OLAR AI LLC
OLAR AI LLC, a California limited liability company (“OLAR AI,” “we,” “us,” or “our”), operates the AI-assisted learning service at app.olar.ai and related websites and services that link to this policy (the “Services”).
This policy explains what personal information we collect, how we use and disclose it, how long we retain it, and the choices available to you. It covers account creation, handwriting and problem analysis, educational feedback, subscriptions, support and use of our websites.
•
Your work: We process the problems, handwriting, images and questions you submit to provide educational feedback. Relevant content is sent to AI and handwriting-recognition providers.
•
Your account: We process account, eligibility and learning information to operate your account and maintain your learning history.
•
Analytics and diagnostics: PostHog product analytics is off by default. Sentry diagnostics and sampled, masked session replay are separate from that analytics preference.
•
Improvement: Submitted work and generated feedback may also be reviewed and used to evaluate and improve recognition and feedback quality. Evaluation is distinct from training a general-purpose model.
•
Advertising: We do not sell personal information or share it for cross-context behavioural advertising.
•
Your choices: You can manage available account settings, control optional product analytics, delete your account or contact official@olar.ai to make a privacy request.
•
Age eligibility: The Services are not intended for children under 13. Users aged 13–17 must have permission and supervision from a parent or legal guardian.
OLAR AI is the controller of personal information we process to provide accounts directly to learners and to operate our websites, subscriptions and support. This means we determine the purposes and means of that processing.
If an educational institution separately contracts with OLAR AI to process student information on its behalf, the institution may be the controller and OLAR AI its processor. The applicable agreement and the institution’s privacy notice explain those responsibilities. This policy does not itself create an institutional service, authorise school access to a personal account, or permit accounts for children under 13.
Third parties may act as independent controllers for particular activities, such as operating a Google account or fulfilling certain payment, fraud-prevention and legal obligations. Their notices explain those activities. This does not remove our responsibility for processing that we control.
We collect information you provide when creating or maintaining an account, including your name, email address, username or display name, profile information, language preferences and onboarding responses. Supabase Auth processes authentication credentials and session information.
We request a date of birth for age and eligibility checks. When provided through our signup or age-verification flows, it is stored with account or compliance information; it is not merely checked and discarded. We also record relevant age-category flags and a user’s confirmation of guardian permission where applicable. That confirmation is not an independent verification of a parent’s identity.
We process problem statements, questions, answers, solution steps, notes, uploaded images, photos of handwritten work, drawings and digital pen strokes. We also process information derived from that content, including recognised text, positions of words or notation, analysis results, annotations and generated feedback.
Learning information includes sessions, progress, educational preferences and other details you provide to support your learning. Submitted content can contain personal information about you or other people.
Please avoid including government identifiers, health information, financial credentials or other sensitive personal information unless necessary for your request. Submitting content does not constitute consent to unrelated uses of that information.
We process subscription plans, trial and payment status, billing contact information, invoice references, and Stripe customer, checkout and subscription identifiers. Stripe processes payment credentials. OLAR AI does not store full payment-card numbers or card security codes.
We process the information you send when contacting us, including support messages, feedback, privacy requests, billing enquiries and any attachments. Please share only what is necessary to resolve your enquiry.
Our systems and providers process information such as IP addresses, browser and device characteristics, operating system, language, request timestamps, page or route information, authentication events, errors, performance measurements and abuse-prevention signals. Approximate location may be derived from an IP address.
Browser storage may hold authentication state, privacy preferences, interface settings, draft work and recovery information. Optional analytics and session replay are explained in Section 6.
If you sign in with Google, we receive the account information authorised through that sign-in flow, which may include your Google identifier, name, email address and profile image. We receive payment and subscription updates from Stripe, recognition and feedback results from AI/OCR providers, and security-verification results from relevant providers.
Password-breach checks send the first five characters of a password’s SHA-1 hash to the Pwned Passwords service. The plaintext password and complete hash are not sent to that service. The direct request also involves network metadata.
We use personal information to:
•
Create and manage accounts, check eligibility, authenticate users and recover access.
