StudyMind Privacy Policy

Effective date: 1 October 2026 · Last updated: 1 October 2026 · Version 1.1 · Controller: TX Fintech Ltd, DIFC Reg. No. CL7465 · Privacy contact: support@txfintech.com

Part I: General

1. About this Privacy Policy

This Privacy Policy explains how TX Fintech Ltd, a company incorporated in the Dubai International Financial Centre (“DIFC”), United Arab Emirates, registration number CL7465, registered address Dubai International Financial Centre, P.O. Box 418630, Dubai, United Arab Emirates (“TX Fintech”, “we”, “us” or “our”), collects, uses, stores, shares and protects Personal Data when you use StudyMind: the mobile app for iPhone and Android that helps you explore what and where to study, and the related website studymind.me (together, the “Services”).

TX Fintech is the controller of the Personal Data described in this Privacy Policy. Please read it together with the StudyMind Terms of Use.

1.1 Data Protection Officer

TX Fintech has appointed a Data Protection Officer (“DPO”), who oversees how StudyMind processes Personal Data in all countries where it is offered. You can contact the DPO about any question on the processing of your Personal Data or your rights.

Data Protection Officer: Ivana Marković · Email: support@txfintech.com

2. Scope and applicable data protection laws

TX Fintech is established in the DIFC and is subject to DIFC Law No. 5 of 2020 (the Data Protection Law) and the DIFC Data Protection Regulations. Depending on where you live and the processing concerned, other laws may also apply, including:

1. Regulation (EU) 2016/679 (the “EU GDPR”);
2. the UK GDPR and the UK Data Protection Act 2018;
3. the Swiss Federal Act on Data Protection (“FADP”);
4. the Law on Personal Data Protection of the Republic of Serbia (Official Gazette No. 87/2018);
5. the personal data protection legislation of Montenegro;
6. Albanian Law No. 124/2024 on Personal Data Protection;
7. the personal data protection legislation of North Macedonia;
8. the Law of Ukraine on Personal Data Protection; and
9. where it applies to the processing, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

In this Privacy Policy, “Applicable Data Protection Law” means the law that applies to a particular processing activity; “Personal Data” means information about an identified or identifiable natural person (or the equivalent term in Applicable Data Protection Law); and “Sensitive Personal Data” means special categories of data or the equivalent protected category. Where a mandatory law gives you more rights or protection than this Privacy Policy, that law applies.

3. Minimum age and younger users

StudyMind is only for people aged 16 or over. You must not create an account if you are under 16. When you create an account, you confirm that you are at least 16. We do not ask for your date of birth.

People aged 16 and 17 may be treated as children or minors under some laws. For them we limit the data we collect to what the Services need, we do not use their data for advertising or for decisions with legal effects, and we do not ask for Sensitive Personal Data.

If we learn that an account belongs to someone under 16, we will close it and delete its data. A parent or guardian who believes that a child under 16 has given us Personal Data can write to support@txfintech.com.

4. The personal data we collect

4.1 Account data

• your first and last name, email address and password (we store only a secure hash of the password);
• your phone number and its country dialling code, if you gave it at sign-up in an earlier version of the app (the current version no longer asks for it);
• if you sign in with Apple or Google: the account identifier and email address the provider gives us (with Apple this may be a private relay address), your name, and with Google your profile picture link; for Apple we also keep an encrypted token so that we can cancel StudyMind's access to your Apple ID when you delete your account;
• security data: one-time codes we email you, how many codes were sent and how many wrong codes or passwords were entered, temporary sign-in locks, and records of your sign-in sessions;
• the avatar you pick and a short profile text, if any.

4.2 Your study preferences

The answers to the orientation questionnaire: your home location (the city you type), citizenship, the languages you speak, your yearly study budget, the countries where you would like to study, language of study, preferred campus type, field of study and programme, the scholarship types you are interested in, when you want to apply, and whether university rankings matter to you.

4.3 Assessment answers and results

• your answers to the three assessments (Interests: Yes/No; Motivation and Personality: positions on a scale, plus the three Motivation statements you pick as most important), how far you got and how long you took;
• the scores and results we calculate from them, the written explanations of your results and your profile summary;
• the university programmes we match to you, with match scores and the reasons shown for each match, your favourites, and travel information between your home city and a university's city;
• your personal report (a PDF with your first name, citizenship, home city, preferences, results and matched universities).

The assessments have no free-text answers.

