Privacy Policy

The short version

• Your notes are stored on your computer.
• Once you are signed in, Illustra can perform its core local functions without an internet connection.
• Illustra's AI runs locally on your computer. Your notes are not sent to an external AI provider for generation.
• You need a free account to use Illustra.
• Your account records your plan and, on eligible paid plans, can store a backup of your library.
• We do not sell your personal data.
• We do not show advertising in Illustra.
• We do not use behavioural analytics to track what you do inside the Illustra app.

What we collect and why

Before you create an account

Illustra does not intentionally collect profile or usage analytics before you create an account.

The application may make network requests to:

• Hugging Face, to download an AI model; and
• Illustra's website or update service, to check whether a newer version of Illustra is available.

As with normal internet requests, those services may receive technical information necessary to deliver the request, such as your IP address.

Illustra does not include your notes or study content in those requests.

When you create an account

We process:

Your email address and authentication information

This is used to create your account and sign you in.

Passwords are handled by our authentication provider using secure password hashing. We do not have access to your plaintext password.

Your name and stage of study

For example GCSE, A-level or university.

We use this information to configure and personalise the basic Illustra experience.

Sign-in security information

We may keep information including when you signed in, a pseudonymous identifier for the device and its operating system.

We use this to help identify suspicious or unauthorised sign-ins.

The device identifier is designed not to reveal the computer's name.

Your library backup

On plans that include backup, this can include your notes, flashcards, goals, uploaded materials and images contained within your library.

The backup is private to your account and is replaced when a new backup is created.

Your subscription information

We keep information including your Illustra plan, subscription status, renewal information and identifiers supplied by Stripe that are needed to manage your subscription.

Payments

If you purchase a paid plan, Stripe processes the payment.

Stripe may collect information such as your payment-card details, email address and billing country.

Illustra does not receive or store your full card number.

Stripe handles payment information in accordance with its own privacy documentation.

Password reset and account emails

If you request a password reset or another transactional account email, we use Brevo to deliver the message.

Our lawful bases

We rely on the following lawful bases under UK data-protection law:

Contract

We process information where it is necessary to create and operate the Illustra account, provide backup functionality, manage your plan and provide services you have requested.

Legitimate interests

We process limited sign-in and device information for our legitimate interest in protecting Illustra accounts and detecting unauthorised access.

We consider this information limited to what is reasonably necessary for account security.

Legal obligation

We retain information where necessary to comply with legal obligations, including applicable accounting and tax requirements.

Providing the information required to create an Illustra account is necessary for us to provide the account-based service. If you do not provide it, we may not be able to create or operate your account.

Who handles data for us

We use a small number of external providers:

• Supabase provides authentication, database services and backup storage.
• Stripe processes subscription payments and billing.
• Brevo delivers transactional account emails.
• Hugging Face hosts AI model files that the Illustra application may download. We do not send your notes or account content to Hugging Face for AI generation.

These organisations process information according to their respective roles, agreements and privacy obligations.

Where a provider processes personal data on our behalf, we require appropriate contractual and security protections.

Some providers may also process certain information as independent controllers under their own privacy policies, particularly where required to provide services such as payment processing.

International transfers

Some of our service providers may process personal data outside the United Kingdom.

Where UK data-protection rules on international transfers apply, personal data must be transferred using a mechanism permitted by UK law, such as applicable adequacy regulations or appropriate contractual safeguards.

You can contact hello@illustraedu.com if you would like more information about safeguards applying to your personal data.

How long we keep information

Account, sign-in and backup information

We keep this while your Illustra account remains active.

When you delete your account, we remove account data from our active systems subject to any limited retention that is necessary for legal, security, fraud-prevention or backup purposes.

Payment and subscription records

We may retain records required for accounting and tax purposes after your account is deleted. These records are normally retained for the period required by applicable law, which may be around six years.

Stripe also retains information in accordance with its own legal obligations and privacy policy.

Information stored locally on your computer

Locally stored Illustra content remains on your computer until you remove it, uninstall or erase the relevant local data, or otherwise delete it.

It is only uploaded to your Illustra backup if your plan includes backup and backup is switched on. Backup is on by default on those plans; you can turn it off in Settings → Backup & sync.

Your rights

Depending on the circumstances and the lawful basis involved, UK data-protection law may give you rights including the right to:

• access personal data we hold about you;
• correct inaccurate personal data;
• ask us to delete personal data;
• ask us to restrict certain processing;
• object to certain processing;
• receive certain personal data in a portable format.

Some rights are subject to legal limitations and do not apply in every circumstance.

You can:

Delete your account

Illustra → Settings → Account → Delete account.

Export your library

Settings → Backup & sync → Export library.

Make another data request

Email hello@illustraedu.com.

We will respond within the period required by applicable data-protection law, normally within one month.

If you are unhappy with how we handle your personal data, you also have the right to complain to the UK Information Commissioner's Office at https://ico.org.uk.

Children

You must be at least 16 years old to create an Illustra account.

If we learn that somebody under 16 has created an account, we will take appropriate steps to delete it.

Users under 18 should have permission from a parent or guardian before purchasing a paid plan.

Keeping information secure

Information transmitted between Illustra and our servers is encrypted in transit.

Access to account backups is restricted to the relevant authenticated account.

AI model files are checked against their published fingerprints before Illustra uses them.

No online system can be guaranteed to be completely secure, but we use reasonable technical and organisational measures designed to protect the personal data we handle.

Changes to this Privacy Policy

We may update this Privacy Policy as Illustra changes.

When we do, we will update the "Last updated" date above.

If a change materially affects how we handle your personal data, we will provide notice in Illustra or through another appropriate method.