Privacy at Scholé

This page is a summary written for orientation. The complete privacy policy, including the legal bases we rely on, our retention periods, and our sub-processors, lives at app.schole.ai/privacy alongside the terms of service. Where the two differ, the policy at that address is the one that applies.

The pages on schole.ai are static and need no account. These are the third parties that can run in your browser here, and when each one does:

• Google Ads (gtag): conversion measurement for our Google Ads campaigns. It loads only after you accept advertising measurement in the cookie banner, and sets the _gcl_au cookie.
• Reddit pixel: the same, for our Reddit campaigns. It loads only after you accept, and sets _rdt_uuid, _rdt_em and, after a Reddit ad click, _rdt_cid.
• HubSpot: the meeting scheduler on /book-a-demo is a HubSpot frame that loads when you open that page. The message box on /contact sends what you type to a HubSpot form when you press send. HubSpot handles that data under its own policy.
• YouTube: the walkthrough video on /scenarios is embedded from youtube-nocookie.com and loads only when you press play.
• PostHog: cookie-free analytics (memory persistence, EU host). It stores nothing in your browser and gives you a new anonymous id on every page load. We use it to see which pages are read and to test headline wording.
• Stripe: checkout for paid plans happens on buy.stripe.com, under Stripe’s policy.

The site itself keeps three small entries in your browser’s local storage, none of them a cookie: your answer to the cookie banner (schole_consent_v1), so we do not ask again; which homepage headline you were shown (schole:hl), so it does not change when you reload; and, only after you accept advertising measurement, the Reddit ad click id (schole:rdt_cid), which is deleted if you later reject.

Advertising measurement is off until you turn it on, and browsers that send a Global Privacy Control signal keep it off. You can change your choice at any time through the “Your Privacy Choices” link in the site footer. Rejecting after accepting deletes the cookies above that we can reach; cookies the pixels set on Google’s and Reddit’s own domains are governed by their policies.

Inside the Scholé app we process the account details you provide and the learning data the product needs to personalize lessons: your role, the tools you use, your progress, and your responses. Organizations that deploy Scholé see adoption and progress reporting for their own members. We do not sell personal data.

On the My Rhythm page you can choose to connect your Google or Microsoft calendar so that Olé, our learning assistant, places short study sessions where you have time. This is optional and off until you connect.

• What we read: only when you are busy or free, as time ranges. We never read the titles, attendees, locations or notes of your events.
• What we write: the study sessions we place, in your own calendar. We create, move and delete only those events, and never change any other event.
• What we store: an encrypted token that lets us place and update those sessions, and the sessions themselves. We use this data only to run the feature. We do not use it for advertising, we do not sell or share it, and we do not use it to train AI models.
• How we protect it: the token is encrypted with a dedicated key kept in Azure Key Vault, separate from the database, and is decrypted only by the service that places your sessions; staff never see it. The busy and free times we read stay in a short-lived cache (at most 5 minutes) and are never stored. Everything travels over TLS. The full details are in section 12 of the binding policy linked above.
• How to stop: disconnect the calendar on the My Rhythm page. We delete the token and revoke it at Google. For Microsoft, you can also remove the access under My Apps in your Microsoft account.

Scholé’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Depending on where you live you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict some processing. Send any such request to team@schole.ai and we will respond within the period the applicable law allows. If you reached us through an employer’s Scholé deployment, we may need to route the request through that organization, which is the controller of its own members’ learning data.

Privacy, security review, and data-processing questions all go to team@schole.ai. Postal mail reaches us at the addresses on the contact page.