4.4 Purchase data

When you buy a plan, Apple or Google handles the payment. We receive and keep the product you bought, the store's transaction or order identifiers (for Google also the purchase token), whether it was a test purchase, the purchase date, and whether it was later refunded or revoked. To link the purchase to your account, the app passes Apple or Google an identifier of your StudyMind account (a random code, not your name or email). We do not receive your card or bank details or the price you paid.

4.5 Your choices

Whether you allowed the AI processing described in section 8 and when, and the settings in Settings → Privacy & Data.

4.6 Usage, device and log data

• Assessment events on our server: when you start, answer and finish an assessment, we record the event together with your IP address and your app's user agent (a technical description of the app and device).
• App analytics (Google Firebase Analytics): which screens and features are used, sign-in attempts, and taps on university cards (including the university's name), together with an app instance identifier, device model, operating system, app version, approximate location derived from the IP address, and on Android the advertising identifier.
• Crash reports (Google Firebase Crashlytics): technical details of a crash, device model, operating system and an installation identifier. We do not attach your name, email or user ID.
• Server logs: our servers record the IP address, the address requested and the user agent of each request, and log some events with personal data, such as the email address an email was sent to, the answers given in an assessment, and the text typed in the location search.

We do not collect your date of birth, gender, precise (GPS) location, photos, contacts, or your payment card details.

4.7 Sources

Most of this data comes from you. We also receive data from Apple or Google when you sign in with them, from the Apple App Store and Google Play about your purchases and refunds, and from your device through Firebase.

4.8 What you must provide

Your name, email address and a password (or an Apple or Google sign-in) are needed to create an account. The orientation questionnaire and the assessments are needed to calculate your results and matches.

Allowing the AI processing in section 8 is also needed to use the app, because StudyMind cannot explain your results without it.

4.9 The studymind.me website

The website has no user accounts and no sign-up forms. When you visit it, the website's server records server logs (your IP address, browser type, the page requested and the time). The website uses Google Analytics in Google's “consent mode”. If you accept analytics cookies in the website's cookie banner, Google Analytics collects information about your visit: the pages you view, the website that sent you, your browser, device type and approximate location, and a random identifier stored in a cookie. If you do not accept, Google Analytics sets no cookies and receives only basic signals without identifiers (for example a page view, its time, browser and device type, and approximate location), which Google uses for aggregated statistics. Google Analytics does not store your IP address. If you use the form on the Delete your account page, we receive the email address you enter (section 15). The website's use of cookies is described in its Cookies Policy.

5. Sensitive personal data

StudyMind does not ask for health information, biometric or genetic data, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, information about your sex life or sexual orientation, or criminal records, and the assessments have no free-text fields where you could enter it.

The Personality and Motivation assessments describe personal preferences and traits for study guidance.

6. How we use personal data

We use personal data to:

1. create your account, let you sign in and keep your account secure (email codes, limits on wrong passwords and codes, sign-in sessions);
2. calculate your assessment results, match you with university programmes and create your report;
3. write the explanations of your results, your profile summary, the field comparison in your report and travel information with AI, if you allow it (section 8);
4. check your purchases with Apple or Google, unlock your plan, restore it on a new phone, and remove it if a purchase is refunded;
5. send you the emails the service needs: sign-up and password-reset codes, account-recovery codes and a notice when your password changes;
6. understand how the app is used, find and fix errors and crashes, and test which version of the sign-up screen works better;
7. protect StudyMind against abuse, fraud and attacks;
8. answer your questions and requests; and
9. meet legal obligations and establish or defend legal claims.

We do not send marketing emails, show advertising, sell personal data, or use your answers or results for advertising.

7. Legal bases

Where the law requires a legal basis, we rely on the following.

Where we rely on legitimate interests, we have weighed them against your interests and rights, taking particular care because some users are 16 or 17. Where we rely on consent, you can withdraw it at any time; this does not affect processing that took place before.

8. Artificial intelligence and OpenAI

8.1 What AI does in StudyMind

StudyMind uses AI models from OpenAI to write four kinds of text: the explanations of your Interests, Motivation and Personality results; your profile summary; the field comparison in a paid report; and travel information between your home city and a university's city. Your scores and your university matches are calculated by StudyMind with statistical methods, not by AI.

8.2 Your consent

Nothing is sent to OpenAI unless you allow it. The app asks right after you create your account, before you choose a plan (accounts created earlier are asked once, at their next start). The screen names OpenAI, says what is sent and why, and has a “More details” page. Our server checks your answer before every request to OpenAI.

