Privacy policy

This policy explains what personal data Tesio AI (“Tesio”, “we”) collects when you use the website at tesio.ai and the application at app.tesio.ai (together, the “Service”), why we collect it, who processes it on our behalf, and the rights and choices you have. It is written to describe what the product actually does. If something here does not match your experience, write to us at support@tesio.ai.

1. Who is responsible

The Service is operated by Tesio AI. For any question about this policy or about your data, contact support@tesio.ai.

2. What we collect

Account data

When you create an account we store your email address, the name you enter, and a hashed password. If you sign in with Google, we receive from Google your email address, name and profile picture; we never see your Google password. We also store your interface language and your analytics preference.

Content you bring

The Service exists to work on your study material. We store what you upload or link: documents (PDF, DOCX, text), audio and video files, pasted text, and the addresses of YouTube videos you add. From that material we derive and store transcripts, text chunks, vector embeddings, and the content the Service generates for you (study guides, courses, quizzes, flashcards, notes, chat conversations, illustrations, review cards).

You choose who sees a folder: it is private to you and the members you invite unless you make it open. Content inside a folder is visible to that folder’s members according to their role.

Usage and technical data

We record how the Service is used: which features you open, generations you start, review sessions, errors, and the pages of the website you visit. Together with that we collect technical data such as IP address, browser and device type, approximate location derived from the IP address, and timestamps. We keep an audit log of actions taken in shared folders (for example, who invited whom) so members can trust what happened in the group.

Payment data

Paid plans are sold by Paddle.com Market Ltd (“Paddle”), who acts as merchant of record. Paddle collects your billing details and payment method; Tesio never receives your card number. We receive from Paddle the status of your subscription, its identifiers, and the country used for tax purposes.

3. Why we use it

We use the data above to:

• provide the Service: store your material, generate content over it, schedule your reviews, and keep folders in sync between members;
• run your account: sign you in, send account emails (verification, password reset, welcome), and apply the limits of your plan;
• process payments and subscriptions through Paddle;
• understand how the product is used and improve it, including measuring which features are used and how generations perform;
• keep the Service secure, prevent abuse, and enforce our terms;
• comply with legal obligations.

The legal bases we rely on, where the law requires one, are the performance of our contract with you (providing the Service), our legitimate interests (improving and securing the Service), your consent (where you have given it, for example analytics), and compliance with the law.

4. AI processing

Generating a guide, a course, a quiz, a chat answer or an illustration means sending the relevant parts of your material, together with your question or instruction, to large language models. Tesio uses OpenRouter as a gateway to those models, which are provided by third-party AI companies (for example Anthropic, OpenAI and Google, depending on the task). Your content is transmitted to them for the sole purpose of producing the output you requested and computing embeddings that make your material searchable.

Tesio does not use your content to train models. OpenRouter and the model providers process the data under their own terms; we select routing options that do not allow the providers to use your data for training where that choice is available.

Audio and video you upload are transcribed by Deepgram, and the transcripts of YouTube videos you add are fetched through Supadata, so the Service can work with them as text. To operate and improve generation we record the prompts sent to the models and their outputs in Langfuse, an observability service; those traces contain the parts of your material that were sent, are used only to debug and evaluate the product, and are kept for a limited time.

Content generated by AI can be wrong. It is produced from your material but is not reviewed by a person; verify anything you rely on.

5. Who processes data on our behalf

We rely on the following providers. Each one only receives what it needs for its role.

We do not sell personal data, and we do not share it with anyone else except when the law requires it, to protect the Service or its users, or as part of a merger or acquisition (in which case this policy continues to apply to the transferred data).

6. Analytics and cookies

The Service uses PostHog to understand how it is used: which screens are opened, which features are used, where errors happen, and, with session replay, how the interface behaves. Session replay never records the content of your documents, generated material, chat, names or email addresses: those surfaces are masked before anything leaves your browser.

You can turn analytics off at any time in Settings in the application (“Share usage data”). The switch stops analytics events, session replay and browser error reports for your account.

The Service sets a small number of cookies and browser storage entries, all of which are needed to run it: your session cookie, the tokens that keep you signed in, your interface preferences, and the analytics identifier when analytics is on. The website tesio.ai uses no advertising cookies.

7. How long we keep data

• Your account and material: for as long as your account exists. When your account is deleted, your account data, your folders, the material and generated content in them, and your review history are deleted, except what a co-owned folder’s other members still hold and what we must keep by law (for example, billing records).
• Uploaded files: deleted from storage when you delete the resource, the folder, or your account.
• Server logs and technical data: up to 30 days.
• Analytics data: according to PostHog’s retention for our project, currently up to 12 months.
• Billing records: as long as tax law requires, held by Paddle.

8. Your rights

Depending on where you live (for example under the GDPR in the European Economic Area and the United Kingdom, or the CCPA in California), you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent where processing is based on it. You also have the right to complain to your data protection authority.

You can exercise some of these rights directly: edit your profile in Settings and delete material or folders from the application. To delete your account, or for anything else, write to support@tesio.ai from the address of your account; we answer within 30 days and complete a deletion within that time. We will not treat you differently for exercising a right.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, contact us and we will delete it.

10. Security

All traffic to the Service is encrypted in transit. Files and databases are encrypted at rest by our providers. Access to production systems is limited to the people who operate the Service and protected by strong authentication. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

11. International transfers

Tesio serves users worldwide and its providers are located mainly in the United States. When data is transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on the transfer mechanisms our providers offer, such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework where the provider is certified.

12. Changes to this policy

When we change this policy we update the date at the top. For changes that materially affect how we use your data we notify you by email or inside the application before they take effect.

13. Contact

Questions, requests and complaints: support@tesio.ai.