Privacy policy

Who we are and what this policy covers

Ebbhaus, Inc. builds a personal tutor. This policy explains what we collect when you use it, why we collect it, who else processes it on our behalf, and what you can ask us to do with it. It covers our website, the product you sign in to, and any application you connect to your account.

We have tried to write it in plain language. Where a section says "may", it is because the practice depends on which parts of the service you use — not because we are reserving a right we do not intend to exercise.

Information we collect

We collect three kinds of information: what you give us, what we observe as you use the service, and what our providers pass to us.

Account information

What identifies your account — such as your email address, your name if your sign-in provider supplies one, a link to your profile picture if there is one, and an account identifier. If you sign in through a third party such as Google, we receive these from them rather than from you.

Billing information

If you subscribe, our payment processor collects and stores your payment details. We receive a record of the subscription — its plan, its status, and enough to answer a billing question — but we do not receive or store full card numbers.

Material you provide

Documents, notes, links and other material you upload or paste so the tutor can build a knowledge map from it, together with the goals and topics you describe.

Learning activity

What happens in a tutoring session — the questions put to you, your answers, and signals such as timing and hesitation — and what we infer from it: the model of what you know, how confident we are, and what to review next. This inferred model is the core of the product.

Technical information

Information your device and browser send when you use the service, such as IP address, browser type, and pages or features requested, along with logs our infrastructure keeps to run the service securely and reliably.

Communications

What you write to us — support requests, bug reports, feedback — and our replies.

We do not ask for information we have no use for. We do not require a date of birth beyond confirming you meet the minimum age, a phone number, or a postal address.

How and why we use information

We use the information above to:

• Provide the service — sign you in, generate and maintain your knowledge maps, run tutoring sessions, and keep your progress available across your devices.
• Build and maintain the model of what you know, which is what allows the tutor to teach you rather than a generic student.
• Take payment, manage subscriptions, and handle billing questions.
• Measure and improve quality — including evaluating whether the tutor is teaching well, diagnosing failures, and testing changes before they reach you.
• Keep the service secure — detect and investigate abuse, fraud, and technical problems.
• Communicate with you about your account, changes to the service, and things you have asked us to send.
• Meet legal obligations and enforce our terms.

We do not sell your personal information, and we do not share it with advertising or retargeting networks. We do not show third-party advertising in the product.

AI, models, and your learning data

The tutor is built on large language models, some of which are operated by third-party providers. To generate a knowledge map, ask you a question, or judge an answer, the relevant material — which may include what you have uploaded and what you have written in a session — is sent to a model provider for processing and returned to us.

We contract with those providers on terms that prohibit them from using your content to train their models, and we do not use your content to train models of our own for other customers. Providers may retain content briefly to operate their service and to detect abuse.

We do use your activity to evaluate and improve the tutor — for example, checking whether the questions it asks are pitched correctly, or whether an answer was judged fairly. Where that work does not require knowing who you are, we use aggregated or de-identified data.

The model of what you know is an inference about you, not a record you supplied. It can be wrong. You can see what it holds, and you can ask us to correct or reset it.

How we share information

We share information with service providers who need it to run the service on our behalf, and who are bound to use it only for that purpose. They fall into these categories:

Identity and authentication

Providers who host sign-in, store credentials, and verify email addresses. Your password, if you use one, is created and checked by our identity provider and never reaches an Ebbhaus server.

Hosting, databases and delivery

Providers who run our servers, store our data, and deliver the site — including content delivery and denial-of-service protection at the network edge.

Payments

A payment processor who takes and stores payment details and handles subscriptions, taxes and invoices.

Model providers

The providers whose models generate maps, questions and explanations, as described above.

Communications and support

Providers who deliver email and help us answer support requests.

We may also share information when the law requires it, in response to a valid legal request, to protect the rights and safety of our users or the public, or in connection with a merger, acquisition, or sale of assets — in which case we will give you notice before your information becomes subject to a different policy.

Applications you connect

You can connect other applications and AI assistants to your Ebbhaus account, so that they can read what you are learning and report evidence of your progress back to us. Connecting one is your choice, it requires you to authorise it explicitly, and you can revoke it at any time from your account.

While a connection is active, the application receives the information you authorised it to receive. Once it holds that information, its own privacy policy governs what it does with it, not ours. Revoking a connection stops future access; it does not retrieve what has already been shared.

How long we keep information

We keep your information for as long as your account is open. When you delete your account, we delete or anonymise the personal information associated with it, and we instruct the providers who hold it on our behalf to do the same.

Two things outlive that. We keep a minimal record that the account existed, so that identifiers are not reissued and so that deletion itself is auditable. And deleted data persists for a short period in encrypted backups and point-in-time recovery snapshots before those expire on their own schedule.

We may keep information for longer where the law requires it — billing records, for example — or where we need it to resolve a dispute or enforce our agreements.

Security

We protect your information with measures appropriate to its sensitivity: encryption in transit and at rest, access limited to the people and systems that need it, isolated environments for development and production, and monitoring for unusual activity.

No service can promise perfect security, and we do not. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law, without undue delay.

If you believe you have found a vulnerability, please write to [email protected]. We will not pursue legal action against good-faith security research reported to us privately.

Your choices and rights

You can review and change your account information, export what you have provided, and delete your account from within the product. Deleting your account deletes your learning data with it.

Depending on where you live, you may also have the right to ask us for a copy of the personal information we hold about you, to have it corrected or deleted, to object to or restrict how we use it, to withdraw consent you previously gave, and to complain to your local data protection authority. We honour these requests regardless of where you live, and we do not charge for them or treat you differently for making one.

Write to [email protected] to make a request. We may need to verify your identity before we act on it.

Children

Ebbhaus is not directed to children. You must be at least 16 years old to create an account, or older if the law where you live sets a higher age for consenting to the processing of your personal information.

We do not knowingly collect personal information from anyone below that age. If you believe a child has created an account, write to [email protected] and we will delete it.

Where your information is processed

Ebbhaus is based in the United States, and your information is processed there and in other countries where our service providers operate. Those countries may have different data protection laws than your own.

Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on transfer mechanisms recognised by the relevant authorities, such as standard contractual clauses.

Changes to this policy

We may update this policy as the service changes. The revision date at the top always reflects the current version.

If a change materially reduces your rights or materially expands how we use your information, we will tell you before it takes effect — by email or in the product — and give you a chance to object or close your account.

Contact

Ebbhaus, Inc. is the controller of the personal information described in this policy.

Privacy questions and requests

[email protected]

Security reports

[email protected]

Abuse reports

[email protected]

Anything else

[email protected]