8.3 What is sent to OpenAI

• your Interests and Personality scores;
• your Motivation scores and the career-anchor categories of the three statements you picked as most important;
• the explanations written from those scores (to write your profile summary);
• the fields you would like to study and the names of your strongest result areas (for the field comparison in a paid report);
• your home location as you typed it and a university's city (for travel information). Please type only a city and country there.

We never send your name, email address, phone number, user ID or any other account identifier.

8.4 How OpenAI handles it

OpenAI is based in the United States and processes this data there on our behalf, under its data processing terms for API customers. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models unless the customer opts in, and we have not opted in. OpenAI may keep API inputs and outputs for up to 30 days to detect abuse, unless the law requires longer. Our requests do not ask OpenAI to store them for any other purpose.

8.5 Withdrawing consent

You can withdraw at any time in Settings → Privacy & Data → AI insights (OpenAI) → Withdraw. From then on nothing more is sent to OpenAI. Texts already written stay in your account and are still shown to you until your account is deleted. Because StudyMind cannot explain your results without AI, the app then offers you to allow it again or to delete your account.

8.6 Knowing which texts are AI-written

The consent screen tells you which parts of StudyMind are written with AI.

8.7 Limits of AI

AI-written text can contain mistakes, leave things out or misread context. It explains your results; it does not decide anything about you. If a text looks wrong, tap Report a problem under it, or write to support@txfintech.com.

9. Automated processing and profiling

StudyMind calculates your results and your matches automatically from your answers and preferences. This is profiling in the sense of data protection law: it evaluates your interests, motivation and personality to suggest fields and programmes.

It does not make decisions that have legal effects on you or that similarly significantly affect you. You decide what to do with the results; StudyMind does not share them with schools, universities or employers. If you think a result or an AI-written text is wrong and want a person to look at it, tap Report a problem under the text or write to support@txfintech.com.

StudyMind is an educational guidance service. It does not diagnose or treat any medical, psychological or learning condition, and its results are not a substitute for an assessment by a qualified professional.

10. Service providers and other recipients

We share personal data only with the service providers we need to run StudyMind, and only the data each one needs. Those acting on our behalf (processors) may use it only to provide their service to us, under written data processing terms.

When you sign in with Apple or Google, or buy a plan in the App Store or Google Play, Apple and Google also process your data for their own purposes, under their own privacy policies. They, not we, process your payment details.

The sign-up email loads the StudyMind logo from an image-hosting service and a font from Google Fonts, so your email program contacts those services when you open it.

We may also disclose personal data:

• to courts, regulators, law-enforcement bodies and other authorities, where the law requires it or where it is needed to establish, exercise or defend legal claims;
• to our legal, accounting, tax, audit, insurance and security advisers, under duties of confidentiality, where needed for their advice; and
• in a merger, acquisition, financing, restructuring or sale of our business or assets, to the parties involved and their advisers, who must protect the data as the law requires.

11. We do not sell personal data

We do not sell personal data, do not give your answers or results to data brokers, schools, universities or employers, and do not let anyone use them for advertising.

12. International data transfers

Our servers are in Frankfurt, Germany. OpenAI, Postmark, Google and Apple may process personal data in the United States and other countries outside the EEA, the UK, Switzerland, the DIFC and your country.

Where the law restricts such transfers, we use a safeguard the law recognises, such as an adequacy decision, the provider's certification under the EU–US Data Privacy Framework (and its UK and Swiss extensions), the European Commission's Standard Contractual Clauses with the UK Addendum where needed, or the DIFC's standard contractual clauses. We do not rely on your consent for routine transfers. You can ask for more information about the safeguard for a transfer, and for a copy of it, at support@txfintech.com.

13. Where our data is stored

StudyMind's servers, database (including its backups) and report files are hosted by Amazon Web Services in its Frankfurt region (eu-central-1), Germany. The database and the stored report files are encrypted at rest. Data shared with the providers in section 10 is processed where those providers operate, as described there.

14. How long we keep personal data

We keep personal data only as long as we need it for the purposes in section 6. Most of it is kept while you have an account and erased 30 days after you ask us to delete the account.

Reports you download stay on your phone until you delete them; we cannot delete them for you.

15. Deleting your account

You can delete your account in the app at any time: Settings → Privacy & Data → Delete My Account. Without the app, write to support@txfintech.com from the email address of your account, or follow the steps at studymind.me/delete-account. If you write from a different address, we will ask you to confirm the request from the account's address.

