Culleva

Privacy Policy

Last updated: 20 September 2026

1. Who we are

References to "we", "us", and "our" mean the operator of Culleva (the "Service"). References to "you" mean the person using the Service. If you have any questions about this policy, contact support@culleva.com.

This policy explains what personal information we collect, how we use it, who we share it with, and your rights under the Australian Privacy Principles in the Privacy Act 1988 (Cth).

2. Information we collect

2.1 Information you provide

  • Account information: your email address, password (stored only as a hashed value, never in plain text), and name.
  • Profile preferences: theme, citation style, and your detected timezone.
  • Content you create: reviews and the briefs, rubrics, and drafts you upload or paste (PDF, DOCX, text), study materials (including PPTX), flashcards, quiz attempts, and citations.

2.2 Information collected automatically

When you use the Service, our backend records technical information needed to deliver it: session tokens, the timestamps of your activity inside the app, and basic error logs.

We also store feature activity needed to operate the app: quiz attempts, flashcard review history, file metadata, and AI processing job status and error metadata. These are operational records, not analytics.

Our hosting and backend providers collect basic operational logs as part of running the service: things like request timestamps, response codes, IP addresses, and user-agent strings. These are used to diagnose errors, prevent abuse, and understand whether old domains (such as the legacy assignmate.dev ) still receive traffic.

We use Google Analytics 4(provided by Google LLC) to understand how visitors find and use the site, so we can improve it. Google Analytics sets cookies and collects usage data such as the pages you view, approximate location (derived from a truncated IP address), device and browser type, and how you arrived at the site. We have IP anonymisation enabled. This data is processed on Google's servers in the United States. We do not use advertising trackers and have not enabled Google's advertising or ad-personalisation features. You can opt out of Google Analytics across all sites with Google's browser opt-out add-on.

2.3 Information from third-party sign-in providers

If you sign in with Google or Microsoft, we receive your email address, name, and profile picture from that provider. We don't receive your password and don't ask the provider for any additional permissions.

3. How we use your information

  • To provide the Service: storing your reviews, files, study materials, and other content you create.
  • To process content through AI features when you ask us to (see Section 5).
  • To diagnose and fix bugs.
  • To enforce our Terms of Service and protect the safety of the Service.
  • To comply with legal obligations (for example, responding to a valid subpoena).

We do not sell your personal information. We do not share it with advertisers. We do not use your content to train AI models.

4. Service providers we share information with

We use the following third-party services to run Culleva. Each receives only the information needed for their role.

  • Backend & data storage provider (United States): database, file storage, scheduled functions, and realtime subscriptions. All your account data and content lives here.
  • Hosting provider (United States): hosts the frontend at culleva.com and serves the web app.
  • AI provider (United States): processes text excerpts when you use AI features. See Section 5.
  • Google (Google LLC, USA): handles Google Sign-In if you choose that sign-in method, and provides Google Analytics for site usage measurement (see Section 2.2).
  • Microsoft (Microsoft Corporation, USA): handles Microsoft Sign-In if you choose that sign-in method.
  • Stripe(Stripe, Inc., USA): processes payments for the optional Pro subscription. Card details are entered on Stripe’s hosted Checkout and Customer Portal pages and never touch Culleva’s servers. We receive only the resulting Stripe customer and subscription identifiers, the current billing-period end date, and your active subscription status (which determines whether your account is on the free or Pro tier).

These providers are our service providers. Where applicable, they process personal information for us and only for the purposes needed to provide Culleva.

5. How AI features work and what they receive

The AI features in Culleva (AI Review, AI Study Coach, and the Citation Checker) work by sending text excerpts to a third-party AI provider's API.

  • What is sent: only the relevant text from the materials you submitted to that feature, plus a fixed system prompt. Other parts of your account (reviews you didn't reference, files in unrelated reviews) are never sent.
  • What that text can contain: depending on the feature, the text excerpt may include extracted content from uploaded PDF, DOCX, PPTX, or text files; text you pasted; and citation documents. AI Review sends excerpts of your assessment task, marking rubric, and draft. The Study Coach sends excerpts of your uploaded course materials. The Citation Checker sends document text in document-scan mode.
  • AI data handling: your content is not used to train AI models. Our AI provider may retain content briefly for abuse monitoring and as required by law.
  • Practical advice: don't put highly sensitive information (financial details, identity documents, confidential personal data of others) into study materials or AI inputs. The AI features are designed for academic content.

