1. Controller
Wicker Study is operated by David Henry Francis Wicker, acting as an individual rather than through a company or other legal entity. David Henry Francis Wicker is the controller for personal data processed through this service. Privacy enquiries and data-rights requests can be sent to privacy@study.wicker.life; general enquiries can be sent to info@study.wicker.life.
2. Data we process
- Account data: account identifier, email address, authentication status, and account creation information supplied through Clerk.
- Study data: course ordering, progress, mastery, notes, attempts, answers, flashcards, mistake history, review schedules, academic-plan details, and mock-session records.
- Course requests: the course and curriculum context, notes, URLs, and source files you choose to submit when requesting maintained content for an unsupported course, plus the request’s production status.
- Optional editorial contributions: if you separately opt in, the selected rights basis, permission time, review decision, source filename, checksum, extracted text, page-level provenance, topic mappings, and evidence links needed to prepare and audit shared course content.
- AI activity: tutor messages, exercise instructions, academic documents or descriptions submitted for plan extraction, retrieved course passages, request counts, and input/output token totals. Account email addresses are not intentionally included in model prompts.
- Feedback: reports, optionally shared account email for investigation follow-up, explicitly attached excerpts/screenshots, answer ratings, public replies, review status and access records. Unsubmitted drafts, optional contact email and attachments are encrypted. Minimized diagnostics contain error codes, page categories, timing and release; diagnostic and optional performance preferences are available in My feedback. Optional AI review uses only submitted messages/text excerpts after per-report permission, never referenced private originals.
- Correspondence: messages and contact details supplied when someone emails a Wicker Study contact address.
- Technical data: essential session data and security or service logs created by hosting and authentication providers.
Course-request material is private intake by default. Optional shared use is presented separately and is not required to request a course. Source originals remain restricted to authorised administrators; student-facing publication uses reviewed derivatives rather than automatically exposing uploaded files.
3. Purposes and legal bases
4. Service providers and transfers
Wicker Study uses Clerk for authentication, Neon for managed database storage, Vercel for hosting, OpenAI for requested AI features, Forward Email for incoming email forwarding, and Google Gmail as the destination mailbox for Wicker Study contact addresses. These providers process only the data needed for their role. Some processing may occur outside the EEA under the applicable provider terms, data-processing agreements, adequacy decisions, or other recognised transfer safeguards.
Personal data is not sold and is not used for third-party advertising.
Feedback retention
Feedback drafts expire after 30 minutes and are purged after one day. Minimized diagnostic events are kept for 30 days. Shared evidence is removed 90 days after issue closure, and closed reports after 12 months. You can withdraw attachments sooner in My feedback. Account export and deletion include your feedback data. Deleting live data does not retroactively remove copies from infrastructure backups before their normal expiry. Feedback is used for service support and improvement, with optional model-assisted review only when you choose it.
5. Retention, withdrawal, and deletion
Primary account and study data is retained while the account remains active. Academic Work and transcript originals attached in setup are retained privately so you can view and download them later. They are removed when you remove that document, erase uploaded data, or delete your account. Their bytes are kept separate from AI context. Other curriculum and screenshot originals submitted for plan extraction are used to create a review draft and are not retained; only confirmed academic fields are saved. Files attached to a course-content request remain private while the request is processed and are included in account export and deletion.
You can withdraw optional shared-use permission from the course request while it is in production, or contact privacy@study.wicker.life. Withdrawal excludes that contribution from future mapping, generation, and publication and does not affect processing that was lawful before withdrawal. Account deletion withdraws the account’s sources from future editorial processing and removes an uploaded source when no independently authorised contribution still supplies the same file. Already-published reviewed derivatives may remain where they contain no personal data and their continued use is permitted by the contribution terms; a privacy or rights request can still ask us to assess a specific item.
Correspondence is kept only as long as reasonably needed to handle the request, maintain necessary records, and meet legal obligations. Users can export personal data and permanently delete an account from Settings. Limited copies may remain temporarily in provider backups or security logs until their normal protected retention cycle ends, or longer where law requires it.
6. Your rights
Depending on the circumstances, the GDPR provides rights to be informed, access data, correct inaccurate data, request erasure or restriction, object to certain processing, receive portable data, and avoid decisions based solely on automated processing that have legal or similarly significant effects.
Settings provides direct data export and account deletion. Other requests can be sent to privacy@study.wicker.life. We may need to verify identity and aim to respond without undue delay and ordinarily within one month. You may also complain to the data protection authority in your country, including the Dutch Data Protection Authority where applicable.
7. AI and automated processing
AI features support study and do not make legal or similarly significant decisions about users. Routine answer checking is performed locally against prepared reference material. Tutor chat is retrieval-grounded, but its output can still be incomplete or incorrect and should be checked against course sources. Academic-plan extraction creates an editable draft only; users review and confirm the fields before they enter the personal record. Shared-course generation is started by an administrator, produces private drafts with source evidence, and requires editorial approval before publication. Assessment rules that are missing, uncertain, or contradictory remain marked for review.
9. Security
Personal data is separated by authenticated user identifier. Transport encryption, access controls, managed infrastructure, and server-side policy enforcement are used to reduce risk. No internet service can guarantee absolute security.
10. Contact and changes
Privacy questions and rights requests: privacy@study.wicker.life. Security reports: security@study.wicker.life. General enquiries: info@study.wicker.life. Material changes to this notice will be dated on this page.