Security
Effective date: 10/28/2026 · Last updated: 10/29/2026
Students trust us with their notes, their voice and their progress. This page explains how we protect that data and what to do if you find a problem.
1. How we protect your data
| Area | What we do |
|---|---|
| Encryption | All traffic uses HTTPS (TLS). Stored data and files are encrypted at rest (AES-256) by our hosting provider. |
| Private by design | Each user can access only their own files, sessions and progress. This is enforced in the database with row-level security, not just in the app. There is no shared library. |
| Parent access | Parents can see only summary progress for linked students, never files, transcripts or conversations. |
| Infrastructure | We host on Lovable Cloud, built on Supabase, whose platform holds SOC 2 Type 2 and ISO 27001 certifications. Our database runs in US. |
| Backups | Daily backups, encrypted, kept for up to 35 days. |
| Secrets | Payment and AI keys are stored only on the server side and never sent to your browser. |
| Staff access | Only a small number of named staff can access production systems, using multi-factor authentication. Access is logged and reviewed every quarter. |
| AI requests | We send AI providers only what is needed to answer you. Our providers do not train on your data. We have switched off request logging in our AI gateway. |
| Payments | Card details are handled by Dodo Payments and never touch our servers. |
| On your device | Study Rafiq does not store your materials or conversations on your device for offline use. Signing out clears your session from the browser. |
2. Keeping your account safe
Use a strong password that you do not use elsewhere.
Do not share your account. Each student needs their own.
Sign out on shared or school computers.
If you think someone has used your account, change your password and email easylessons@easylessons.app straight away.
3. If something goes wrong
We have a written incident response plan with a named lead (Solomon Tatwebwa, founder) and practise it at least once a year. If a breach affects your personal data and could put you at risk, we will:
contain the problem and investigate it;
tell affected users (and linked parents for students under 18) without undue delay, explaining what happened and what to do;
notify data protection authorities where the law requires it, within 72 hours for EU users;
record what happened and fix the cause.
4. Reporting a vulnerability
If you find a security weakness, please email easylessons@easylessons.app with details and steps to reproduce it. Please do not access other people's data, disrupt the service or share the issue publicly until we have fixed it. We will acknowledge your report within 3 working days and keep you updated. We will not take legal action against good-faith research that follows these rules.
5. Reviews
We review our security controls, access rights and service providers at least once a year, and train everyone with access to user data in privacy and security.