When you ask us to delete your account:

1. Immediately: the account is closed, you are signed out on every device, and if you used Sign in with Apple we cancel StudyMind's access to your Apple ID.
2. For 30 days: your data is kept, in case the request was a mistake. If you try to sign in, you see that the account is being deleted. To keep it, write to support@txfintech.com before the 30 days end.
3. After 30 days: we erase your account and everything linked to it: profile, preferences, answers, results, matches, reports, favourites, sessions and usage events.

After erasure we keep the purchase records described in section 14, without your name or email. Copies in our database backups disappear within 7 days, server logs are overwritten within the period in section 14, and copies held by our providers are deleted on their schedules (section 14).

Deleting the app from your phone does not delete your account. A plan you bought is linked to your StudyMind account, so after the account is erased it cannot be restored on a new account. If you signed in with Google, you can also remove StudyMind from your Google Account's list of connected apps.

16. Security

We protect personal data with technical and organisational measures suited to the risks, including:

• encrypted connections (HTTPS) between the app and our servers, and between our own servers;
• passwords stored only as secure hashes, and Apple sign-in tokens stored encrypted;
• an encrypted database and encrypted storage for report files; reports are private and can only be downloaded through links that expire after 24 hours;
• limits on sign-in attempts, codes and requests, and sign-in sessions that expire and that end on every device when you delete your account;
• access to production systems limited to the people who need it.

No system connected to the internet can be made completely secure.

17. Personal data breaches

We have procedures to detect, assess, record and respond to personal data breaches. Where the law requires it, we notify the competent supervisory authority and the people affected.

18. Your rights

Depending on the law that applies to you, you have the right to:

1. be informed about how we process your data (this policy);
2. get a copy of your personal data;
3. have inaccurate data corrected;
4. have your data deleted;
5. restrict our processing;
6. object to processing based on legitimate interests;
7. receive the data you gave us in a structured, machine-readable format, or have it sent to another provider;
8. withdraw consent at any time, for example to the AI processing (section 8.5);
9. information about international-transfer safeguards;
10. not be subject to decisions based solely on automated processing that significantly affect you (StudyMind makes none, section 9); and
11. complain to a data protection authority (Part II lists them).

Your right to object. Where we rely on legitimate interests (security and server logs, assessment events with your IP address, crash reports, and analytics where we do not ask for consent), you can object at any time, on grounds relating to your particular situation, by writing to support@txfintech.com. We will then stop, unless we have compelling legitimate grounds or need the data for legal claims.

These rights have conditions and exceptions set by law.

19. How to use your rights

In the app you can change your study preferences, withdraw or give AI consent, download your report and delete your account. For anything else, including a copy of your data, correcting your name, email or phone number, or any other request, write to support@txfintech.com from the email address of your account.

We may ask for information to confirm your identity, but no more than the request needs. If someone acts for you, we may ask for proof that they may. We answer within the time the law sets; under the GDPR and the UK GDPR this is one month, which can be extended in some cases.

Postal address: TX Fintech Ltd, StudyMind Privacy, Dubai International Financial Centre (DIFC), P.O. Box 418630, Dubai, United Arab Emirates. Data Protection Officer: Ivana Marković, support@txfintech.com.

20. Marketing

We do not send marketing messages. If we start, we will do so only as the law allows, with your consent where required, and every message will let you unsubscribe. Emails about your account, codes, purchases or security are not marketing.

Settings → Privacy & Data has a “Marketing Insights” switch.

21. Analytics, SDKs and storage on your device

The app contains software from other companies (SDKs) to provide the Services:

• Google Firebase Analytics and Firebase Crashlytics, for usage statistics and crash reports (section 4.6);
• Google Sign-In and Sign in with Apple, for signing in;
• the App Store and Google Play billing libraries, for purchases.

The app stores on your phone, in its protected storage (the iPhone Keychain or Android's encrypted storage), your sign-in tokens and a copy of your profile so that you stay signed in; signing out removes them. It also keeps lists such as countries and languages, and the report PDFs you download.

StudyMind does not show advertising, does not read your device's advertising identifier, and does not track you across other companies' apps and websites.

The studymind.me website uses cookies as described in its Cookies Policy.

Part II: Regional provisions

StudyMind is offered in the countries of the European Economic Area, Switzerland, the United Kingdom, Serbia, Montenegro, Albania, North Macedonia, Ukraine and the United Arab Emirates. The sections below add to Part I for each of them.

