1. Who controls your information
StudyBrite is the trading name of Chandni Josson, a sole trader based in England. The sole trader operating StudyBrite is the controller of personal information described in this notice.
You can contact StudyBrite at hello@studybrite.co.uk.
2. Purchases and payment
When you buy a workbook, StudyBrite processes your email address, product and SKU, price and currency, payment status, purchase timestamps, Stripe Checkout Session, Payment Intent and Customer identifiers where supplied, and fulfilment status. This is necessary to enter into and perform the purchase contract, verify payment, provide the product, prevent duplicate fulfilment, keep transaction records and support the purchase.
Stripe processes payment-card and Checkout information as an independent payment service provider. StudyBrite does not receive or store your full card number or card security code. Stripe’s own privacy information applies to its processing.
3. Downloads, entitlements and licensed PDFs
StudyBrite creates a secure, time-limited entitlement associated with the purchase. We process encrypted or hashed token information, expiry, permitted and completed uses, revocation status and last-use time to provide and protect the download.
The purchased PDF is licensed to the purchaser and contains the verified purchase email as licence information. The personalised file is generated for download; StudyBrite does not currently retain a separate stored copy of each generated customer PDF.
4. Contract and delivery emails
StudyBrite uses Resend to send purchase confirmations, secure download links and operational emails. Resend receives the recipient address and message content. StudyBrite records delivery status, provider identifiers, attempts and errors where needed to deliver and evidence the transaction. This processing is necessary to perform the contract and support customers.
5. Database and website hosting
Purchase, entitlement, review and updates information is stored using Neon Postgres. The website is hosted through Vercel. These providers may process technical and account information to provide, secure and operate their services.
6. Customer reviews
When you submit a review, StudyBrite collects your display name, email address, rating, title, review text, optional child year group, product, submission identifier and timestamps. Reviews are moderated and remain pending unless approved.
If approved, StudyBrite displays only your chosen display name, rating, title, review text, optional year group, review date and Verified Purchase status. Your email, moderation information and security data are not published.
StudyBrite uses the privately supplied email to compare the review with a successfully paid purchase of the same product. It also creates privacy-preserving HMAC fingerprints from submission details and the request IP address to deter duplicate or abusive submissions. The raw IP address is not stored in the review table.
Review processing supports the reviewer’s request to submit content and StudyBrite’s legitimate interests in publishing authentic feedback, moderating content, preventing abuse and protecting customers. You may ask StudyBrite to remove or correct a published review.
7. Updates and marketing
When an adult subscribes for StudyBrite updates, we collect their name, email address, child’s current school year, consent record, referral source and signup date. We use this information only with consent to send StudyBrite news and information about resources.
You may withdraw marketing consent at any time. Until an automated unsubscribe facility is available, contact hello@studybrite.co.uk. Withdrawal does not affect processing already carried out lawfully, and StudyBrite may retain minimal suppression information so the request continues to be honoured.
8. Customer support and enquiries
When the customer-support form becomes operational, StudyBrite will process the name, email address, message, timestamps and proportionate anti-abuse information needed to answer the enquiry, take steps requested before a purchase, support a contract, handle a complaint and protect the service. Until then, support is available directly by email.
9. Technical and security information
StudyBrite and its hosting providers may process request metadata, security logs, error information and service identifiers to operate the website, investigate failures, prevent fraud or abuse and protect the service. Where StudyBrite intentionally uses request IP information for review abuse protection, it stores an HMAC fingerprint rather than the raw address in the review table.
10. Cookies and analytics
StudyBrite does not currently use advertising profiles, marketing pixels or application analytics cookies identified in the website code. Stripe may use cookies and similar technologies on its hosted Checkout pages, and essential platform technologies may be used to operate and secure the website. If optional analytics or marketing technologies are introduced, this notice and any required consent controls will be updated first.
11. Lawful bases
StudyBrite relies on contract to process information needed to take payment, fulfil orders, license products and provide purchase support. It relies on legal obligations where records must be retained or rights handled by law. Marketing updates rely on consent. Security, fraud prevention, proportionate service logs, review verification and moderation rely on legitimate interests where those interests are not overridden by individual rights. Enquiries may be processed for pre-contractual steps, contract support or legitimate interests depending on their subject.
12. Sharing, processors and international transfers
StudyBrite shares personal information only as needed with service providers such as Stripe for payments, Neon for database hosting, Vercel for website hosting and Resend for email delivery, and with professional or public authorities where legally required. StudyBrite does not sell personal information.
Some providers may process information outside the United Kingdom. Where required, StudyBrite relies on the provider’s appropriate contractual safeguards, adequacy arrangements or another lawful transfer mechanism. Provider locations and safeguards may change as their services develop.
13. Retention
Purchase and transaction records, Stripe transaction/event evidence, and purchase-email delivery evidence may be retained for up to six years after the relevant accounting or tax period where reasonably required for financial, contract or legal records. This starting point should be confirmed with StudyBrite’s professional legal or accounting adviser.
Operational download access normally expires after 72 hours or five uses. The associated purchase record may remain under the transaction-retention policy.
Approved reviews may remain while published and relevant, subject to periodic review. Pending or rejected reviews and review abuse/security fingerprints are normally retained for 12 months unless needed longer for an active dispute, legal requirement or security investigation.
Marketing subscriber information is retained while subscribed. After withdrawal, StudyBrite retains only the minimum information reasonably required to honour the unsubscribe and demonstrate withdrawal. Support enquiries are normally retained for two years after resolution unless needed longer for an active transaction, complaint, legal issue or other justified purpose. Hosting and security logs follow provider and operational retention and are kept no longer than reasonably necessary.
14. Security
StudyBrite uses proportionate technical and organisational measures including server-side payment handling, Stripe webhook verification, restricted database access, encrypted or hashed download credentials, time-limited entitlements, access controls and input validation. No internet service can guarantee absolute security.
15. Children’s information
StudyBrite products are designed for children, but the website and shop are intended for adult purchasers. StudyBrite does not currently solicit children’s names, dates of birth or school names through the purchase process. Optional school-year information supplied by a parent may relate to their child; parents should not submit additional identifying information about a child.
16. Your rights
Depending on the circumstances, you may have rights to access, correct, erase or restrict personal information, object to certain processing, receive portable information, and withdraw consent. These rights are subject to legal conditions and exemptions. To exercise a right, email hello@studybrite.co.uk. StudyBrite may need to verify your identity.
17. Complaints
Please contact StudyBrite first so concerns can be investigated. You may also complain to the UK Information Commissioner’s Office through ico.org.uk. International customers may also have the right to contact their local data-protection authority.
18. Changes to this notice
StudyBrite may update this notice to reflect changes in services, providers or law. The current version and effective date will remain displayed on this page.