•
Interpret submitted work, provide educational feedback and preserve learning history.
•
Process subscriptions, payments, cancellations, invoices and billing disputes.
•
Deliver password-reset emails, security notices, renewal reminders and other necessary service communications.
•
Respond to support enquiries, feedback and privacy requests.
•
Diagnose faults, measure reliability, evaluate recognition and feedback quality, and improve the Services.
•
Prevent and investigate fraud, automated abuse, unauthorised access and security incidents.
•
Maintain records necessary for legal obligations, disputes and enforcement of our agreements.
These purposes do not mean every category of data is used for every purpose. For example, payment credentials are not needed to assess handwritten work.
When you request analysis or feedback, relevant problem text, handwritten work, images, recognised text, prior steps and follow-up questions are processed by our systems and providers. Google Gemini provides AI processing, and Mathpix provides handwriting and mathematical-notation recognition. Supabase supports the associated backend processing and storage.
We use safeguards intended to reduce unnecessary disclosure, including redaction of certain text identifiers and controls over requests and outputs. These safeguards do not guarantee anonymity. Names or other personal details may remain in images, handwriting or free-form content.
We may select examples of submitted work and generated feedback for debugging and quality evaluation. This can include human review and assessment of whether recognition, feedback and annotations are accurate. Removing account identifiers from an evaluation example does not necessarily make handwritten content anonymous.
Quality evaluation, testing and changes to prompts or application logic are different from training model weights. We do not use your personal information to train OLAR AI general-purpose models. That statement does not mean that all evaluation, human review or provider retention is excluded.
Providers’ handling of inputs and outputs depends on the applicable service, agreement and account configuration. We do not make a blanket promise that every provider retains no content or never uses it for quality improvement.
OLAR AI automatically interprets work, assesses solution steps and generates educational feedback. Its feedback can be inaccurate or incomplete. It is intended to support learning and should be reviewed critically. A correctness indicator is an automated assessment of the submitted work, not a verified fact about a learner’s abilities.
If you do not want particular content sent to an AI or OCR provider, do not submit that content to a feature that requires that processing. You can contact us about concerns regarding automated feedback or associated personal information.
We disclose relevant information to providers that help deliver the Services:
Supabase
Authentication, database, storage and backend processing
Account information, learning content, uploads and operational records
Vercel
Hosting and delivery
Requests, IP addresses, technical metadata and hosting logs
Google Gemini
AI analysis and feedback
Submitted work, images, questions, context and generated responses
Mathpix
Handwriting and mathematical OCR
Pen strokes, images and recognised content
Resend
Transactional email
Recipient address, message content and delivery records
PostHog
Optional product analytics
Usage events, user identifiers and account properties
Sentry
Diagnostics, performance monitoring and sampled replay
Errors, technical metadata and masked replay information
Cloudflare Turnstile
Bot detection and abuse prevention
Browser/device signals, request information and challenge results
Stripe
Payments and subscriptions
Payment and billing information, subscription and transaction identifiers
Google sign-in and Fonts
Authentication and font delivery
Authorised account information and browser request metadata
Have I Been Pwned / Pwned Passwords
Password-breach checking
Partial password-hash prefixes and request metadata
Some providers process information on our behalf; others also act as independent controllers for specified purposes. For example, Stripe has its own fraud-prevention and compliance activities, and Cloudflare describes certain independent uses of Turnstile signals.
We may also disclose information at your direction, when necessary to comply with law or valid legal process, to investigate security incidents, or to establish, exercise or defend legal claims. Information may be disclosed in connection with a proposed or completed merger, acquisition or other business transfer, subject to applicable protections.
We do not sell personal information or share it for cross-context behavioural advertising.
For provider-by-provider detail, see our Sub-processor list.
We use cookies and similar technologies, including localStorage, sessionStorage and IndexedDB. They support authentication, security, privacy preferences, interface settings, checkout and recovery of draft work. Clearing browser storage may remove local preferences or unsynchronised work and may sign you out.
