Privacy Policy

In this document:

• "We", "us" or "our" refers to FlashFlow Study (flashflowstudy.com) and the authorised administrators responsible for managing FlashFlow Study within your school or organisation.
• "You" or "your" refers to the individual using FlashFlow Study, including students, teachers and other authorised users.
• "FlashFlow Study" refers to the website, services, features and systems provided through flashflowstudy.com.
• "School" or "organisation" refers to the school, college or other organisation that provides or authorises your access to FlashFlow Study.
• "Administrator" refers to an authorised person responsible for managing FlashFlow Study or your organisation's use of the service (this may include school IT staff, teachers or other designated staff members), or a person or developer overseeing FlashFlow and user activities.

We use Google SSO to make it easier for you to access FlashFlow Study using your existing Google account. Depending on the type of Google account you hold, a Google Workspace Administrator may need to approve FlashFlow Study before you can sign in. Our Google SSO requests are openid, email and profile, which together provide only your email address, full name and profile image (where available).

We do not request access to your Google contacts, photographs, calendars, Drive files, emails or any other Google data, and we do not store anything beyond the minimum profile information required to create and identify your account. If you remove FlashFlow Study's access from your Google account settings, you can revoke this consent at any time.

Where your access is provided through a Google Workspace for Education account, your school and its designated Google Workspace Administrator control whether FlashFlow Study may be used with that account. Any approval, restriction or withdrawal of such access is a matter between you and your school; FlashFlow Study will act on the instructions of the school in respect of accounts under its control.

Where FlashFlow Study is deployed, provided or authorised by a school or organisation, the school acts as the data controller in respect of its users' personal data, and FlashFlow Study acts as the data processor. In this capacity, FlashFlow Study processes personal data only on the documented instructions of the school, and the school retains responsibility for ensuring that the use of FlashFlow Study complies with its own data protection obligations, including those arising under the UK GDPR and the Data Protection Act 2018.

Where you create your account and use FlashFlow Study independently, without your access being provided or authorised by a school or organisation, you use the service in a personal capacity and FlashFlow Study determines the purposes and means of processing your personal data as described in this document. In this case you act entirely on your own behalf: you control your own account, decks, classes and study records, and you can exercise all of the rights set out in this document directly, at any time, without needing a school Administrator to act for you.

Any questions, requests or complaints regarding this document or the processing of your personal data should be directed to support@flashflowstudy.com. Where your access is provided by a school, you may also contact your school's Administrator or data protection lead.

To provide the service, the platform collects only the data it needs to function:

• Account information — your email address and name, used to identify you, and whether your account is a teacher or student account, so the appropriate features are shown.
• Study content — flashcard decks and cards, folders, and (for teachers) classrooms, members and assignments that you create.
• Study records and assignment progress — sessions, cards studied and scores, so that you can track your progress and teachers can monitor assigned work; which classes you belong to and your completion of assigned work.
• Device confirmation — a confirmation flag stored only in your own browser to remember that you have confirmed this device at sign-in.
• Messages you send us — if you contact us through the contact form, the platform stores your name, email address and message so that your enquiry can be read and answered.

We do not collect location data, biometric data, browsing history, advertising identifiers or any categories of data beyond those set out above. We do not use third-party advertising or analytics trackers on the platform.

The platform uses your personal data only to operate the service, specifically:

• To display your decks, cards, classes and assignments.
• To record study progress and assignment completion.
• To send a one-time confirmation code to your email address when you sign in from a new device, and to send service messages relating to your account, class invitations and assignments.
• To permit teachers and Administrators to manage classrooms and monitor assigned work.
• To maintain the security and integrity of the service, including the prevention of abuse.

Legal bases. Your personal data is processed on the following legal bases: the performance of the contract between you and us in providing the service; our legitimate interests in operating, securing and improving the service; and, where required, your consent, which may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.

What we do not do. We do not sell your personal data. We do not share your personal data with third parties for the purpose of training artificial intelligence models. We do not use your personal data for advertising, and the platform displays no third-party advertisements.

AI-assisted deck creation. Where you deliberately submit material to FlashFlow Study's AI-assisted deck creation feature, that material is processed solely for the purpose of generating the flashcards you have requested. Study content that you do not submit to this feature is not processed by it, and your data is not used to train third-party AI models.

Service providers. FlashFlow Study is operated on secure managed cloud infrastructure, and uses a small number of third-party service providers strictly necessary to operate the platform (including hosting, bot-protection and email delivery services). Such providers process personal data only on our instructions and are bound by appropriate data protection obligations.

Every user's study data, decks and records are isolated per account, and such isolation is enforced at the database level through row-level security controls, not merely by the user interface. A user can access only their own study records and content shared with them. Private decks cannot be viewed by other users, even where a direct link is known. Classrooms, assignments and class materials are visible only to the teacher and enrolled students concerned.

Data is transmitted over encrypted connections. The platform is protected against automated abuse and bot activity, and public-facing forms are safeguarded by bot-verification controls.

Administrators may moderate content and suspend or ban accounts that breach the FlashFlow Study Terms of Service, in order to protect users and maintain a safe, school-appropriate environment.

Subject to applicable data protection law, including the UK GDPR and the Data Protection Act 2018, you have the following rights in respect of your personal data:

• Right of access — to request a copy of the personal data held about you.
• Right to rectification — to request correction of inaccurate personal data.
• Right to erasure — to request deletion of your personal data and your account.
• Right to data portability — to receive your data in a structured, commonly used format.
• Right to object and to withdraw consent — to object to certain processing or withdraw consent where processing is based on it.

To exercise any of these rights, contact support@flashflowstudy.com. Where your access is provided by a school, your school's Administrator may make or support such requests on your behalf. Requests are answered within one month of receipt. Deleting your account removes your personal data from the platform, save where we are required to retain certain records by law, in which case such records are retained no longer than necessary for that purpose.

Your personal data is retained only for as long as your account is active and as necessary to provide the service, or where retention is required for security, legal or operational reasons. Upon account deletion, or upon a valid erasure request, your personal data is deleted from the platform in accordance with the section above.

We may update this document from time to time to reflect changes in the service or in applicable law. The current version is always available at flashflowstudy.com, with its effective date shown above. Where changes are material, users are notified through the platform or by email. Continued use of FlashFlow Study after the effective date of an updated policy constitutes acceptance of the updated policy.