Privacy Policy
1. Data Controller
KSUR Services, trading as Cardemio, is the data controller responsible for the personal data processed through the Cardemio service. This means we decide why and how your personal data is processed. You can reach us at support@cardemio.com.
2. Information We Collect
We collect account information (email, name), content you upload (PDFs, decks, cards, comments), usage data (quiz scores, interactions), and technical data (IP address, browser type) to operate and improve the service. Payment and billing information is collected and processed directly by our Merchant of Record, Paddle.com, not by Cardemio.
3. How We Use Your Data & Legal Basis
We use your data to provide the flashcard and quiz services, generate AI study materials, enable community features, personalize your experience, and communicate with you about your account. Our legal bases for processing are: (a) performance of a contract with you (to deliver the service and manage your subscription); (b) our legitimate interests (to secure, maintain, and improve the service, and to prevent fraud and abuse); (c) your consent (for optional analytics, marketing, or non-essential cookies, where required); and (d) compliance with legal obligations (accounting, tax, and responding to lawful requests).
4. Data Sharing & Recipients
We do not sell your personal data. We share data with categories of recipients strictly necessary to operate the platform, including: cloud hosting and database providers; AI model providers used to generate study materials; and Paddle.com, our Merchant of Record, which processes payments, manages subscriptions and invoicing, and handles sales-tax compliance and refunds on our behalf. We may also share data with professional advisers and with authorities where required by law. Public decks are visible to all users.
5. International Transfers
Some of our providers (hosting, AI processing, and our Merchant of Record Paddle.com) may process data outside your country, including outside the UK and EEA. Where that happens, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.
6. Data Security
We implement industry-standard technical and organisational measures (encryption in transit, access controls) to protect your data. However, no online service is completely secure. You are responsible for keeping your password confidential.
7. Cookies & Tracking
We use essential cookies (authentication, session security, preferences) which are required for the service to work, and analytics cookies which help us understand how the product is used. Where required by law, non-essential cookies are only set with your consent. You can manage or delete cookies at any time through your browser settings.
8. Your Rights
Subject to applicable law, you have the right to access, rectify, erase, export (portability), restrict, or object to the processing of your personal data, and to withdraw consent at any time. To exercise these rights, email support@cardemio.com; we respond within one month. You also have the right to lodge a complaint with your local data protection authority.
9. Data Retention
We retain your data as long as your account is active or as needed to comply with legal, tax, and accounting obligations (typically up to 7 years for invoicing records held by our Merchant of Record). You may delete your account at any time, which will remove your personal data and private content. Data that is no longer needed is deleted or anonymised. Public decks may remain unless explicitly deleted.
10. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of significant changes via email or in-app notice.
11. Contact
For privacy-related questions, contact KSUR Services (trading as Cardemio) at support@cardemio.com.