(ISC)²
(ISC)²®, CISSP®, CCSP®, SSCP®, CSSLP®, and all (ISC)² certification marks are registered trademarks of (ISC)². (ISC)² does not endorse this product.
Privacy policy, terms of service, the open-source projects we’re built on, and every third-party trademark referenced in the catalog.
Version: 2.3.0
Effective Date: August 21, 2026
Last Updated: August 21, 2026
This Privacy Policy explains how Renkara Media Group ("Renkara," "we," "us," or "our") collects, uses, shares, and protects your personal data when you use the AccelaStudy® AI application and related services (collectively, the "Service").
This policy applies to all users of the Service worldwide, including users in the European Economic Area (EEA), the United Kingdom (UK), the State of California, and all other jurisdictions. Where local laws grant you additional rights, those rights are described in the relevant sections below.
By using the Service, you acknowledge that you have read and understood this Privacy Policy. Where we rely on consent as a legal basis for processing, we will obtain your explicit consent before collecting or processing your data.
The data controller responsible for your personal data is:
Renkara Media Group
For GDPR-related inquiries, you may also contact our Data Protection Officer at the email address listed in Section 14.
| Category | Data Elements | When Collected |
|---|---|---|
| Account Information | Email address, first name, last name, username, password (stored as bcrypt hash) | Account registration |
| Social Sign-In Data | Apple Sign-In: Apple User ID, email address (captured on first sign-in only), and display name if provided by your device. Google Sign-In: Google Account ID, email address, name, and profile picture URL. | When you choose to sign in via Apple or Google |
| Study Content | User-created study sets, custom groupings of content | When you create or modify study materials |
| Category | Data Elements | When Collected |
|---|---|---|
| Device Information | Device vendor identifier (Device ID), device type, operating system version, app version, locale/language | Each time you use the Service |
| Usage & Analytics Data | Analytics events (event name, timestamp, associated product ID), IP address | During your use of the Service |
| Study Progress | Per-item difficulty scores, study set membership, enrollment data (which products you study) | As you study |
| Session Data | Session authentication tokens | When you sign in |
| Subscription Data | App Store transaction IDs, purchase dates, subscription expiration dates | When you make a purchase or restore a subscription |
We do not collect precise geolocation data, biometric data, financial account numbers, government-issued identification numbers, or health information.
We process your personal data only for the purposes described below. For users in the EEA/UK, we identify the lawful basis under GDPR Article 6 for each purpose.
| Purpose | Data Used | Lawful Basis (GDPR) |
|---|---|---|
| Provide and operate the Service | Account information, device information, session data, study progress, study content, enrollment data | Performance of contract (Art. 6(1)(b)) |
| Authenticate your identity | Email, password hash, Apple User ID, Google Account ID and profile data, session tokens | Performance of contract (Art. 6(1)(b)) |
| Process subscriptions and purchases | Subscription/receipt data, account information | Performance of contract (Art. 6(1)(b)) |
| Provide AI-assisted study features | Your assistant messages and conversation history, study progress, proficiency and accuracy signals, weak areas, recent activity, and the question and answer you are working on | Performance of contract (Art. 6(1)(b)) — see Section 15.2 |
| Personalize your study experience | Study progress, difficulty scores, enrollment data, study sets | Performance of contract (Art. 6(1)(b)) |
| Send transactional communications | Email address, name | Performance of contract (Art. 6(1)(b)) |
| Send marketing communications | Email address, name | Consent (Art. 6(1)(a)) — you may withdraw consent at any time |
| Analyze usage and improve the Service | Analytics events, device information, IP address, usage data | Legitimate interest (Art. 6(1)(f)) — improving our Service and user experience |
| Ensure security and prevent fraud | IP address, device information, session data | Legitimate interest (Art. 6(1)(f)) — protecting our Service and users |
| Comply with legal obligations | Any data as required by applicable law | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interest, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms.
The AccelaStudy® AI mobile application does not use browser cookies. We use a device vendor identifier (Device ID) to associate your device with your account and to collect analytics data.
If you visit our website, we may use:
You can manage your cookie preferences through your browser settings or through any cookie consent mechanism presented on our website. Withdrawing consent for non-essential cookies will not affect the functionality of the Service.
We honor Do Not Track (DNT) browser signals. When we detect a DNT signal, we do not load non-essential tracking technologies.
We share your data with the following third-party service providers, solely for the purposes described. We do not sell your personal data.