22. European Economic Area

Where the EU GDPR applies, TX Fintech Ltd (contact details in section 36) is the controller. Our representative in the EU under Article 27 GDPR is: Nikolaos Stasinopoulos, Georgiou Markidi 1, Office 12, 1066 Nicosia, Cyprus. You and supervisory authorities can contact the representative instead of, or as well as, us. You can complain to the data protection authority of the EU or EEA country where you live or work or where you think your rights were infringed. Transfers outside the EEA are covered in section 12.

23. United Kingdom

Where the UK GDPR applies, you can reach our representative in the UK under Article 27 UK GDPR by writing to support@txfintech.com; we will put you in touch with them. Users aged 16 and 17 are protected by the Age Appropriate Design Code (Children's Code) where it applies (section 3). You can complain to the Information Commissioner's Office (ico.org.uk).

24. Switzerland

Where the Swiss FADP applies, we process personal data in line with it. If the conditions of Article 14 FADP for appointing a Swiss representative are met, we will appoint one and name them here. You can complain to the Federal Data Protection and Information Commissioner (FDPIC).

25. Serbia

Where the Serbian Law on Personal Data Protection applies, you have the rights it gives. Our representative in Serbia under Article 44 of that law is: Ivana Marković, support@txfintech.com. You can complain to the Commissioner for Information of Public Importance and Personal Data Protection.

26. Montenegro

Where the data protection law of Montenegro applies, you have the rights it gives. You can reach our representative in Montenegro by writing to support@txfintech.com; we will put you in touch with them. You can complain to the Agency for Personal Data Protection and Free Access to Information.

27. Albania

Where Albanian Law No. 124/2024 on Personal Data Protection applies, you have the rights it gives. You can reach our representative in Albania by writing to support@txfintech.com; we will put you in touch with them. You can complain to the Information and Data Protection Commissioner.

28. North Macedonia

Where the personal data protection law of North Macedonia applies, you have the rights it gives. You can reach our representative in North Macedonia by writing to support@txfintech.com; we will put you in touch with them. You can complain to the Personal Data Protection Agency.

29. Ukraine

Where the Law of Ukraine on Personal Data Protection applies, you have the rights it gives, and transfers abroad are made with the safeguards it requires. You can complain to the Ukrainian Parliament Commissioner for Human Rights.

30. United Arab Emirates and the DIFC

TX Fintech Ltd is established in the Dubai International Financial Centre, and its processing is subject to DIFC Data Protection Law No. 5 of 2020 and the DIFC Data Protection Regulations. Where UAE Federal Decree-Law No. 45 of 2021 applies to particular processing, we comply with it. You can raise data protection matters with the DIFC Commissioner of Data Protection.

Part III: General provisions

31. App stores, purchases and refunds

StudyMind's paid plans are one-time purchases made through the Apple App Store or Google Play. Apple and Google process your payment and your purchase history under their own terms and privacy policies, and we do not control that processing. Refund requests are handled by the store you bought from, under its rules and your consumer rights (see the Terms of Use). When a store tells us that a purchase was refunded, we remove the plan it unlocked.

32. Links to other websites

StudyMind links to university websites and other sites run by others. When you open them, those organisations collect data under their own privacy policies, not this one.

33. Changes to this Privacy Policy

We may update this Privacy Policy when StudyMind, our providers or the law change. The “Last updated” date shows the current version. If a change is material, we will tell you in the app or by email before it takes effect, and ask for your consent where the law requires it. Continuing to use StudyMind never counts as consent where the law requires a separate consent.

34. Language

This Privacy Policy is written in English. If we provide a translation and the law where you live requires that version to prevail, it prevails to the extent required.

35. Accountability

We keep records of our processing, assess new processing before we start it (with a data protection impact assessment where required), review our providers and their safeguards, and check that this policy matches what StudyMind actually does.

36. Contact us

TX Fintech Ltd, StudyMind Privacy Dubai International Financial Centre (DIFC), P.O. Box 418630, Dubai, United Arab Emirates Email: support@txfintech.com Data Protection Officer: Ivana Marković, support@txfintech.com

The contact details of our representatives are in Part II.

37. Supervisory authorities

Nothing in this Privacy Policy limits your right to complain to a data protection authority. For processing governed by the DIFC Data Protection Law, the authority is the DIFC Commissioner of Data Protection. Part II lists the authorities in the other launch countries.

© 2026 TX Fintech Ltd. StudyMind is a product of TX Fintech Ltd.