Privacy Policy

Who runs Tassel

Tassel is run by [business name], [business address]. We decide how your data is used, which the law calls being the “data controller”.

Questions or requests: [contact email].

What is stored, and where

With your account, on our server

• Your email address and your password, stored only as a salted scrypt hash. We cannot read your password.
• If you continue with Google: your Google account’s email address and its account ID. Google tells us nothing else, and we never see your Google password.
• A sign-in session for each device, stored only as a hash, for 30 days from last use.
• Your setup answers: first name, university, course, year, modules, the tools you use, your goals and target grade.
• Your study data: ticked tasks, topic ratings, marks you type in, flashcards, question sets and scores, and revision notes.
• Your plan, credit balance and a list of your credit spends.

Your browser keeps a copy of your setup and study data so pages open quickly, plus your light or dark theme choice.

When you pay

Payments are handled by Stripe. You type card details into Stripe’s own page, never into Tassel. We keep the Stripe customer and subscription reference and your subscription status, never your card number. [Payments are not live yet].

In cookies, when you connect a tool

Connecting is optional. If you do, your browser keeps a cookie that pages cannot read, for 30 days:

• Moodle: your Moodle site address and your access key.
• Timetable feed: your calendar link.
• Canvas, Blackboard or Brightspace: your calendar link and which platform it is.

Your browser sends these to our server so it can read your deadlines and classes from your university. The server uses them for that request and does not keep a copy.

Sent to our AI provider

When you ask for AI flashcards, questions or notes, the text you paste or the text read from a file you upload, the module name and the topic name go to our server and on to Anthropic, the company that makes the Claude AI model. The result comes back and is saved to your account. We do not keep your text or the result.

Uploaded files are read inside your browser: the file itself never leaves your device, only its text. Do not paste or upload personal details about you or anyone else. [How long Anthropic keeps this, and where: check its current terms].

On our server

• Your internet address (IP) is held in memory for up to an hour to stop one address sending too many requests. It is not written to a database.
• For each AI request we log its type and size, not its content.
• Our hosting company, [hosting provider], keeps standard access logs (IP address, time, page) for [log retention period].

What Tassel does not do

• No analytics, advertising or tracking.
• No selling or sharing your data for marketing.
• No card details ever reach Tassel. Stripe handles them.

Why we use it

Only to give you the features you ask for: showing your term, reading your deadlines and classes, and writing study material. [Lawful basis under UK GDPR, to be confirmed: likely “performance of a contract” and “legitimate interests”].

Who else is involved

• Anthropic: receives the text you send for AI features. It is based in the United States. [Transfer safeguard, to be confirmed].
• Your university’s systems: receive requests made with your key or calendar link.
• Google: confirms who you are when you choose Continue with Google.
• Stripe: handles payments when you upgrade. [Stripe’s role and location, to be confirmed].
• [Hosting provider]: runs the server.

How long it is kept

• Your account and study data: until you delete your account.
• Browser copy: until you sign out, delete your account or clear your browser.
• Connection cookies: 30 days, or until you disconnect.
• Rate-limit records: up to an hour, in memory.

Your rights

Under UK data protection law you can ask to see, correct or delete your data, and object to how it is used. You can see and change most of it in Tassel, and delete all of it yourself, right here.

If you are unhappy with an answer from us, you can complain to the Information Commissioner’s Office at ico.org.uk.

Delete my data

This deletes your account and everything saved with it, cancels any subscription, disconnects every tool and clears this browser. It cannot be undone.

Age

Tassel is for university students aged 18 or over. [Confirm the minimum age].

Changes

When this page changes, the date at the top changes and anything important is shown when you next sign in. See also the Cookie Policy.