Privacy Policy

1. Who we are

References to "we", "us", and "our" mean the operator of Culleva (the "Service"). References to "you" mean the person using the Service. If you have any questions about this policy, contact support@culleva.com.

This policy explains what personal information we collect, how we use it, who we share it with, and your rights under the Australian Privacy Principles in the Privacy Act 1988 (Cth).

2. Information we collect

2.1 Information you provide

• Account information: your email address, password (stored only as a hashed value, never in plain text), and name.
• Profile preferences: theme, citation style, and your detected timezone.
• Content you create: assignments, tasks, messages, files you upload (PDF, DOCX, PPTX, images, audio, video, text), study materials, flashcards, quiz attempts, citations, and whiteboard content.
• Group memberships: which groups you join, who else is in them, and the role you have.

2.2 Information collected automatically

When you use the Service, our backend records technical information needed to deliver it: session tokens, the timestamps of your activity inside the app, and basic error logs.

We also store feature activity needed to operate the app: quiz attempts, flashcard review history, notification read status, meeting reminder records, file metadata, voice-channel participant status (joined / muted / sharing screen), and AI processing job status and error metadata. These are operational records, not analytics.

Our hosting and backend providers collect basic operational logs as part of running the service: things like request timestamps, response codes, IP addresses, and user-agent strings. These are used to diagnose errors, prevent abuse, and understand whether old domains (such as the legacy assignmate.dev ) still receive traffic.

We use Google Analytics 4(provided by Google LLC) to understand how visitors find and use the site, so we can improve it. Google Analytics sets cookies and collects usage data such as the pages you view, approximate location (derived from a truncated IP address), device and browser type, and how you arrived at the site. We have IP anonymisation enabled. This data is processed on Google's servers in the United States. We do not use advertising trackers and have not enabled Google's advertising or ad-personalisation features. You can opt out of Google Analytics across all sites with Google's browser opt-out add-on.

2.3 Information from third-party sign-in providers

If you sign in with Google or Microsoft, we receive your email address, name, and profile picture from that provider. We don't receive your password and don't ask the provider for any additional permissions.

3. How we use your information

• To provide the Service: storing your assignments, files, messages, study materials, and other content you create.
• To communicate with you: in-app notifications about assignment due dates, group meetings, and account activity.
• To process content through AI features when you ask us to (see Section 5).
• To diagnose and fix bugs.
• To enforce our Terms of Service and protect the safety of the Service.
• To comply with legal obligations (for example, responding to a valid subpoena).

We do not sell your personal information. We do not share it with advertisers. We do not use your content to train AI models.

4. Service providers we share information with

We use the following third-party services to run Culleva. Each receives only the information needed for their role.

• Backend & data storage provider (United States): database, file storage, scheduled functions, and realtime subscriptions. All your account data and content lives here.
• Hosting provider (United States): hosts the frontend at culleva.com and serves the web app.
• AI provider (United States): processes text excerpts when you use AI features. See Section 5.
• Google (Google LLC, USA): handles Google Sign-In if you choose that sign-in method, and provides Google Analytics for site usage measurement (see Section 2.2).
• Microsoft (Microsoft Corporation, USA): handles Microsoft Sign-In if you choose that sign-in method.
• Stripe(Stripe, Inc., USA): processes payments for the optional Pro subscription. Card details are entered on Stripe’s hosted Checkout and Customer Portal pages and never touch Culleva’s servers. We receive only the resulting Stripe customer and subscription identifiers, the current billing-period end date, and your active subscription status (which determines whether your account is on the free or Pro tier).

These providers are our service providers. Where applicable, they process personal information for us and only for the purposes needed to provide Culleva.

5. How AI features work and what they receive

The AI features in Culleva (AI Review, AI Study Coach, Citation Checker, and the Whiteboard AI chat) work by sending text excerpts to a third-party AI provider's API.

• What is sent: only the relevant text from the materials you submitted to that feature, plus a fixed system prompt and any chat history. Other parts of your account (assignments you didn't reference, group chat messages, files in unrelated assignments) are never sent.
• What that text can contain: depending on the feature, the text excerpt may include extracted content from uploaded PDF, DOCX, PPTX, or text files; text you pasted; citation documents; whiteboard content; recent AI chat history; and the prompt you submit. AI Review sends excerpts of your assessment task, marking rubric, and draft. The Study Coach sends excerpts of your uploaded course materials. The Whiteboard AI chat sends your whiteboard content plus recent chat history. The Citation Checker sends document text in document-scan mode.
• AI data handling: your content is not used to train AI models. Our AI provider may retain content briefly for abuse monitoring and as required by law.
• Practical advice: don't put highly sensitive information (financial details, identity documents, confidential personal data of others) into study materials or AI inputs. The AI features are designed for academic content.