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, infrastructure (including Secrets Manager, SQS, DynamoDB) | All data stored by the Service | United States |
| Stripe, Inc. | Payment processing, subscription billing, and billing-webhook event processing for purchases made on the web | Email address, name, customer and subscription identifiers, and billing metadata. Card details are collected by Stripe directly and are never received or stored by us | United States |
| SendGrid (Twilio Inc.) | Transactional and marketing email delivery, webhook event processing | Email address, name, email content | United States |
| Apple Inc. | Sign-In with Apple authentication, App Store receipt validation and subscription management | Apple User ID, subscription/receipt data | United States |
| Google LLC | Sign-In with Google authentication (Google Identity Services) | Google Account ID, email address, name, profile picture URL | United States |
Each service provider is bound by a Data Processing Agreement (DPA) that requires them to process your data only on our instructions and in compliance with applicable data protection law.
We may also disclose your personal data:
Our commitments regarding government data requests:
We do not share your data with third parties for their own marketing purposes.
Renkara is based in the United States. If you are located outside the United States (including in the EEA or UK), your personal data will be transferred to and processed in the United States.
We protect international transfers of personal data using the following safeguards:
You may request a copy of the relevant transfer safeguards by contacting us at privacy@renkara.com.
Renkara is a United States corporation. As such, Renkara and its U.S.-based sub-processors (including Amazon Web Services and Twilio/SendGrid) are subject to the Clarifying Lawful Overseas Use of Data Act (CLOUD Act), enacted in 2018 as an amendment to the U.S. Stored Communications Act (18 U.S.C. § 2713).
What this means for your data:
Our position and safeguards:
For EEA and UK users: We recognize that the CLOUD Act was identified by the Court of Justice of the European Union (in Schrems II, Case C-311/18) as a factor relevant to the assessment of U.S. data protection standards. We address this through the supplementary measures described in Section 7.3, in accordance with the European Data Protection Board's recommendations on supplementary transfer measures (Recommendations 01/2020).
In addition to the Standard Contractual Clauses, we implement the following supplementary technical and organizational measures to protect personal data transferred from the EEA/UK to the United States:
Technical measures:
Organizational measures:
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Specific retention periods are:
| Data Category | Retention Period |
|---|---|
| Account information | Until you delete your account, plus 30 days for backup removal |
| Study progress and study sets | Until you delete your account |
| Analytics events and usage data | 2 years from the date of collection |
| Session tokens | 30 days from issuance, or until you sign out |
| Subscription/receipt data | Duration of the subscription plus 3 years (for financial record-keeping and dispute resolution) |
| SendGrid email delivery logs | 90 days |
| IP addresses in analytics | 90 days, then anonymized or deleted |
| Apple authentication token | Until you disconnect the linked account or delete your AccelaStudy® AI account |
| Google Sign-In tokens | Not retained — the Google ID token is verified at sign-in and discarded immediately |
When the retention period expires, we securely delete or anonymize the data. You may request deletion of your data at any time (see Sections 9 and 10).
If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and the UK GDPR:
We will respond to all rights requests within 30 days. In complex cases, we may extend this period by an additional 60 days, and we will inform you of any such extension.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
CCPA Categories of Personal Information Collected:
| CCPA Category | Examples | Collected |
|---|---|---|
| Identifiers | Name, email, username, Device ID, IP address, Apple User ID | Yes |
| Customer records | Name, email | Yes |
| Commercial information | Subscription and purchase records | Yes |
| Internet/electronic activity | Analytics events, usage data, app interactions | Yes |
| Geolocation | General location inferred from IP address (not precise) | Yes |
| Inferences | Study difficulty scores, learning progress | Yes |
We do not collect: protected classification characteristics, biometric data, sensory data, professional/employment data, education data (beyond study progress within our app), or sensitive personal information as defined by the CPRA.
To submit a CCPA request, see Section 16.
We take children's privacy seriously. In compliance with the Children's Online Privacy Protection Act (COPPA):
For users in the EEA/UK, the minimum age for consent to data processing is 16 (or the lower age set by the relevant Member State, which may be as low as 13). Where the user is below the applicable age, we require consent from the holder of parental responsibility.
