Privacy Policy

Skoodocs (the "Service", "we", "our") is a marketplace for student-written study materials. This policy describes how we handle personal information about people who visit, register on, or transact on the Service.

For the purposes of the EU and UK General Data Protection Regulations (GDPR), Skoodocs is the data controller for the information described below. Contact us at privacy@skoodocs.com.

Account data. When you register, we collect your name and email address. You may optionally add your country and university — both are used to surface relevant documents.

Transaction data. When you buy or sell a document, we collect a record of the transaction (item, price, timestamp). Payment-card details are handled by Stripe; we do not store them. Sellers who connect Stripe also provide bank-account information directly to Stripe for payouts.

Content. Documents you upload, reviews you write, and other material you submit are stored on our servers. Reviews are public; uploaded documents are public when listed for sale.

Technical data. Like most web services, we automatically collect basic technical information such as your IP address, browser, operating system, and pages visited. We use this primarily for security, analytics, and debugging.

Communications. If you email support, we keep a record so we can pick up the conversation where we left off.

• —To operate the Service: authenticate you, deliver the documents you buy, process payouts, and surface relevant content.
• —To send you transactional emails (purchase receipts, payout notifications, password resets, security alerts).
• —To improve the Service through aggregate analytics, error monitoring, and user research.
• —To prevent fraud, abuse, and other harmful activity, and to enforce our Terms of Service.
• —To comply with legal obligations and respond to lawful requests from authorities.

We do not sell your personal information. We do not use your uploaded documents to train AI models. We do not send marketing email without your explicit opt-in.

Where the GDPR applies, we rely on the following legal bases: contract (to deliver the Service you signed up for), legal obligation (e.g. tax recordkeeping), legitimate interest (security, fraud prevention, analytics), and consent (any optional marketing communications, non-essential cookies).

We share data with the following processors strictly to operate the Service:

• —Stripe. Payment processing, seller payouts, fraud detection.
• —Sentry. Error monitoring (technical context, no document content).
• —Email service provider. Transactional emails (receipts, password resets).
• —Hosting & CDN. Server hosting and content delivery for documents and previews.
• —Analytics. Aggregate usage metrics, where you have not opted out of analytics cookies.

We may also disclose information when required by law, to enforce our Terms, or to protect the rights, property, or safety of Skoodocs, our users, or the public.

Some of our processors are located outside your country of residence. When we transfer personal data outside the EEA or UK, we rely on Standard Contractual Clauses or equivalent safeguards to ensure the data receives an equivalent level of protection.

We use a small number of cookies. Strictly necessary cookies (session, authentication, theme preference, CSRF) are required for the Service to function and cannot be disabled. Analytics cookies, where present, can be disabled in your browser settings.

We do not use third-party advertising cookies and do not sell cookie-derived data.

Depending on where you live, you have the right to:

• —Access. Request a copy of the personal data we hold about you.
• —Rectify. Correct inaccurate data — most fields are editable directly from your profile.
• —Erase. Delete your account and personal data. Some records (transactions, fraud signals) may be retained for legal compliance.
• —Restrict. Restrict certain processing of your data.
• —Portability. Receive a structured, machine-readable export of the data you provided.
• —Object. Object to processing based on legitimate interest, including analytics.
• —Withdraw consent. Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email privacy@skoodocs.com. You also have the right to lodge a complaint with a supervisory authority in your country.

We retain account information for as long as your account is active. After you delete your account, we retain transaction records for up to seven years to comply with tax and accounting obligations, and minimal fraud-prevention records for as long as necessary to detect repeat abuse.

Documents you uploaded that have been sold remain accessible to their buyers (this is part of what they paid for). Reviews you wrote may remain visible but will be anonymised.

We use industry-standard technical and organisational measures — including HTTPS everywhere, encrypted password storage, scoped access controls, and regular dependency updates — to protect your personal data. No system is perfectly secure; if we discover a breach affecting you, we will notify you and the relevant authorities as required by law.

The Service is not directed at children under 16 (or the equivalent age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has registered, please email privacy@skoodocs.com and we will delete the account.

If you are a California resident, the categories of personal information we collect, the purposes of collection, and the processors we share with are described in the sections above. You have the right to know, delete, and correct your personal information, and to opt out of any "sale" or "sharing" — though we do not sell or share personal information for cross-context behavioural advertising.

We may update this policy from time to time. Material changes will be announced by email and on the Service at least 14 days before they take effect.

For privacy questions or to exercise any of the rights above, email privacy@skoodocs.com.