Privacy policy

The short version

We collect what we need to run your account, build your pathway, answer your questions to CERA and take payment.
We don’t sell your data or use it for advertising, and we only use analytics cookies if you allow them.
Your questions to CERA go to OpenAI, which doesn’t train its models on them. Card details go straight to Stripe.
You can see, correct, download or delete your data at any time.

Who we are

The ChemEng Student LTD is the controller of your personal data: we decide how and why it’s used. We’re registered in Scotland, company number SC728384, with our registered office at 220 Mallace Avenue, Armadale, Bathgate, Scotland, EH48 2GE, and registered with the Information Commissioner’s Office under number ZB574074. For anything about your data, email info@chemengstudent.com.

What we collect and why

Each use ends with its lawful basis: the legal reason we rely on.

Account: your email address and sign-in codes and, if you sign in with Google, the name, email and photo Google shares. (Contract.)
Setup and learning: your setup and topic check answers, the name and university you add in Settings, your email preferences, and your progress: lessons, video watch time, checkpoint answers and the announcements you’ve read. Before you have an account, a cookie links your setup answers to your browser. (Contract, or steps you ask us to take before one.)
Profile: the username and profile picture you choose to add in Settings, and the colours you choose for your initials. For now only you see them; when shareable profiles arrive, sharing yours will be your choice. Your picture is stored privately, and removing it in Settings deletes the file. (Contract.)
Payments: Stripe collects your card and billing details, and tells us your customer reference, plan, subscription status and invoices. (Contract, and our legal duty to keep financial records.)
Emails: sign-in codes and messages about your account and payments (contract), and study reminders, summaries and feature news, which you can switch off in Settings or with the unsubscribe link (our legitimate interest in helping you study).
Case requests: the process you ask us to write up in Industrial Cases, its industry and why you want it, anything you add about what it should teach or a plant you have in mind, your plan and year, and the requests you vote for. Once we’ve read a request, other students see its process, its industry, anything you said it should teach and how many votes it has, but never who asked or who voted. We use it to decide which case studies to write next. (Contract.)
Pro waitlist: your email and anything else you add to the form and, if you’re signed in, your account and plan. We use it to send the launch email and early-bird discount and to shape Pro. (Your consent, which you can withdraw by emailing info@chemengstudent.com.)
Contacting us: your emails and our replies. (Our legitimate interest in answering you.)
Security: your IP address, browser and device details and our server logs, used to keep the service running and stop abuse such as guessing sign-in codes. (Our legitimate interest in keeping the service secure.)
Analytics: only if you allow analytics cookies, Google Analytics records how the site is used: the pages you visit (their address, cut down to the page itself), how you arrived, your device, browser and rough location, and a random identifier kept in a cookie. We never send it your name, email or account, and it doesn’t store your IP address. We use it to see which parts of the platform help and to fix the rest. (Your consent, which you can withdraw at any time from Cookie settings, or from Settings in the app.)

We don’t ask for sensitive information, such as health details. Please leave it out of your questions to CERA.

CERA

When you ask CERA something, we send OpenAI your question, the earlier messages in that conversation and the lesson or question you’re looking at. So her answers suit you, we also send your first name, setup answers, hardest topics and place in your pathway, but never your surname or email. A code made from your account ID lets OpenAI spot misuse without knowing who you are. An automated safety check reads each message first, and she won’t answer one it flags.

OpenAI doesn’t train its models on what we send, and keeps it for no more than 30 days to detect abuse. We save your 50 most recent conversations, which you can delete at any time, with how much of your daily allowance each question used and any rating you give. (Contract.)

Beta feedback

During the beta, a Feedback tab on every page let you report what was broken, confusing or missing, with or without an account. The beta has ended and the tab is gone, but we keep the reports that were sent. Each holds what was written, the page it was sent from, the browser, screen size, connection, language, time zone and app version, how long the page took to load, any errors it ran into, any screenshot added to it and the plan it was sent on. Beta accounts were deleted before the full launch, so no report is linked to an account any more.

Only the team building the platform reads feedback, to fix and improve the service and, if you said we could, to write to you about it. (Our legitimate interest in making the service work, and our contract with you if you have an account.)

Cookies

We use the cookies and browser storage the app needs to keep you signed in, save your progress and remember your settings, and Google Analytics cookies only if you allow them. YouTube may set its own cookies when a lesson video loads. Our Cookie policy lists everything.

Only the companies that help us run the service, under contracts that limit what they may do with it:

Supabase: our database, sign-in and file storage, in Ireland.
Vercel: hosts the website and app.
OpenAI: powers CERA and her safety check.
Stripe: takes payments, and uses payment data to prevent fraud as a controller in its own right.
Brevo and our sign-in email provider: send our emails and your sign-in codes.
Google: when you sign in with Google or watch a lesson video on YouTube, and, if you allow analytics cookies, Google Analytics, which measures how the site is used for us.

We may also share data with our professional advisers, with the police or regulators where the law requires it, or with a buyer of our business. Only authorised staff see your account, and only when they need to, for example to answer a support request.

Transfers outside the UK

Vercel, OpenAI, Stripe and Google may process data in the United States. Whenever data leaves the UK it stays protected, by a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework) or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

How long we keep it

Account, setup answers, progress and settings: while your account is open, and deleted within a month of you asking us to delete it.
Setup answers never attached to an account: 30 days after you last changed them.
Conversations with CERA: your 50 most recent, until you delete them or your account.
Payment records: six years from the end of their financial year, as UK tax law requires.
Pro waitlist: until Pro opens and we’ve told you, or you ask us to remove you.
Case requests: for as long as they help us decide what to write. If you delete your account, your votes go and your requests stay without the link to you.
Beta feedback: while it helps us improve the service. If you delete your account, we keep the report without the link to you. You can ask us to delete one at any time.
Emails with us: as long as we need to deal with them.
Server logs: no more than 30 days.
Analytics: Google Analytics keeps its detailed records for no more than 14 months. Its cookies last up to two years, unless you clear them or switch analytics off, which removes them.

Your rights

You can ask to see, correct or delete your data, to limit or object to how we use it, and to receive it in a format you can take elsewhere, and you can withdraw consent wherever we rely on it. Email info@chemengstudent.com: we’ll reply within one month, and may first check it’s really you.

The setup and topic check use automated rules to suggest where you start, but make no decisions with legal or similarly significant effects, and you can change your answers at any time.

Children

The ChemEng Student isn’t for children under 13. If we learn that someone under 13 has an account, we’ll close it and delete their data, so tell us at info@chemengstudent.com if you think that has happened. If you’re under 18, you need a parent or guardian’s permission to create an account.

How we protect it

Everything between your browser and our servers is encrypted, scripts on the page can’t read your sign-in cookie, every request is checked against your own account, card details never reach our servers, and repeated sign-in attempts are limited. No system is completely secure, but we fix problems quickly when we find them.

Changes to this policy

We’ll update this policy when the way we use personal data changes, and the date at the top shows the last change. If a change affects you significantly, we’ll tell you by email or in the app.