Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how Wizzad (“Wizzad,” “we,” “us,” or “our”) collects, uses, shares, and protects information about you when you use our website at wizzad.ai and our related applications, products, and services (collectively, the “Service”). Wizzad is an AI-powered student workspace that brings study, research, writing, design, and productivity tools together in one place.

By using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Service.

1. Information we collect

Information you provide to us

Account information — your name, email address, and password when you create an account. If you sign in with a third-party provider (Google or Microsoft), we receive your name, email address, and profile picture from that provider instead of a password.
Content you create or upload — documents, PDFs, presentations, images, videos, notes, flashcards, quizzes, research queries, whiteboards, chat messages, meeting recordings and transcripts, and other materials you submit to the Service so that we can provide its features.
Payment information — if you purchase a paid plan or credits, our payment processors (Stripe, and Chargebee for subscriptions) collect and process your payment details. We do not store full payment card numbers on our servers.
Communications — information you provide when you contact us for support or otherwise correspond with us.

Information we collect automatically

Usage data — how you interact with the Service, such as the features you use, actions you take, and study or activity history, which we use to operate and improve the Service.
Device and log data — your browser type, device information, IP address, and timestamps, collected automatically when you access the Service.
Cookies — we use a small number of essential cookies, including a session cookie that keeps you signed in. See Cookies below.

2. Signing in with Google & Google user data

When you choose “Continue with Google,” we use Google’s OAuth sign-in to authenticate you. We request only the basic scopes openid, email, and profile. From these we receive your email address, name, and profile picture, and we use them solely to create and secure your account, sign you in, and identify you within the Service. We do not receive your Google password.

Wizzad’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Optional Google Workspace connectors

Separately from signing in, you may choose to connect a Google Workspace tool from the assistant’s Connectors directory. This is entirely optional. When you do, Wizzad requests read-only access to only the service you connect — and, only when you ask the assistant to create or change something (a Google Doc, a Slides deck, a Calendar event), permission to do that:

Google Drive (drive.readonly) — to search and read the files you ask the assistant about.
Gmail (gmail.readonly) — to search and read the messages you ask the assistant about.
Google Calendar (calendar.readonly) — to view your events so the assistant can help you plan.
Creating or editing, when you ask (documents, presentations, calendar, drive.file) — to create or edit the Doc, deck or event you asked for, and the files Wizzad created for you.

We use this data only to provide the feature you invoke, and:

We store only an encrypted refresh token so the assistant can access the service when you ask. Content it retrieves (a file’s text, an email, an event) is fetched on demand to answer your request and appears in your assistant conversation, which is saved in your own workspace; we do not separately harvest, copy, or retain your Google data outside that.
We do not use Google user data to develop, improve, or train generalized AI/ML models.
We do not sell Google user data or use it for advertising.
No human reads your Google user data except as necessary for security or to comply with applicable law, or with your explicit consent.

You can revoke Wizzad’s access at any time by disconnecting the connector in the app, or from your Google Account permissions page.

3. How we use your information

To provide, maintain, and operate the Service and its features.
To generate AI outputs you request (see AI processing).
To personalize your experience and remember your preferences.
To process payments, manage subscriptions, and prevent fraud.
To communicate with you about your account, security, updates, and support requests.
To monitor, secure, debug, and improve the Service and develop new features.
To comply with legal obligations and enforce our terms.

4. AI processing & third-party AI providers

Many of Wizzad’s features are powered by third-party artificial intelligence providers. To generate an output you request — such as a summary, answer, analysis, transcript, image, or study aid — the relevant content you submit may be transmitted to and processed by these providers on our behalf. Providers we use include, but are not limited to, OpenAI, Anthropic, Google (Gemini), TwelveLabs, Perplexity, ElevenLabs, Runway and LiveKit (the spoken examiner), Kling and Black Forest Labs (image and video generation), Serper (web search), E2B (running a notebook you hand in), and Recall.ai (for meeting recording and transcription).

Defending your work. When you defend a piece of your work, its text is sent to an AI provider to write the questions; your answers — typed, or spoken and transcribed — are graded by AI providers against a marking guide; and, only if you choose, your camera and screen are recorded. The sealed record is kept in your account and is seen by a reader only through a link you make, which you can withdraw. A reader who asks you a question gives their name and email address so you can answer them.

Drawing your own mascot. If you choose to draw a mascot from a photo, the photo is sent to OpenAI to draw it. We do not keep the photo: it is used for that drawing and then discarded. Only the mascot it draws is kept, in your account, where only you can see it, and it is deleted with your account.