PostHog product analytics is off by default. Eligible users can change the Product Analytics setting in the application. When enabled, analytics can include page views, interactions, performance events, a user identifier and limited account properties. Identified profiles are supported. Minor-user privacy settings restrict analytics. PostHog session recording is disabled in the current application.
Disabling analytics stops future collection through that setting; it does not automatically delete information previously collected. Contact us to request deletion where applicable.
Sentry error monitoring and performance measurement are separate from the PostHog analytics setting. The application also supports sampled session replay, including sampling associated with errors. Replay can capture page structure, interaction timing and technical metadata.
Replay is configured to mask text and inputs, block media and exclude network request bodies. Default PII collection is disabled, and additional scrubbing is applied to specified event fields. These measures reduce exposure but do not mean every diagnostic event is anonymous. Turning off Product Analytics should not be understood as turning off all diagnostic or replay processing.
Legacy Do Not Track signals and Global Privacy Control are different mechanisms. The current application does not implement a dedicated response to either signal. We do not sell personal information or share it for cross-context behavioural advertising. Applicable opt-out rights remain available through the request channels described in this policy. This explanation does not substitute an email request for a browser signal where applicable law requires that signal to be honoured.
OLAR AI is based in California. The primary Supabase project is in Northern California, United States (us-west-1). Supabase states that its regional hosting includes the database, authentication service, storage objects and backups. Platform logs are stored in EU data centres, and edge processing, global delivery and authorised support access can occur elsewhere.
OLAR AI’s PostHog service and browser Sentry destination use US regions. Resend stores customer data in the United States. Vercel uses global delivery infrastructure, and Google, Cloudflare and Stripe describe international processing in their applicable notices and terms. A primary database location does not mean all personal information stays in that location.
Where an international transfer requires a legal safeguard, the applicable arrangement may involve an adequacy decision, a recognised data-transfer framework covering the recipient and processing, or contractual safeguards such as standard contractual clauses and relevant UK provisions. You can contact us for information about the safeguards applicable to a particular transfer and how to obtain a copy, subject to appropriate redactions.
Retention depends on the information, its purpose and applicable obligations. We consider whether an account or learning-history feature still needs the information, whether an enquiry or dispute remains open, relevant legal obligations, security needs and backup arrangements.
Account, profile and eligibility records
Needed to maintain the account and associated eligibility controls, subject to deletion requests and justified legal or security retention
Learning history, uploads and generated feedback
Needed to provide saved-work and history features, subject to available deletion controls and requests
Support and privacy correspondence
Needed to resolve the enquiry, document its handling and meet relevant legal obligations
Billing and transaction records
Needed for accounting, tax, refunds, chargebacks, disputes and applicable recordkeeping requirements
Security, audit and operational records
Needed to investigate incidents, prevent abuse, maintain reliability and support justified audit or legal requirements
Quality-evaluation examples
Needed for a defined testing or improvement purpose, with continued treatment as personal information where identifiable
Browser preferences and local recovery data
Until replaced, cleared, expired or removed through the relevant browser or application behaviour
Account deletion and browser-storage deletion are different. Clearing a browser does not delete server-side records. Deleting an account does not guarantee immediate removal from backups, every provider’s records or separately retained legal records.
Requests involving evaluation copies, vendor-held information or legal records may require additional handling. We will explain applicable limitations when responding to a request. Data that is genuinely anonymised so that it no longer identifies a person may be retained separately; removing a user ID alone is not sufficient to make data anonymous.
The Services are not intended for children under 13, and children under 13 may not create an account or use the Services. We do not knowingly collect their personal information. If you believe a child under 13 has provided information, contact us so we can investigate and take appropriate deletion action.
Users aged 13–17 must have permission and supervision from a parent or legal guardian. Our age-related controls use information supplied by the user. Recording a guardian-permission confirmation is not the same as independently verifying parental consent. Minor-user privacy settings restrict optional product analytics.
Where a separate institutional agreement applies, requests concerning institution-controlled student information may need to be directed to the institution. We assist within our role and applicable obligations. We do not assume that every personal learner account is a school education record or that every school relationship permits the same uses of student information.