When you choose a password, we check it against the Have I Been Pwned breached-password corpus using that service’s range API. Your password never leaves our systems: only the first five characters of its SHA-1 hash are sent, the service returns every hash suffix matching that prefix, and the comparison happens on our side. The service cannot determine your password or identify you from the request.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:
Although not legally required to appoint a Data Protection Officer under GDPR Article 37, we have designated a privacy contact to handle all data protection inquiries:
Data Protection Contact
You may contact our Data Protection Contact for any questions regarding this Privacy Policy, to exercise your data protection rights, or to file a complaint about our data practices.
The Service uses artificial intelligence in two different ways, and they involve different data. This section describes both and names every provider that processes data on our behalf for either purpose. It replaces the narrower “content synthesis only” description in earlier versions of this Policy, which did not account for our interactive study features.
Educational content — knowledge graphs, question banks, lessons, flashcards, scenarios, case studies, glossaries, exam tips, and labs — is generated and verified in advance, offline, and then published into the Service. For that work we send domain and curriculum content only. We do not send your account data, your identity, your learning history, or your telemetry to any provider for content synthesis.
Some features respond to you in real time: the study assistant, personalized lesson framing, and hints. These features do send your input to an artificial-intelligence provider. There is no way for a feature to answer what you actually asked without sending what you asked.
For an interactive request we send:
We do not send your name, email address, password, or payment information as part of an interactive request. The lawful basis for this processing is performance of our contract with you (GDPR Art. 6(1)(b)) — these are features of the Service you signed up for. If you would rather not have your input processed this way, do not use the assistant, hints, or personalized lesson framing; the rest of the Service, including all published lessons, questions, and exams, works without them.
The table below lists both the providers we use today and providers we have approved for these purposes and may begin using without a further revision of this Policy. The Status column tells you which is which.
| Provider | Role | Data Sent | Location | Status |
|---|---|---|---|---|
| Inception Labs | Primary provider for content synthesis and for interactive features | Domain and curriculum content; for interactive features, the data described in Section 15.2 | United States | In use |
| Anthropic (Claude) | Content generation and adversarial review; automatic fallback for interactive features when the primary provider is unavailable | Domain and curriculum content; when acting as fallback, the data described in Section 15.2 | United States | In use |
| OpenAI | Secondary review of candidate questions and lessons | Domain and curriculum content only | United States | In use |
| Amazon Web Services (AWS) | Cloud hosting for the Service (see Section 6.1); managed artificial-intelligence and machine-learning services, including model hosting through Amazon Bedrock | All data stored by the Service; where a managed AI service is used, the data described in Sections 15.1 and 15.2 | United States | In use for hosting; approved for AI services |
| Voyage AI | Text embeddings for semantic search and content matching | Domain and curriculum content; where a feature embeds text you have entered, that text | United States | Approved; not currently in use |
| ElevenLabs | Text-to-speech generation for lesson audio | Our own lesson text; no user data | United States | Approved; used where lesson audio is enabled |
Anthropic’s API operates under a zero-retention policy for API inputs by default. OpenAI states that API inputs are not used to train its models. Each provider’s own published terms govern its handling of the data we send it; we are not responsible for the privacy practices of these third parties, and we encourage you to review their policies. All of them process data in the United States — see Section 7 for the transfer mechanisms and supplementary measures that apply.
We do not send your notes, bookmarks, study sets, or the contents of your account profile to any of these providers, and we do not sell or share your personal data with them for their own purposes, for advertising, or for training their models on you.
If we add a provider outside this table, or use one of these providers for a materially different purpose, we will update this Policy and notify you under Section 17 before the change takes effect.
You may exercise any of your data protection rights by:
Verification: To protect your privacy, we will verify your identity before processing any rights request. We may ask you to confirm information associated with your account.
Response time:
No fee: We will not charge a fee for processing your request, unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.
Authorized agents: California residents may designate an authorized agent to submit requests on their behalf. The agent must provide written authorization signed by you, and we may still verify your identity directly.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes:
Your continued use of the Service after the effective date of changes constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account before the changes take effect.
We encourage you to review this Privacy Policy periodically.
If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:
Renkara Media Group
This Privacy Policy is effective as of August 21, 2026.
Version 2.3.0
Apple®, iPhone®, iPad®, Apple Pencil®, Apple Vision Pro®, and macOS® are trademarks of Apple Inc., registered in the U.S. and other countries and regions, and App Store® is a service mark of Apple Inc. Apple is not affiliated with, and does not endorse, this product.
AccelaStudy® and Renkara® are registered trademarks of Renkara Media Group, Inc. All third-party marks are the property of their respective owners and are used for nominative identification only.