Noli Study
Sign up free
← Back to Noli Study

Privacy Policy of noli-study.com

Latest update: 22 October 2026

This policy explains what personal data Noli Study processes, why, on what legal basis, for how long, who helps us process it, and what your rights are. It applies to the website noli-study.com and the app installed from it (the “Service”).

This policy exists in English and in Dutch; switch the site's language to read the other version. Both versions are equally valid. If they differ, the reading most favourable to you applies.

Owner and Data Controller

Wout Desmedt, trading as Noli Web Apps, operating Noli Study
Willy Maststraat 25, 9032 Wondelgem, Belgium
Enterprise number (KBO/BCE): 1043.553.021

Contact for questions about your data: [email protected]

We haven't appointed a data protection officer; at our size the law doesn't require one. Write to the address above for anything about your data.

What We Do Not Do

  • We never sell your personal data or your study content.
  • We show no advertising and use no analytics or advertising cookies.
  • We send no marketing emails without your consent.
  • We make no decisions about you by automated means that have legal or similarly significant effects.

What We Process, Why, and for How Long

For each purpose: the data, the legal basis under the General Data Protection Regulation (GDPR), and how long it's kept. When you delete your account from your profile, your account and everything in it are deleted right away, except where a longer period is named below.

Your account

  • Data: Email address, name (optional), a securely hashed password (not for Google-only accounts), language, accent colour, and, if you sign in with Google, your Google account ID (the identifier Google gives your account, which we use to recognise you when you sign in) and the name and profile picture Google shares with us. We don't store Google's access tokens.
  • Legal basis: Contract: we need it to give you an account (art. 6(1)(b) GDPR).
  • Kept: As long as your account exists.

Your study content and activity

  • Data: Courses, chapters, cards and images; which chapters you studied and when, their next review date, your exam dates, and how many cards you studied per day.
  • Legal basis: Contract: this is the Service itself (review schedule, reminders, streak, statistics).
  • Kept: As long as your account exists. You can export or delete it at any time.

AI features

  • Data: What we send to the AI provider depends on the feature. For the study assistant: your message, the earlier messages of that conversation, and the titles and cards (front and back) of the course or chapter you ask about. For multiple choice: the card's question and answer. For generating cards and for the StudyFlash import: the text extracted from your document, not the file itself or its file name. We never send your name, email address or user ID. For every AI request we record the feature, time, model, amount of text and estimated cost, not the content.
  • Legal basis: Contract for sending the text (you ask for the feature). Legitimate interest for the usage records: enforcing fair-use limits, preventing abuse and understanding costs (art. 6(1)(f)).
  • Kept: The text isn't stored by us beyond the result you keep. Usage records: 24 months, or until you delete your account.

Payments and subscriptions

  • Data: Your Stripe customer number, plan, status and renewal date, and the exact text and time of the consent you give at checkout to start immediately. Stripe processes your payment details, which we never see.
  • Legal basis: Contract, and our legal obligations under Belgian tax and accounting law (art. 6(1)(c)). For keeping the consent record after you delete your account: our legitimate interest in establishing or defending legal claims (art. 6(1)(f)).
  • Kept: Plan: as long as your account exists. The consent record: 7 years, also after you delete your account, but then no longer linked to your account. Payments and invoices: in Stripe and our accounts for as long as Belgian accounting and tax law requires (at least 7 years), also after you delete your account, without your name and email address in Stripe.

Account emails

  • Data: Your email address and the email's content: address verification, password reset, confirmations of a changed password or email address, the confirmation of your Pro contract, and a message when your support request is resolved.
  • Legal basis: Contract.
  • Kept: Not stored by us beyond the account itself; the email provider keeps delivery logs for a short time.

Support

  • Data: Your support requests in the Service with their attachments, and emails you send to our contact addresses (also withdrawals and content reports).
  • Legal basis: Contract when it's about your account or subscription; otherwise legitimate interest in answering you.
  • Kept: Requests in the Service: as long as your account exists. Emails: as long as needed to handle your request and any follow-up, and for withdrawals and reports as long as we may need them as proof.