These providers process your content to return a result to you and act as our service providers under their respective data-processing terms. AI outputs can be inaccurate or incomplete; you are responsible for reviewing them before relying on them.

We do not sell your personal information. We share it only as follows:

Service providers (sub-processors) — companies that perform services for us, such as cloud hosting, storage and infrastructure (Render, Cloudflare), the AI providers described above, payment processing (Stripe, Chargebee), email (Resend), and meeting recording (Recall.ai). They may access your information only to perform work for us and are bound by confidentiality obligations.
Legal and safety — when required by law, legal process, or to protect the rights, property, or safety of Wizzad, our users, or others.
Business transfers — in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred, subject to this Policy.
With your consent — when you direct us to share information, including content you choose to make public or share with others.

6. Cookies

We use strictly necessary cookies to operate the Service — most importantly a session cookie that keeps you signed in after you log in. These are required for the Service to function. We do not use cookies for third-party advertising. Most browsers let you block or delete cookies, but doing so may prevent you from signing in or using the Service.

7. Data retention

We retain your information for as long as your account is active or as needed to provide the Service. When you delete content or close your account, we delete or de-identify the associated personal information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

If nobody signs in to your account for 24 months, we email you. Signing in within 30 days keeps it, and nothing changes. If you don’t, we delete it in the same way as if you had asked: it is locked, we email you a link to keep it, and after 14 days it is erased. We never delete an account with an active subscription, or one holding credits you bought. For accounts that existed before October 2026, the 24 months count from that month.

Recordings of answers you speak aloud in a work sample’s defense are kept while you let readers hear them on a record you have shared. Otherwise we delete them 90 days after the defense, and never sooner than 30 days after you stop sharing them. Your written answers and your signed record stay with your account until you ask us to delete them; withdrawing a record takes its public link down. You can delete the recordings yourself at any time from the work sample.

The same rule applies to the recordings of any other Defend sitting: the answers you speak, and your camera and screen if you chose to record them. They are kept while a live link you made carries them. Otherwise we delete them 90 days after the sitting, and never sooner than 30 days after the last link that carried them was withdrawn or expired. Your record and its results stay, and so does each recording’s fingerprint, which cannot change. You can delete the recordings of any sitting yourself at any time, from the piece you defended.

When someone opens a work sample record you shared, we count the opening (once it has been on screen a few seconds) and show you the total; your own visits while signed in are not counted. A reader may also answer one question about the record, with an optional note. We keep the count and the answers with your work sample, and nothing about the reader: no account, no cookie, no address. The answers come to us, not to you, and help us make records more useful. Both are deleted with your account.

When you delete your account

You can delete your account yourself from Account settings. The moment you do, your account is locked: you are signed out everywhere, nothing you shared (records, credentials, links, pages, forms, booking pages) opens for anyone, any subscription is cancelled, and accounts you connected are disconnected. You then have 14 days to change your mind, using the link in the email we send you. After that we erase your account and everything in it — within 30 days of your request — including pages you own that others were invited to, and we send you a last email to say it is done. Backups roll off within 90 days.

A few records are kept, without your name: billing and payment records, which the law requires us to keep; the record of your consent choices for Brain memory, as the audit of what you agreed to; and, for meetings you recorded, Recall.ai’s record that each recording bot existed. We ask Recall.ai to delete every recording, transcript and participant record, but it keeps a bot’s descriptive details and cannot change them afterwards. Since October 2026 those details are only an opaque tag that does not identify you; a bot created before then may also carry your account’s internal id, the meeting’s title and its calendar event id.

We also keep the identifier of each badge or credential you were issued and the date it was withdrawn. Deleting your account withdraws them all. A credential’s identifier is random and names no one; we keep it so that anyone holding a copy you shared can check that it no longer stands.

8. Security

We use technical and organizational measures designed to protect your information, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, update, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA/UK (under GDPR) and California (under the CCPA/CPRA), among others, have these or similar rights. You can update much of your information from within your account, delete your account yourself from Account settings (see “When you delete your account” above), and you may exercise other rights by contacting us at privacy@wizzad.ai. We will not discriminate against you for exercising your rights.

10. International data transfers

Wizzad and its service providers may process and store your information in countries other than your own, which may have different data protection laws. Where required, we use appropriate safeguards for such transfers.

11. Children’s privacy

The Service is intended for students and is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children under that age. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will take steps to delete it. If you are under the age of majority where you live, you may use the Service only with the involvement and consent of a parent or guardian.

12. Third-party links and services

The Service may contain links to third-party websites or integrate third-party services. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their policies.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the Service after an update means you accept the revised Policy.

14. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at privacy@wizzad.ai.