Privacy notice

1. Who is responsible for your data

Mohamed Elhag, a sole trader based at 103 Gotse Delchev Blvd., Strelbishte, 1000 Sofia, Bulgaria, runs AceMed and is the controller of your personal data when you use it.

For anything about privacy, write to info@myacemed.com. No data protection officer has been appointed, because the law doesn't require one for AceMed; this address reaches the person responsible for privacy.

2. What we collect

• Account details: your name, email address, password (stored only as a secure hash) and preferred language. If you continue with Google, Google gives us your name, email address and Google account ID instead of a password.
• Study profile: your university, programme, year, subjects, goals, exam dates, daily study time and the character you choose.
• Study activity: which notes you open and finish, time studied, focus sessions, recall ratings, your study plan, and your highlights, pen drawings, margin notes and notebook pages.
• AI requests: the passage you ask about (Ask AI), your answers in Professor Mode (typed, or transcribed from your voice by your browser), and the grades and feedback you receive.
• Subscription and payment: your plan, trial and renewal dates, billing country, invoices and payment status. Card details are handled by our payment provider; we never receive your full card number.
• Messages: anything you send us, such as support questions or error reports from a note.
• Technical data: IP address, browser and device type, error and security logs, and short-lived counters that limit how many requests an IP address or account can make.

3. Why we use it, and our legal basis

• To provide AceMed — your account, notes, study tools and AI features. Basis: performing our contract with you (Art. 6(1)(b) GDPR).
• To take payments, issue invoices and keep accounting records. Basis: our contract, and our legal obligations under Bulgarian tax and accounting law (Art. 6(1)(c)).
• To send service emails — sign-in codes, password resets, receipts, payment problems, price changes and other important changes. Basis: contract and legal obligation.
• To keep AceMed secure and prevent fraud and abuse, including limiting excessive requests. Basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f)).
• To improve AceMed using statistics about how features are used, in aggregated form wherever possible. Basis: legitimate interest.
• To deal with complaints and legal claims. Basis: legitimate interest and legal obligation.

We don't add you to any marketing list without your consent. If you joined before 3 November 2026, you may be on our email list: unsubscribe with the link in any email from it, or write to info@myacemed.com and we will remove you.

You need to give us your account details to use AceMed; everything else depends on which features you use.

4. AI features

When you use Ask AI or Professor Mode, we send the passage, paragraph and note title, or the exam question, the reference answer and your answer, to our AI provider Anthropic PBC (USA) to generate a reply or a grade. We don't send your name or email with it. Under its commercial terms, Anthropic processes this data on our behalf, does not use it to train its models, and keeps it only for a limited period for safety and abuse monitoring.

Please don't include personal data about others (for example, patients) or sensitive data about yourself in what you type or say.

Professor Mode grades are practice feedback generated automatically. They have no legal or similarly significant effect on you, so they are not “automated decisions” in the sense of Art. 22 GDPR.

5. Voice

When you answer out loud in Professor Mode, the speech-to-text is done by your browser's built-in speech recognition. Depending on your browser, the audio may be processed by the browser maker (for example Google for Chrome, or Apple for Safari) under its own privacy terms. AceMed receives only the resulting text, never the audio. You can always type your answer instead.

The professor's spoken voice is generated by Inworld AI (USA) from the text of the professor's lines. Inworld receives only that text, never your voice, name or email.

6. Who we share it with

We never sell your personal data. We share it only with providers that help us run AceMed, under contracts that require them to protect it and use it only on our instructions:

• hosting and file storage: Amazon Web Services EMEA SARL (Luxembourg), with servers in Stockholm, Sweden;
• database: MongoDB, Inc. (USA), with the database stored in Stockholm, Sweden;
• payments: Stripe Payments Europe Ltd. (Ireland), which is also responsible on its own account for some processing, such as fraud prevention and its legal obligations;
• email delivery: Resend, Inc. (USA);
• AI: Anthropic PBC (USA);
• the professor's voice: Inworld AI (USA), which receives only the professor's lines;
• request limiting: Upstash, Inc. (USA), which keeps short-lived counters linked to IP addresses and account IDs;
• videos: Google Ireland Ltd. (YouTube). Video thumbnails in a note load from YouTube, and a video you play loads from youtube-nocookie.com, so YouTube receives your IP address under its own privacy policy;
• sign-in with Google: Google Ireland Ltd., if you choose “Continue with Google”. Google confirms your email address and gives us your name and Google account ID; we tell Google nothing about your studies;
• email list: Klaviyo, Inc. (USA), which holds the name, email address and phone number (if given) of students who joined before 3 November 2026. We no longer add anyone to it.

We may also disclose data where the law requires it, for example to a court or public authority.

7. Transfers outside the EU

Some providers are based in the USA: Anthropic, Inworld AI, Resend, Upstash, MongoDB, Klaviyo and Google. When your data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed. Ask us at info@myacemed.com for a copy of the relevant safeguards.

8. How long we keep it

• Account, profile and study data: while your account exists. When you ask us to delete your account, we delete it within one month of your request. Copies in backups are removed as those backups expire, within 90 days.
• Invoices and accounting records: as long as Bulgarian accounting and tax law requires, currently up to 10 years.
• AI requests: what is saved in your study activity (for example your Professor Mode answers and grades) is kept while your account exists; our AI provider keeps requests only for the limited period described above.
• Security logs: up to 90 days, unless needed to investigate an incident.
• Support messages and error reports: up to 2 years after they are resolved.
• Email list (students who joined before 3 November 2026): until you unsubscribe or ask us to remove you.

9. Your rights

You have the right to:

• access your data and get a copy of it;
• correct inaccurate data;
• delete your data (“right to be forgotten”);
• restrict how we use it in some cases;
• receive your data in a portable format and have it sent to someone else;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, where we rely on consent.

You can change most details in your account. For anything else, including deleting your account, write to info@myacemed.com from the email address of your account. We reply within one month. For complex requests the law lets us extend this by two more months; we'll tell you if we need to. We may ask you to confirm your identity first.

You can also complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, cpdp.bg), or to the authority in the EU country where you live or work. We'd appreciate the chance to sort it out with you first.

10. Age limit

AceMed is only for people aged 18 and over. Please don't create an account if you are under 18. If we learn that someone under 18 has an account, we will delete it.

11. Keeping your data safe

We use encrypted connections (HTTPS), hashed passwords, access controls and regular backups, and our providers are bound to similar standards. If a breach puts your rights at high risk, we will tell you and the supervisory authority as the law requires.

12. Changes to this notice

We'll update this notice when how we handle data changes, and tell you by email or in the app about important changes. The date at the top shows the latest version.