Security and abuse prevention

  • Data: IP address and browser characteristics (Cloudflare and its Turnstile check on sign-up, log-in, password reset and support), and a one-way, keyed hash of your IP address (never the address itself) to limit how many accounts one connection can create.
  • Legal basis: Legitimate interest: keeping the Service and your account safe and stopping automated abuse.
  • Kept: The hashed IP address: at most 2 days. Cloudflare: under its own short retention.

Error logs

  • Data: Technical error reports from the server and your browser, which can include the page you were on and the text of the error.
  • Legal basis: Legitimate interest: keeping the Service working.
  • Kept: 30 days, in the database and in log files on the server.

Backups

  • Data: Nightly copies of the database and the uploaded files.
  • Legal basis: Legitimate interest: being able to restore the Service after a failure.
  • Kept: 7 days on the server; a copy on our own backup server in Belgium, kept 30 days, physically secured and accessible only to us; an encrypted copy at Hetzner (Storage Box, in the EU), deleted after at most 3 months; and Hetzner's own backups of the server, kept 7 days. Deleted data disappears from the backups within those periods.

Help from the Owner

  • Data: To answer a support request or investigate a problem, the Owner can open your account and see it the way you do. Every such access is recorded in an audit log. Your password is never visible.
  • Legal basis: Legitimate interest: supporting you and fixing problems.
  • Kept: The audit log: 1 year. When you delete your account, your email address is removed from it.

Weekly leaderboard

  • Data: Only if you join it: the leaderboard name you choose (it doesn't have to be your real name) and your number of studied cards this week, visible to other signed-in users; your top-3 weeks.
  • Legal basis: Consent, given by switching the leaderboard on (art. 6(1)(a)). Switch it off at any time and you disappear from it immediately.
  • Kept: Until you leave the leaderboard or delete your account.

Push notifications

  • Data: Only if you switch them on: an address at your browser maker's push service (for example Apple, Google or Mozilla), which delivers at most one reminder a day about chapters to repeat and upcoming exams.
  • Legal basis: Consent, given by switching them on in Settings.
  • Kept: Until you switch them off or delete your account.

Sharing a chapter

  • Data: When you create a share link, the person who opens it sees the chapter's title and number of cards, and can copy the chapter and its cards (with images) into their own account. A link works once and expires after 48 hours if unused; you can revoke it before then.
  • Legal basis: Contract: you ask us to share it.
  • Kept: The copy belongs to the other person and stays in their account even if you later change or delete your chapter.

Legal obligations and disputes

  • Data: The data relevant to a legal obligation (for example a request from an authority, or a report of illegal content), or to a dispute about your use of the Service.
  • Legal basis: Legal obligation, or legitimate interest in establishing or defending legal claims.
  • Kept: As long as the obligation or the dispute requires.

Please don't put personal data about yourself or others in documents or messages you submit to the AI features. Your email address and password are never sent to the AI provider.

Who Helps Us Process Your Data

These service providers process personal data for us, only for the purposes above. All of them do so under a data processing agreement, except Microsoft: the Outlook mailbox where emails to our contact addresses arrive is a consumer mailbox, without a data processing agreement. It only holds the emails you send us.

  • Hetzner Online GmbH (Germany): Hosts the server, the database, the uploaded files and backups, including the encrypted backup copy (Storage Box). Location: European Union.
  • Cloudflare, Inc.: Delivers and protects the website, checks forms against bots (Turnstile), and forwards emails sent to our contact addresses. Location: United States and the Cloudflare network.
  • Microsoft (Outlook): The mailbox where emails to our contact addresses arrive. Location: European Union and United States.
  • Google Ireland Limited / Google LLC: Sign in with Google, and the Gemini API for the AI features. Location: European Union and United States.
  • Stripe Payments Europe, Ltd. (Ireland): Payments and subscriptions. Stripe is also an independent controller for fraud prevention and its own legal obligations, under its own privacy policy. Location: European Union and United States.
  • Resend, Inc.: Sends account emails. Location: United States.
  • Your browser maker's push service: Delivers push notifications, if you switch them on. Location: Depends on your browser (for example Apple, Google or Mozilla).

