Acadomic Privacy Policy

1. Who is responsible

The controller for personal accounts is Ontinity Private Limited. If you use Acadomic inside an enterprise organisation, that institution may be a separate controller for learner files it asks you to upload; we process that content to provide the workspace.

2. Data we collect

• Account. Name, email, and sign-in identifiers from Clerk, plus the role you choose (student, tutor, or enterprise).
• Workspace. Assignments, briefs, solution drafts, optional referencing guides and supervisor notes, scan reports, comments, and downloaded PDFs.
• Billing. Plan, credit wallet and ledger, subscription dates, and Paddle transaction or subscription identifiers. We do not store full card numbers; Paddle is merchant of record.
• Usage. Scan events, credit deductions, and product logs needed to operate and secure the service.
• Marketing site. Strictly necessary cookies always. Analytics cookies only if you opt in (see Cookies below).
• Contact. Messages you send to contact@acadomic.com or the contact form. The form asks Google reCAPTCHA to confirm a person sent it.

3. Why we use it

We use this data to create your account, run scans, meter credits, take payment, show insights dashboards, send transactional email (welcome, report-ready), prevent abuse, and improve reliability. Legal bases typically include performing the contract (the Terms of service), legitimate interests in securing the service, and consent where you opt in to analytics cookies.

4. Who processes data for us

• Clerk — authentication and session management.
• Paddle — checkout, subscriptions, invoices, and tax as merchant of record.
• Neon / PostgreSQL — application database (accounts, assignments, credit ledger).
• Object storage (S3-compatible) — uploaded files.
• Anthropic (Claude) — QA / supervisor-style feedback when a scan runs. The full solution draft is sent only to produce that check.
• Google Gemini — grammar and language review when that analysis runs. The full solution draft is sent only to produce that check.
• Winston AI — AI-use and plagiarism indicators when those tabs run. These are signals, not misconduct findings. The full solution draft is sent only to produce that check.
• Resend or similar — transactional email.
• Sentry — error diagnostics, when configured. Events are stripped of draft text, email addresses, and request bodies before they are sent.
• Vercel — hosting. Vercel Analytics and Speed Insights run only after the same cookie opt-in as Google Analytics, on the marketing site and in the signed-in app.
• Google reCAPTCHA — checks the contact form for automated submissions. Google receives the check token and browser signals for that request. Assignment drafts are not sent.
• Google Analytics — site analytics, only after cookie consent.
• Trustpilot — the homepage shows their star badge under the hero wave and a review button under the pre-footer drawing. Both are images we host, and both link to Acadomic’s public review page. They do not load a Trustpilot script and do not receive assignment drafts.
• Inngest — background jobs that generate scan feedback.

Providers may process data outside your country. We use them only to operate Acadomic. We do not sell personal information.

5. Access inside the product

Drafts and reports stay in your workspace. Access is limited to you, tutors you invite into comment threads, and members of an organisation you belong to. Those members see the author’s name on a shared assignment, not that person’s email address. When you delete your account, personal files are deleted. Work that already sits in an organisation stays with that organisation and is moved to another member. We do not publish student work.

6. Cookies

Strictly necessary cookies keep the site secure, remember your session, and store your cookie choice. The contact form loads Google reCAPTCHA so automated submissions can be refused. That check may set a cookie from Google. Analytics cookies are off until you accept them. You can change your mind with the Cookie settings button on any page.

7. Retention

We keep account and workspace data while the account is active. After you request deletion, or after a cancelled plan ends and the account is closed, we delete personal workspace files. Organisation workspace files remain with the organisation. Our billing archive keeps the plan, amount, dates, and payment reference, without your name or email. Paddle, as merchant of record, keeps invoices for as long as tax law requires and does not let us erase that profile through an API. We cancel any subscription that is still billing and archive the Paddle customer so it is not used again. You can ask Paddle to delete the rest of the buyer profile it holds. Scan reports remain available in the product until deleted or the account is removed.

8. Your rights

You may ask to access, correct, export, or delete personal data, or to object to certain processing. Email contact@acadomic.com. You can also manage profile details in Clerk and Settings. If we refuse a request where the law allows, we will say why. A country-by-country summary is on the Data privacy page (GDPR, UK GDPR, India’s DPDP Act, CCPA/CPRA, and education-record notes).

9. Children

Acadomic is aimed at higher-education students, tutors, and institutions. We do not knowingly collect data from children who cannot consent to the service. If you believe we have, contact us and we will delete it.

10. Security measures we actually run

We do not claim ISO 27001, SOC 2, or similar certificates on this page unless we have named them here. What we do operate today:

• HTTPS in transit for the web app and APIs.
• Clerk-authenticated sessions; route handlers reject unsigned requests.
• Workspace scoping: drafts stay with the owner or the organisation tenant.
• Object storage for files; the application database for reports and the credit ledger.
• Paddle holds card data. We store subscription and transaction identifiers only.
• Least-privilege staff access and error diagnostics (Sentry) when configured.
• Analytics and speed measurement run only after you opt in, including in the signed-in app.
• Uploaded files can be read only by the account that uploaded them, or through an assignment that account is allowed to open.

No method of transmission is perfectly secure. Use a strong password or SSO and only upload files you are allowed to share.

11. Global data-security compliance

Acadomic is offered worldwide. We align our processing with the laws that apply to the people and institutions who use it:

• GDPR / UK GDPR. Lawful bases, purpose limitation, data-minimisation, and data-subject rights. EU/UK users may complain to their supervisory authority.
• India DPDP Act. Ontinity Private Limited is the data fiduciary for personal accounts. Grievances go to contact@acadomic.com.
• CCPA / CPRA and similar US state laws. We do not sell personal information. You may know, delete, and correct. Analytics is opt-in.
• Education records. We are not a school. A university enterprise customer typically remains controller of learner files; we process them to provide the workspace and will sign a DPA on request.
• Cross-border transfers. Subprocessors may sit outside your country. We use them only to run the product (auth, database, storage, models, email, payments).

If a regulator or institution needs a written security pack, email contact@acadomic.com. Security incidents that affect your account will be notified as required by applicable law.

12. Changes

We will update this policy when processors or product behaviour change. The effective date at the top will change. Continued use means you have read the current version.

13. Contact

Privacy requests for Acadomic go to contact@acadomic.com, Ontinity Private Limited.