Privacy Policy

a. Information you provide directly

• Account information: your email address and password (stored securely via Supabase Auth with hashed passwords).
• Profile information: your full name, if you choose to provide it.
• Waitlist: if you join the waitlist without an account, your email address, used only to tell you when sign-ups open.
• User content: notes, uploaded files (PDF, Word documents, plain text, Markdown, and PNG, JPG, WebP, or GIF images), flashcards, flashcard decks, project names and descriptions, and chat messages you create within the Service.

b. Information collected automatically

• Usage data: basic interaction logs such as which features you use, collected to improve the Service, and page-view statistics from Vercel Web Analytics, which does not use cookies.
• Technical data: IP address, browser type, and device information transmitted as part of standard web requests and handled by our infrastructure provider (Vercel).

c. Information we do NOT collect

• We do not see or store your card number. Pro payments are processed by Stripe, under Stripe's Privacy Policy. We keep only your subscription status: your plan, your Stripe customer and subscription IDs, and your renewal date.
• We do not use tracking cookies or third-party advertising trackers.
• We do not build advertising profiles or sell data to data brokers.

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Authenticate your identity and secure your account.
• Process and display your User Content within your workspace.
• Send transactional emails such as password reset requests.
• Improve and develop new features of the Service.
• Respond to requests you make through your account settings.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not use your content to train AI models. Your notes, files, and chats are not used for any purpose other than delivering the Service to you.

When you use AI features, relevant portions of your User Content are sent to an AI provider to generate a response. Chat replies come from OpenAI. Requests are sent with storage turned off, so OpenAI does not keep the conversation. If OpenAI is unavailable, Groq, Inc. answers instead. Groq also handles flashcard generation, text transformations, memory of your preferences, and reading the text in images you upload. When web search is needed, your query may be sent to Tavily. This processing is necessary to generate responses and retrieve current sources.

• Data sent to OpenAI is governed by OpenAI's Privacy Policy.
• Data sent to Groq is governed by Groq's Privacy Policy.
• Data sent to Tavily is governed by Tavily's Privacy Policy.
• We transmit only the content necessary for the specific AI request (e.g., relevant notes or file excerpts for context).
• We recommend you do not submit sensitive personal information, passwords, financial data, or confidential third-party data through AI features.

We do not sell, rent, or trade your personal information. We share your information only in the following limited circumstances:

• Previously generated Google Search-grounded replies retain Google attribution and expire within two years. Google is no longer used for new AI requests.
• Infrastructure providers: Supabase (database, authentication, file storage), Vercel (hosting and cookieless analytics), OpenAI and Groq (AI inference), Tavily (optional web search), Stripe (payments), and Resend (account email) receive data as necessary to operate the Service. Each is bound by their own privacy and data processing terms.
• Legal compliance: We may disclose your information if required by law, subpoena, court order, or other governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: If Selrano is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.

Your data is stored securely on Supabase's infrastructure (PostgreSQL database and private object storage). We implement the following safeguards:

• Row-level security (RLS): database policies ensure each user can only access their own data. Your data is never accessible to other users.
• Encrypted storage: all data is encrypted at rest and in transit (HTTPS/TLS).
• Private file storage: uploaded files are stored in a private bucket accessible only to your account.
• Hashed passwords: passwords are never stored in plain text.

Despite these measures, no system is 100% secure. We cannot guarantee absolute security of your data. In the event of a data breach that affects your rights and freedoms, we will notify you as required by applicable law.

We retain your personal data for as long as your account is active or as necessary to provide the Service.

• When you delete your account, we will delete your personal data, User Content, and files from our systems within 30 days, except where we are required to retain it by law.
• Aggregate, anonymized data that cannot identify you may be retained indefinitely for analytical purposes.
• Backups may retain data for up to 90 days following deletion before being purged.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your data. You can delete your account at any time from the Settings page.
• Portability: request your data in a portable, machine-readable format.
• Objection: object to certain uses of your data.

You can exercise most of these rights directly in the app: delete your account and data, and manage email preferences, from the Settings page.

California residents: under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect, request deletion, and opt out of any sale of personal information (we do not sell personal information). You can delete your account and its data from Settings; for other requests, see Contact Us below.

Selrano uses only essential cookies necessary to operate the Service, specifically session authentication cookies set by Supabase to keep you logged in. We do not use advertising cookies, tracking pixels, or analytics cookies from third parties.

You can disable cookies in your browser settings, but doing so will prevent you from logging in to the Service.

Selrano is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please delete the account from Settings and we will remove that information.

The Service may contain links to external websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or by posting a prominent notice within the Service before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

Selrano does not currently offer a public email address. For privacy requests, use the account controls in Settings. We will publish a contact channel here as soon as one is available.