Centawa, Poland
  • NIP: 7561994740
  • REGON: 541810208
  • Email: contact@smartby.app
  • Smartby is the name of the application/platform and is not a separate company or legal entity.
  • The Controller has not appointed a data protection officer. For all personal data matters, please contact us at the email address above.

3. Data We Process

The scope of data depends on which Platform features you use:

3.1 Account and Login Data

  • email address, user ID, display name, account role, and account settings;
  • authentication information, including encrypted or hashed login data handled by the authentication provider;
  • parent-child relationship information if you use family accounts.

3.2 User Content and Learning Data

  • messages, tasks, questions, notes, documents, files, images, spreadsheets, answers, and other materials uploaded or created in the Platform;
  • learning history, progress, results, activity in lessons, quizzes, exercises, and assignments;
  • AI-generated content created in response to your prompts.

3.3 Payment and Subscription Data

  • subscription plan, payment status, billing cycle, customer and transaction identifiers;
  • billing details and card details are processed by Stripe. We do not store full payment card numbers.

3.4 Technical, Security, and Cookie Data

  • IP address, device type, browser, operating system, technical logs, session identifiers, and security events;
  • cookies and similar technologies required for login, settings, application functionality, and, if enabled, usage analytics.

3.5 Communications and Support

  • support requests, email correspondence, and information needed to handle questions, complaints, and data rights requests.

4. Purposes and Legal Bases

  • performance of a contract or steps before entering into a contract (Art. 6(1)(b) GDPR) – account creation, login, providing Services, subscriptions, family accounts, AI features, and support;
  • legal obligation (Art. 6(1)(c) GDPR) – accounting, tax, consumer rights, and legally required documentation;
  • legitimate interest (Art. 6(1)(f) GDPR) – Platform security, abuse prevention, legal claims, basic service analytics, quality improvement, and stability;
  • consent (Art. 6(1)(a) GDPR) – marketing, newsletter, optional analytics, or other voluntary features where consent is required;
  • parental/legal guardian consent under Art. 8 GDPR – where processing of a child under 16 is based on consent for information society services.

5. AI Services and Third-Party Providers

To provide the Services, we may share data with selected providers only to the extent necessary for Platform operation:

  • OpenAI and other AI model providers used by a given feature – to process questions, documents, images, prompts, and generate educational responses;
  • Wolfram Alpha – for mathematical computations and scientific queries in modes using this integration;
  • Supabase – for authentication, database, and file storage;
  • Stripe – for payments, subscriptions, invoicing, and the customer portal;
  • Vercel and related infrastructure services – for hosting, security, technical logs, and website analytics;
  • Resend or another transactional email provider – for account, support, and service-related messages;
  • voice, transcription, or speech synthesis providers, if such features are made available and you use them.
  • We do not sell personal data. Providers process data under their own terms, data processing agreements, or other appropriate safeguards.

6. Transfers Outside the EEA

  • Some providers, especially AI, payment, hosting, or analytics providers, may process data outside the European Economic Area, including in the United States.
  • In such cases, we use appropriate safeguards required by the GDPR, such as standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms.

7. Data Retention

  • account data is retained while the account exists and, after deletion, for the period needed for settlements, security, legal claims, or legal obligations;
  • payment, invoice, and accounting data is retained for the period required by tax and accounting law;
  • user content, learning history, and AI interaction data are retained while the account exists or until deleted, unless further retention is needed for legal, security, or settlement reasons;
  • technical and security logs are retained for the period necessary to protect the Platform, detect abuse, and diagnose errors;
  • data processed based on consent is retained until consent is withdrawn, unless another legal basis applies.

8. Your Rights

Under the GDPR, you have the following rights:

  • access to your data and information about processing;
  • rectification of inaccurate or incomplete data;
  • erasure of data in cases provided by the GDPR;
  • restriction of processing;
  • data portability where processing is based on consent or contract and carried out by automated means;
  • objection to processing based on legitimate interest;
  • withdrawal of consent at any time without affecting the lawfulness of processing before withdrawal;
  • to exercise your rights, contact us at contact@smartby.app.

9. Complaint to a Supervisory Authority

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Poland this is:

  • President of the Personal Data Protection Office (UODO)
  • ul. Stawki 2, 00-193 Warsaw, Poland
  • www.uodo.gov.pl

10. Children and Family Accounts

  • Smartby may be used by minors only in accordance with the Terms of Use and with parental/legal guardian consent and supervision where required.
  • For services offered directly to a child, where processing is based on consent, a child under 16 requires consent from a parent or legal guardian.
  • A parent or guardian may contact us to access, correct, or delete a child’s data, subject to legal and account security limitations.
  • We aim to make notices addressed to minors clear and understandable.

11. Cookies and Similar Technologies

  • we use essential cookies for Platform operation, including login, session maintenance, security, and remembering settings;
  • we may use analytics cookies or similar technologies to measure website performance and feature usage, to the extent permitted by law and consent settings;
  • you can manage cookies in your browser settings. Restricting essential cookies may limit or prevent use of parts of the Platform;
  • if a consent banner or preference center is implemented, you can update your choices there.

12. Data Security

  • we use organizational and technical measures to protect data, including encrypted transmission, access control, authentication mechanisms, permission limits, and infrastructure safeguards;
  • no method of transmission or storage is absolutely secure, so please protect your login details and report suspicious events.

13. Changes to This Privacy Policy

  • we may update this Privacy Policy when Platform features, providers, laws, or data processing practices change;
  • material changes will be announced on the website, in the app, or by email where appropriate;
  • the current version of the Privacy Policy is available on this page.
Privacy Policy | Smartby