5.1 Citation Checker URL fetching

If you use the Citation Checker's URL-fetch mode, we receive the URL you submit and our backend fetches the page server-side to extract citation metadata such as title, author, publication date, site name, and similar fields. We keep the URL alongside the resulting reference in your library. Other servers and the page's host may log our request, in line with normal web traffic.

6. Voice channel and screen share

If you join a group voice channel or share your screen, your live audio and screen-share stream is sent directly between group participants using WebRTC. The media itself does not pass through Culleva's servers, and we do not record or store any live voice or screen-share media. Once a session ends, the audio and video are gone.

We do store temporary connection and signalling data required for the feature to work: WebRTC offers, answers, and ICE candidates (deleted on read), participant peer IDs, join timestamps, mute and deafen status, screen-share status, and a heartbeat timestamp used to remove stale participants from the room. None of this is the media itself; it's the metadata that lets the feature function.

If a session is recorded in the future (a planned feature), this policy will be updated to disclose how recordings are captured, stored, and accessed before that feature ships. Recording is not currently available.

7. Shared content within groups

Some Culleva features are collaborative. If you join a group assignment, other members of that group may see:

• Your name, email address, and role in the group.
• Tasks you create, edit, or are assigned to.
• Files and shared external links you upload.
• Messages you send in the group chat.
• Whiteboard content you add or edit.
• Your participation in scheduled meetings and live voice channels.
• When you're actively in the voice channel, your mute, deafen, and screen-share status.

Group members may copy, download, screenshot, or export shared content outside Culleva. We can't control what people do with content once they have access to it. Only share material you're comfortable having other group members see, and only material you have the rights to share.

Content uploaded to AI Study Coach courses, references in your Citation Library, and your own personal calendar events are private to your account and are not shared with anyone unless you choose to share them.

8. Data retention

We keep your information for as long as your account is active. When you delete your account, we delete the following from active storage within 30 days:

• Every assignment you own, plus the group workspace, files, messages, whiteboard, and meetings inside it.
• Your Study Coach courses, materials, flashcards, quizzes, and quiz history.
• Your saved citations, citation folders, and citation scans.
• Your personal calendar events and notifications.
• Your sign-in records (auth accounts, sessions, refresh tokens), so the same email can be used to register a fresh account in future.

We also anonymise your account row rather than deleting it outright. Identifying fields (your name, email, profile image, preferences) are cleared, and a deletion timestamp is recorded. The row itself is retained as a placeholder so foreign-key references from shared group content (see next paragraph) keep resolving and render as "Deleted user" instead of breaking other users' views.

Shared group content: where you contributed to a group you didn't own (chat messages, files uploaded to a shared assignment, whiteboard edits, completed tasks, meeting attendance), we retain those contributions and anonymisethem via the mechanism above. Other group members continue to see the contribution itself, but your name, email, and any avatar are replaced with "Deleted user". This balances your right to erasure with other users' need for continuity (if your messages disappeared, group chat threads would lose context). If you prefer full erasure of your group contributions, mention this in your deletion request and we will action it where reasonably possible.

Encrypted backups are retained for up to 90 days for disaster recovery; after that, the deleted data is permanently removed from backups too.

We may retain limited information after account deletion if required by law (for example, financial transaction records for tax compliance once paid subscriptions are live).

9. Your rights

Under the Australian Privacy Principles, you have the following rights:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete information. You can update most fields directly from your profile page.
• Deletion: delete your account and personal information yourself from the Danger Zone in your profile settings, at any time. You can also email support@culleva.com from the email address linked to your account and we will action confirmed requests within 30 days. See Section 8 for how shared group contributions are handled.
• Complaint: if you believe we have mishandled your information, contact support@culleva.com first. We will acknowledge your complaint, investigate, and respond within a reasonable time. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Cookies and local storage

Culleva uses cookies needed for authentication, which hold your session token so the app knows you're signed in. We also use Google Analytics cookies to measure site usage (see Section 2.2); these distinguish visitors and remember the start of a visit. We do not use advertising cookies. You can block analytics cookies with the Google opt-out add-on linked in Section 2.2, or by blocking cookies in your browser, without affecting your ability to use the app.

11. Security

We protect your information with HTTPS in transit and encryption at rest. Passwords are stored as hashed values (we cannot read your password even if asked). Our backend provider handles encryption at rest for stored files and database content.

No internet system is perfectly secure. You are responsible for keeping your password and your computer secure. If you suspect your account has been compromised, change your password and email us immediately.

12. Children's privacy

Culleva is intended for university students and is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected information from a child under 16, we will delete it.

13. International data transfers

Our backend, hosting, and AI providers operate servers in the United States. By using Culleva you understand that your information may be transferred to, stored, and processed in countries outside Australia.

14. Changes to this policy

We may update this policy when our practices change, when new features add new data flows, or when laws change. We will post the new version here with an updated "Last updated" date. If the changes are significant we will also notify you in-app or by email before they take effect.

15. Contact us

Questions about this policy or your information? Email support@culleva.com.