Privacy Policy

1. Who is responsible for your data

The data controller is Pierpaolo Abbatiello, an individual based in Italy, who builds and runs Socratree. I have not appointed a Data Protection Officer, as the law does not require one for a service of this size. You can reach me at the address at the end of this policy.

2. What data I handle

• Account: your email address, your name if you give it, and a login credential (a password, stored only as a secure hash by Supabase, or your Google account if you sign in with Google). Your email is required: without it I cannot create your account. Everything else is optional.
• Your books and texts: the files you upload (EPUB or PDF), the original file itself, its cover, and the text extracted from it.
• Your activity in the app: reading progress, highlights and passages you choose, debate conversations, checkpoint questions and your answers, mind maps, and display preferences.
• Waitlist: if you ask for access, your name, email and field of study.
• Support and feedback: the messages you send, and any screenshot you attach.
• Payments: your plan and subscription status. Card details go to Paddle, never to me.
• Technical data: IP address and browser details, which reach the servers with every request; product usage events (for example, "opened a book"); and error reports.

3. Why I use it, and on what legal basis

• To provide the service you signed up for (contract, GDPR Art. 6(1)(b)): your account, storing and showing your books, the AI features, saving your progress, service emails such as invitations and password resets, and support replies.
• To keep the service secure and working (legitimate interest, Art. 6(1)(f)): rate limits and abuse prevention using IP address, error monitoring with Sentry, and server logs.
• To understand how the product is used (legitimate interest, Art. 6(1)(f)): usage events recorded with your account inside Socratree's own database, so I can see which features help readers. You can object at any time (see section 7): write to me and I will delete the events already recorded for your account and leave your account out of any analysis.
• Visit statistics with Google Analytics (consent, Art. 6(1)(a)): only if you click Accept on the cookie banner. Without your consent nothing is loaded from Google Analytics.
• Payments and invoices (contract, Art. 6(1)(b)): handled by Paddle as merchant of record, which keeps its own tax records.
• Waitlist (steps at your request before a contract, Art. 6(1)(b)): to contact you and give you access.
• I do not sell your data, share it for advertising, or use it to build advertising profiles.

4. What the AI features send, and where

• When you use an AI feature (debate, checkpoint questions, mind maps, read aloud, the support chat), the passage or text needed for that request, your messages, and any screenshot you attach to the support chat are sent to the AI provider that answers it: Anthropic or OpenAI. Under their API terms, neither uses this data to train its models. Each deletes it within 30 days, unless it is flagged for misuse or the law requires them to keep it longer.
• When you upload a PDF, its pages may be sent to Google (Gemini API), as images together with their text, so the layout can be read correctly.
• Read aloud sends the text being read to OpenAI to produce the audio.
• Voice dictation (the microphone button) uses your browser's built-in speech recognition. Socratree never receives the audio, only the resulting text. Some browsers, such as Chrome, send the audio to their maker (Google) to transcribe it.
• AI answers can be wrong. They are generated text, not decisions about you.

5. Who else processes your data

These providers process data on my behalf (processors), under data processing terms, unless marked otherwise. Several are based in the United States or may process data there; in those cases the transfer relies on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses. You can ask me for a copy of these safeguards.

• Supabase: login, database and file storage. Hosted in the EU (Frankfurt, Germany). See Supabase Privacy Policy.
• Railway: runs the website and the servers, including the service that reads uploaded documents. See Railway Privacy Policy.
• Anthropic: AI replies. See Anthropic Privacy Policy.
• OpenAI: AI replies, mind maps, read aloud and the support chat. See OpenAI API data usage.
• Google (Gemini API): reading the layout of uploaded PDFs. Google does not use this data to train its models. It keeps it for a limited period (55 days, according to its policy) to detect misuse and meet legal obligations, and authorised Google staff may review flagged content. See Gemini API Terms.
• Sentry: error monitoring. When an error occurs it records the page layout and clicks, with all text and images hidden. See Sentry Privacy Policy.
• Resend: sends account and service emails. See Resend Privacy Policy.
• Google Analytics: visit statistics, only with your consent. See Google Privacy Policy.
• Paddle (independent controller): processes payments and subscriptions as merchant of record, under its own privacy policy. See Paddle Privacy Policy.
• Google Sign-In (independent controller): only if you choose to sign in with Google. See Google Privacy Policy.

6. Security and how long data is kept

• Data travels over HTTPS. Your books and your activity are tied to your account, and in the app only you can see them. I access them only when needed to run the service or to answer a request from you. The original files sit in private storage, and the providers in section 5 process them only to deliver the service.
• Account, books and activity: kept while your account exists. When you delete your account, they are deleted at once, including the original files and covers; copies in the database backups expire within 30 days.
• A single book: deleting it removes its text, its original file and its cover.
• Proof of deletion: I keep a one-way hash of the email address of a deleted account, with the date and plan, to show that the request was carried out. It cannot be turned back into the address.
• Waitlist: until you are given access or ask to be removed, and in any case deleted with your account.
• Support messages: deleted with your account. Screenshots attached to a support message are stored at a private but unlisted link, separately from your account, and are not found by the account deletion. Write to me and I will delete them.
• Usage events: kept while your account exists, and deleted with it.
• Error reports: up to 90 days; server logs: up to 30 days. Both are then deleted automatically.
• Google Analytics: at most 14 months.
• Payment records: kept by Paddle for as long as tax law requires.

7. Your rights

Under the GDPR you have the right to:

• Access your data and get a copy of it.
• Correct data that is wrong or incomplete.
• Delete your account and all its data, yourself, from Settings > Account > Delete account, or by writing to me.
• Portability: receive the data you gave me, and your activity, in a structured, machine-readable format.
• Restrict processing, for example while a correction is checked.
• Object to processing based on legitimate interest, such as product usage events.
• Withdraw consent to analytics cookies at any time from Cookie preferences, without affecting your account.
• Complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live.
• To use any of these rights, write to me at the address below. I reply within one month.

8. Cookies and local storage

• Socratree uses your browser's local storage for things the service needs: your login session, language, reading and display preferences, and your cookie choice.
• Only with your consent, it uses Google Analytics cookies to understand how visitors reach Socratree. Nothing is loaded until you click Accept, and you can change your choice at any time from Cookie preferences. Withdrawing removes those cookies.
• On the pricing page, the payment window is provided by Paddle, which may set the cookies it needs to process a payment.
• No advertising pixels, and no data shared with advertising networks or data brokers.

9. Automated decisions

Socratree makes no decision about you based solely on automated processing that has legal or similarly significant effects. AI feedback on checkpoint answers is a study aid, not a grade or an assessment that is used to decide anything about you.

10. Age

Socratree is for people aged 18 and over. I do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given me personal data, please write to me and I will delete it promptly.

11. Changes to this policy

When this policy changes in a way that matters, I will say so on the platform before the change applies, and the date at the top will change. Where a change needs your consent, I will ask for it.

12. Contact

For questions about this policy or your data, or to exercise your rights, write to:

privacy@socratree.com