01Data Controller
The controller responsible for the processing of personal data collected through the RSchool app is:
Digital Asset S.r.l.
Via Colombara, 7 — 36030 Sarcedo (VI), Italy
VAT number: IT04223550247
Email: info@digitalassetgroup.it
Given the nature and scale of the processing carried out, the Controller is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. For any request concerning this notice or the exercise of your rights, you can contact us directly at the email address above.
02Data We Collect and Why
We only collect the data strictly necessary to provide the service. We do not collect irrelevant data and we never request access to your contacts, messages, or social profiles.
| Data category | Purpose | Legal basis |
|---|---|---|
| Name, surname, email | Account creation, authentication, service communications | Performance of a contract (Art. 6.1.b) |
| Social sign-in credentials (Google / Apple, if used) | Authentication via a third-party provider | Performance of a contract (Art. 6.1.b) |
| Profile photo (optional) | Profile personalisation | Consent (Art. 6.1.a) |
| Uploaded study content (photos of notes/books, PDFs) | AI processing to generate summaries, flashcards and quizzes — see Art. 3 | Performance of a contract (Art. 6.1.b) |
| Conversations with the tutor (questions and answers) | "Ask the tutor" feature: answers based on your pages and conversation history for each scan — see Art. 3 | Performance of a contract (Art. 6.1.b) |
| Progress data (scores, XP, study streaks, spaced-repetition stats) | Gamification and spaced-repetition features | Performance of a contract (Art. 6.1.b) |
| Subscription data (plan status — not payment card data) | In-app subscription management and billing | Contract (Art. 6.1.b) and legal obligation (Art. 6.1.c) |
| Device token (anonymous) | Push notifications and study reminders | Consent (Art. 6.1.a) |
| Diagnostic data (device model, OS version, crash logs) | Detecting and fixing malfunctions | Legitimate interest (Art. 6.1.f) |
| Usage data (usage events, screen views) | Statistical analysis to improve the product — collected only with your explicit consent, possibly linked to your account to analyse usage over time | Consent (Art. 6.1.a) |
| Ad measurement data (install, sign-up and subscription events; on iPhone, the advertising identifier only if you allow tracking) | Understanding which advertising campaign led you to RSchool — collected only with the "Ad measurement" consent | Consent (Art. 6.1.a) |
| Referral code | Managing the "Invite a friend" programme | Consent (Art. 6.1.a) |
| Month and year of birth | Checking the minimum age of 14 — see Art. 8 | Legal obligation (Art. 6.1.c; Italian Law 132/2025) |
| Consent choices and acceptance of the Terms and Privacy Policy (with date and version) | Proving the consents received and the conditions accepted | Legal obligation (Art. 6.1.c and Art. 7.1 GDPR) |
Providing the data needed to create an account and use the service, including your month and year of birth, is mandatory: without it you cannot use RSchool. The profile photo, push notifications, taking part in the "Invite a friend" programme and the "Usage statistics" and "Ad measurement" consents are optional.
03Artificial Intelligence and Uploaded Content
RSchool uses artificial intelligence to turn the study content you upload (photos of notes or books, PDF files) into summaries, mind maps, flashcards, quizzes and oral quizzes, and to answer your questions through the tutor. This processing deserves a specific explanation.
- How it works: uploaded content is sent, through a proxy server we operate and which is hosted on European infrastructure, to Google's Gemini AI service. The access key for this service is never present on your device: every request is authenticated with your account and passes exclusively through our backend.
- No automated decisions about you: the AI processes the content you choose to upload to help you study, but it does not make any automated decision producing legal effects concerning you or significantly affecting you (Art. 22 GDPR).
- No advertising profiling: the content you upload is never used to build an advertising profile or shared with advertisers.
- Conversations with the tutor: the questions you ask the tutor and its answers are saved, one conversation per scan, so you can find them when you come back. To answer, we send the AI the material from that scan and only the last 6 exchanges of the conversation. Conversations are deleted when you delete the scan or your account, and automatically after 12 months without activity.
- Oral quiz: if you choose to answer out loud, the app uses the microphone only while you are answering; you can always answer in writing.
If you'd rather not upload certain content, you simply don't have to: uploading study material is a voluntary action you take each time you use the scan feature.
04Recipients and Data Processors
Your data may be shared, to the extent strictly necessary, with the following parties, acting as data processors or as independent controllers for their own purposes:
- Google Ireland Limited / Google LLC — Firebase infrastructure (authentication, Firestore database, cloud functions, storage, Analytics, Crashlytics, App Check), hosted on servers in the European region.
- Google LLC — Gemini AI service, for the content processing described in Article 3.
- RevenueCat, Inc. — management and synchronisation of in-app subscriptions across iOS and Android. It does not receive or store your payment card data.
- Apple Inc. and Google LLC (Google Play) — store and in-app payment operators, acting as independent controllers for purchase transactions made through their respective stores.
