Privacy Notice
This notice explains what personal data Chameleon collects, why, and what rights you have under the GDPR. Effective date: .
Who is the controller
Controller details are being finalised ahead of public launch.
What we process
- Account data (email, name) — provided by you via Clerk authentication.
- Uploaded course materials (PDFs, slides, notes) — stored on Cloudflare R2 (EU region) and processed by Anthropic Claude for tutorial generation.
- Study activity (chapters opened, flashcard grades, quiz scores) — stored in our SQLite database for spaced-repetition scheduling.
- Operational logs — short-lived request logs for debugging and abuse prevention.
Why we process
- To provide the service (Art. 6(1)(b) — performance of the contract).
- To prevent abuse (Art. 6(1)(f) — legitimate interest).
- We do not currently carry out any marketing or analytics processing. Should we introduce it, we will rely on your explicit consent (Art. 6(1)(a)) and list it here first.
Sub-processors
We rely on the following sub-processors. All are bound by an Art. 28 data-processing agreement and operate under appropriate transfer mechanisms (SCCs) where data leaves the EU.
- Anthropic — Claude API for content generation. Not used for model training.
- OpenAI — text-to-speech (read-aloud audio of generated tutorial text). Not used for model training.
- Clerk — authentication and session management.
- Cloudflare R2 — file storage (EU region).
- Fly.io — application hosting (Amsterdam region).
- Resend — transactional email.
- Upstash Redis — rate limiting state.
- Sentry — error monitoring and performance observability.
Retention
Account data — for the lifetime of the account, plus 90 days after deletion request to satisfy backup-rotation cycles. Uploaded files and study activity — retained while the account is active; deleted within 30 days of account-deletion request.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Have inaccurate data corrected;
- Request erasure (the "right to be forgotten");
- Restrict or object to processing;
- Data portability — export your study plans, flashcards, quiz history as machine-readable JSON;
- Lodge a complaint with the Dutch Autoriteit Persoonsgegevens (or your national supervisory authority).
Contact
Privacy questions: privacy@chameleons.study. A dedicated Data Protection Officer is not currently appointed; privacy enquiries are handled via the address above.