We use safeguards designed to protect information, including encrypted network connections, authentication, access controls, validation, abuse limits and monitoring. Access to learning content and stored files is restricted through application and database controls. No system can guarantee complete security.
If we identify a security incident, we investigate and take appropriate response measures. We notify affected people, institutional customers or regulators when required by applicable law or agreement. Suspected incidents can be reported to official@olar.ai.
Available account settings allow you to update certain information, manage product analytics and request account deletion. You can also email official@olar.ai to request access, a copy, correction or deletion of personal information, or to raise another privacy concern.
Depending on applicable law, you may also have rights to restrict or object to processing, withdraw consent, receive portable data, opt out of specified processing or appeal a refusal. These rights are subject to applicable conditions and exceptions. Withdrawing consent does not affect earlier lawful processing.
Tell us what you are requesting and how to identify your account. Do not send your password or full payment-card details. We may request information reasonably necessary to verify identity or an authorised representative’s authority. A parent’s request may require verification of their authority; it does not automatically grant access to another person’s account.
We respond within applicable legal deadlines. If we cannot fulfil a request, we explain the reason and any available appeal or complaint route, except where the law prevents disclosure. To appeal where a right of appeal applies, email the same address with “Privacy request appeal” and enough information to identify the original request.
Necessary security, account and billing communications may continue while relevant even if you do not want promotional messages. If you receive a promotional message from us, you can use its available unsubscribe option or contact us.
Where EU or UK data-protection law applies and OLAR AI acts as controller, we identify a lawful basis for each processing purpose. The following describes the proposed allocation of purposes:
Providing a requested account, tutoring feature or subscription
Contract, where processing is objectively necessary to provide that service
Necessary service communications and support
Contract; legitimate interests in resolving enquiries where contract does not apply
Security, abuse prevention and operational diagnostics
Legitimate interests in protecting accounts and operating a reliable service; specific legal obligations where applicable
Optional product analytics
Consent
Quality evaluation and improvement
Legitimate interests in understanding and correcting service failures, subject to a documented assessment; consent where required
Non-essential storage or access on a device, including replay where consent is required
Consent
Accounting, tax and legally required disclosures
Relevant legal obligations
Establishing, exercising or defending claims
Legitimate interests in protecting legal rights
Identifying a legitimate interest does not remove the need to consider your interests and rights, particularly for children. Special-category information requires an additional applicable condition; submitting it does not by itself establish one. For institution-controlled processing, the institution determines the applicable lawful basis.
You may complain directly to the relevant supervisory authority without first contacting us. UK residents can contact the Information Commissioner’s Office; EEA residents can contact their national data-protection authority.
State rights apply where the relevant law covers the business and processing. Depending on that law, rights can include access, correction, deletion, portability, authorised-agent requests, appeals, non-discrimination and opt-outs from sale, targeted-advertising sharing or specified profiling.
The categories described in Section 2 include identifiers; account and customer records; age information; commercial information; internet or network activity; approximate location; submitted images and electronic content; learning information; and inferences such as progress or preferences. Sources, purposes and recipients are described in Sections 2–5. Retention is addressed in Section 8.
Account login credentials may be sensitive personal information under applicable law. Submitted work may also contain sensitive information. We use authentication credentials to secure access; sensitive content supplied in work is processed in connection with the relevant feature and applicable legal requirements. We do not sell personal information or share it for cross-context behavioural advertising.
Residents of Switzerland, Canada and other jurisdictions may have additional rights under applicable law, including access, correction, withdrawal of consent and complaints to an appropriate regulator. Contact us to exercise an applicable right. Nothing in this policy limits a right that cannot lawfully be waived.
We update this policy when our practices or applicable requirements change. The published version will state its revision and effective dates. For material changes, we will provide notice through the Services, email or another appropriate method, and obtain consent where required before introducing processing that requires it.
Reading this policy or continuing to use the Services does not by itself constitute consent to every processing activity described here. Separate choices and legal requirements apply where consent is necessary.
OLAR AI LLC
Email: official@olar.ai
Website: app.olar.ai
Please identify whether your enquiry concerns an individual account or an institutional arrangement so we can direct it appropriately.