- Apple (APNs) and Google (Firebase Cloud Messaging) — delivery of push notifications, via an anonymous device token.
- Singular Labs, Inc. — advertising campaign measurement, only if you turn on the "Ad measurement" consent. With the same consent, install, sign-up and subscription events are shared with the platforms where we advertise (for example Meta and TikTok), which act as independent controllers.
- Authorised staff of Digital Asset S.r.l., bound by confidentiality obligations, to the extent necessary to assist you.
We do not sell your personal data to third parties. Your study content and your conversations with the tutor are never used for advertising.
05International Data Transfers
Your data is primarily stored on servers located in the European Union. Some of the providers listed in Article 4 (in particular RevenueCat, Inc., Singular Labs, Inc. and, for certain features, Google LLC) are also based in the United States. For these international transfers, the Controller relies on the Standard Contractual Clauses approved by the European Commission and, where applicable, on other safeguards recognised as adequate under Articles 45 and 46 GDPR.
06Retention Periods
| Data category | Retention period |
|---|---|
| Name, surname, email | For as long as the account is active, plus 12 months after its closure |
| Profile photo | Deleted immediately upon account closure |
| Study content and progress data | For as long as the account is active; deleted upon closure, with backup copies removed within 90 days |
| Conversations with the tutor | For as long as the account exists; deleted with the scan or the account, and automatically after 12 months without activity |
| Subscription and billing data | 10 years, for tax and civil-law obligations (Art. 2220 Italian Civil Code) |
| Diagnostic data (crash logs) | 90 days |
| Usage data | Up to 14 months, or until consent is withdrawn for the collection of new data |
| Month and year of birth | For as long as the account exists; deleted when it is closed |
| Support correspondence | 24 months from the last contact |
07Security Measures
- Communications encrypted in transit using TLS 1.2 or higher.
- Encryption of data at rest on the underlying cloud infrastructure.
- Identity-token authentication for every call to our APIs — no anonymous access to data.
- Firebase App Check to block automated traffic and requests from tampered apps.
- No backend secret keys are ever present on the user's device.
- Access to backend systems restricted to authorised staff, with multi-factor authentication.
- Periodic review of the security measures in place.
08Minimum age
RSchool is designed for secondary school students and can be used from the age of 14. Under 14, using artificial intelligence services requires the consent of a parent or guardian (Italian Law 132/2025), which the app does not currently collect.
- The first time the app is opened, we ask everyone for their month and year of birth, before collecting any other data or consent. For accounts created before this rule, we ask once, at the first sign-in.
- If you are under 14, you cannot create an account or use the app. If the account already existed, it stays saved but cannot be used until you turn 14.
- If you entered the wrong date, write to support@rschool.it.
- A parent or guardian who believes a child under 14 is using RSchool can write to info@digitalassetgroup.it to request access to or deletion of the child's data.
09Cookies and Similar Technologies
The RSchool app does not use cookies of any kind. This webpage also does not use cookies or third-party tracking tools: it only stores your language preference in your browser's local storage, exclusively on your own device, with no transmission to external servers.
The app does, however, use two SDKs that read or write a technical identifier on your device: Firebase Analytics, for usage statistics, and Singular, for ad measurement. In line with EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, neither collects any data before you consent: we ask right after you sign up, with two separate choices ("Usage statistics" and "Ad measurement"), both off to start with. On iPhone, if you turn on measurement, the system also asks for Apple's tracking permission. You can change your mind at any time from Settings → Privacy in the app: your choice applies immediately.
10Your Rights
As a data subject, you have the right to:
- Access — obtain confirmation that processing is taking place and a copy of your personal data (Art. 15 GDPR).
- Rectification — correct inaccurate or incomplete data (Art. 16 GDPR).
- Erasure — obtain the deletion of your data, where applicable (Art. 17 GDPR).
- Restriction — restrict processing in certain circumstances (Art. 18 GDPR).
- Portability — receive your data in a structured, machine-readable format (Art. 20 GDPR).
- Objection — object to processing based on legitimate interest (Art. 21 GDPR).
- Withdrawal of consent — withdraw a given consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
You can exercise these rights directly from the app's settings or by writing to info@digitalassetgroup.it. We will respond within 30 days, extendable by a further 60 days for particularly complex requests, as provided by Art. 12.3 GDPR.
RSchool does not use any fully automated decision-making process that produces legal effects concerning you.
11Right to Lodge a Complaint
If you believe the processing of your data breaches applicable law, you have the right to lodge a complaint with the competent supervisory authority:
Garante per la protezione dei dati personali (the Italian Data Protection Authority)
Piazza Venezia, 11 — 00187 Rome, Italy
www.garanteprivacy.it
If you reside in another EU member state, you may contact the supervisory authority of your country of residence.
12Changes to This Policy
We may update this notice from time to time, for example following regulatory changes or the introduction of new features. In case of material changes, we will notify you through the app or by email before the changes take effect. The date of the last update and the version number are shown at the bottom of this page.