The AI provider. The Service uses Google's paid Gemini API. Under Google's terms for the paid service, Google doesn't use submitted content to improve its products; it keeps it for a limited time only to detect abuse and comply with the law.

Transfers outside the EU. Where a provider processes data in the United States, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for certified providers) or on the Commission's Standard Contractual Clauses. Ask us for a copy of the relevant safeguards at [email protected].

We may also have to give data to authorities when the law requires it, and the people you share a chapter with see what you share.

Cookies and Data Stored on Your Device

The Service only stores what it needs to work. It uses no analytics, advertising or marketing cookies, so no cookie banner is needed under Belgian law; this list is here for transparency. Stripe's checkout page and Cloudflare Turnstile may set their own strictly necessary cookies for security and fraud prevention.

  • Cookies: your sign-in session (up to 30 days, or until you sign out), your language and theme, whether the sidebar is collapsed, and a few short-lived ones (10 minutes) during sign-up and sign-in (that you confirmed you are 13 or older, the page to return to, and a chapter share link you opened before signing in).
  • Browser storage: a copy of your current study assistant conversation (deleted after an hour without use), cards generated by AI that you are still reviewing (kept 24 hours so a reload doesn't lose them, deleted once you import or cancel them), display preferences such as list sorting, and study sessions finished without an internet connection until they reach our server.
  • Offline copies: pages you opened are kept by the browser so the Service works without an internet connection (for example when installed on your phone).

When you sign out, or delete your account, the Service deletes the offline copies and the conversation and review copies from your browser. It does the same when another account signs in on the same browser. Before signing out, it tries to send study sessions finished offline, and asks you before discarding any it couldn't send.

Your Rights

Under the GDPR you have the right to:

  • access your data and get a copy of it;
  • have incorrect data corrected;
  • have your data deleted;
  • restrict the processing of your data;
  • receive your data in a structured, machine-readable format and have it transferred to another controller;
  • withdraw your consent at any time (for the leaderboard and push notifications: switch them off), without affecting what happened before;
  • lodge a complaint with a data protection authority. In Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données (gegevensbeschermingsautoriteit.be).

Your right to object. Where we process your data on the basis of our legitimate interest (see the list above), you have the right to object to that processing at any time, on grounds relating to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish or defend legal claims.

You can do a lot yourself: download your whole account as a .zip file (courses, chapters and cards with study progress as JSON and CSV, plus your images) or a chapter or course as a CSV file, correct your details on your profile, and delete your account there. For anything else, email [email protected]. Requests are free and answered as soon as possible, and always within one month. We may ask you to confirm your identity first.

Minimum Age

The Service is intended for people who are at least 13 years old, the age from which a person in Belgium can consent to the processing of their own personal data without a parent's permission. You confirm your age when you create an account; an account can't be created without it. We don't knowingly collect personal data from children under 13. If we learn that an account belongs to a child under 13, we delete it. Parents or guardians who believe this has happened can contact us.

Security

Connections to the Service are encrypted (HTTPS), passwords are stored only as a secure hash, the backup copy at Hetzner (Storage Box) is encrypted and the copy on our own backup server is physically secured and accessible only to us, the server is reachable for administration only through a private network, and access to personal data is limited to what is needed. If a data breach is likely to put you at high risk, we tell you without undue delay.

Changes to This Policy

We update this policy when what we do with your data changes. The date at the top shows the latest version. We tell you about important changes by email before they take effect, and ask for your consent again where the law requires it.

Contact Us

For any question about this policy or to exercise your rights, contact [email protected].