5.1 Citation Checker URL fetching

If you use the Citation Checker's URL-fetch mode, we receive the URL you submit and our backend fetches the page server-side to extract citation metadata such as title, author, publication date, site name, and similar fields. We keep the URL alongside the resulting reference in your library. Other servers and the page's host may log our request, in line with normal web traffic.

6. Voice channel and screen share (retired)

The group voice channel and screen-share feature was removed from Culleva in September 2026. Live media was always sent peer-to-peer and never recorded or stored by us; the temporary connection metadata the feature used (signalling data, participant status, heartbeats) is no longer collected, and remaining historical rows will be deleted as described in Data retention below.

7. Shared content within groups (retired)

Group workspaces (shared assignments, group chat, shared files and links, tasks, meetings, and the shared whiteboard) were removed from Culleva in September 2026. Content you previously shared to a group is no longer visible to other users; remaining historical rows will be deleted as described in Data retention below. Your reviews, AI Study Coach courses, and Citation Library have always been private to your account and remain so.

8. Data retention

We keep your information for as long as your account is active. When you delete your account, we delete the following from active storage within 30 days:

  • Every review you own, plus the files uploaded to it and its AI review history.
  • Your Study Coach courses, materials, flashcards, quizzes, and quiz history.
  • Your saved citations, citation folders, and citation scans.
  • Your sign-in records (auth accounts, sessions, refresh tokens), so the same email can be used to register a fresh account in future.

We also anonymise your account row rather than deleting it outright. Identifying fields (your name, email, profile image, preferences) are cleared, and a deletion timestamp is recorded. The row itself is retained as a placeholder so historical references (for example legacy shared content from the retired group features) keep resolving as "Deleted user" rather than breaking. If you prefer full erasure of any legacy group contributions, mention this in your deletion request and we will action it where reasonably possible.

Encrypted backups are retained for up to 90 days for disaster recovery; after that, the deleted data is permanently removed from backups too.

We may retain limited information after account deletion if required by law (for example, financial transaction records for tax compliance once paid subscriptions are live).

9. Your rights

Under the Australian Privacy Principles, you have the following rights:

  • Access: request a copy of the personal information we hold about you.
  • Correction: request that we correct inaccurate or incomplete information. You can update most fields directly from your profile page.
  • Deletion: delete your account and personal information yourself from the Danger Zone in your profile settings, at any time. You can also email support@culleva.com from the email address linked to your account and we will action confirmed requests within 30 days. See Section 8 for how shared group contributions are handled.
  • Complaint: if you believe we have mishandled your information, contact support@culleva.com first. We will acknowledge your complaint, investigate, and respond within a reasonable time. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Cookies and local storage

Culleva uses cookies needed for authentication, which hold your session token so the app knows you're signed in. We also use Google Analytics cookies to measure site usage (see Section 2.2); these distinguish visitors and remember the start of a visit. We do not use advertising cookies. You can block analytics cookies with the Google opt-out add-on linked in Section 2.2, or by blocking cookies in your browser, without affecting your ability to use the app.

11. Security

We protect your information with HTTPS in transit and encryption at rest. Passwords are stored as hashed values (we cannot read your password even if asked). Our backend provider handles encryption at rest for stored files and database content.

No internet system is perfectly secure. You are responsible for keeping your password and your computer secure. If you suspect your account has been compromised, change your password and email us immediately.

12. Children's privacy

Culleva is intended for university students and is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected information from a child under 16, we will delete it.

13. International data transfers

Our backend, hosting, and AI providers operate servers in the United States. By using Culleva you understand that your information may be transferred to, stored, and processed in countries outside Australia.

14. Changes to this policy

We may update this policy when our practices change, when new features add new data flows, or when laws change. We will post the new version here with an updated "Last updated" date. If the changes are significant we will also notify you in-app or by email before they take effect.

15. Contact us

Questions about this policy or your information? Email support@culleva.com.