Thea App Privacy Policy

Last Updated: 07/30/2026

Scope

This App Privacy Policy explains how Theaai Corporation, doing business as Thea ("Thea," "we," "us," or "our"), collects, uses, and discloses personal information when you use Thea's educational application and related services, collectively, the "Service."

This policy applies to the Service. It does not apply to Thea's marketing website, which is governed by our Website Privacy Policy. The advertising cookies, social media pixels, and similar advertising technologies described in our Website Privacy Policy are not used in the Service.

School-Licensed Accounts and Student Data

If you access the Service through a school, university, district, teacher, employer, or other organization, that organization may provide, manage, or administer your account and may determine certain settings, access permissions, and uses of information within the Service. Your use of the Service may also be subject to that organization's policies and its agreement with Thea.

For school-licensed accounts, Thea processes student personal information to provide the Service to the school and its authorized users, in accordance with our agreement with the school. In this policy, "School-Licensed Student Data" means personal information about a student that we process through the Service on behalf of a school, district, university, teacher, or other educational institution under an agreement with that organization.

We use School-Licensed Student Data only to provide, secure, support, maintain, and improve the Service as authorized by the applicable school or educational institution and our agreement with that organization. We do not sell School-Licensed Student Data. We do not use or disclose School-Licensed Student Data for targeted advertising, cross-context behavioral advertising, survey monetization, data broker disclosures, or other monetization unrelated to providing the Service, as those terms are defined under applicable privacy laws.

If you are a student using a school-licensed account and want to access, correct, or delete your personal information, we may direct your request to your school or educational institution, consistent with applicable law and our agreement with that organization.

Personal Data We Collect

We collect personal data relating to you, "Personal Data," as described below. The Personal Data we collect depends on how you use the Service, whether you use an individual account or an account provided by a school or other organization, and the features available to you.

Personal Data You Provide: We collect Personal Data if you create an account to use the Service or communicate with us as follows:

Personal Data We Collect Automatically:

Information We Receive from Other Sources:

Sensitive Information: We do not require you to provide sensitive Personal Data, such as health information, biometric information, government identification numbers, financial account numbers, precise geolocation, racial or ethnic origin, political opinions, religious beliefs, or similar sensitive information, to use the Service. Please do not upload sensitive Personal Data unless it is necessary for your authorized use of the Service and you have the right to provide it. If we become aware that sensitive Personal Data has been uploaded in violation of this policy or our Terms, we may delete, redact, restrict access to, or otherwise handle it consistent with applicable law, our agreements, and our retention practices.

How We Use Personal Data

We use Personal Data for the following purposes:

We use School-Licensed Student Data only to provide, secure, support, maintain, and improve the Service as authorized by the applicable school or educational institution and our agreement with that organization. We do not use School-Licensed Student Data for targeted advertising, cross-context behavioral advertising, survey monetization, data broker disclosures, or other monetization unrelated to providing the Service.

We do not use School-Licensed Student Data to train or fine-tune AI models unless expressly permitted by the applicable school agreement and applicable law. If we offer optional model-improvement features for individual consumer users, we will obtain any consent required by law.

We may aggregate or de-identify Personal Data so that it no longer reasonably identifies you and use that information for the purposes described above, such as analyzing Service usage, improving and developing features, maintaining security, and conducting internal research. Where we maintain or use de-identified information, we will maintain and use it in de-identified form and will not attempt to re-identify it except as permitted or required by applicable law.

Disclosure of Personal Data

We disclose your Personal Data in the following circumstances:

We do not disclose School-Licensed Student Data to data brokers, advertising networks, or social media advertising platforms for targeted advertising, cross-context behavioral advertising, survey monetization, or other monetization unrelated to providing the Service.

Retention

We retain Personal Data for as long as reasonably necessary to provide, secure, support, and improve the Service; comply with legal obligations; resolve disputes; enforce our agreements; prevent fraud, abuse, and misuse; maintain business and financial records; and fulfill the other purposes described in this App Privacy Policy.

How long we retain Personal Data depends on the type of data, how we use it, your account settings, applicable law, and, for school-licensed accounts, our agreement with the applicable school or organization.

Information You Delete

The Service may allow you to delete certain Personal Data stored in your account, such as study materials, uploaded content, or your account. When you delete Personal Data, we will delete it from active systems within 30 days, unless we need to retain it for longer for the reasons described below, or unless it has already been aggregated, de-identified, or disassociated from your account.

Information We Delete Automatically

In some cases, Personal Data is deleted automatically. For example, original file uploads may be automatically deleted from active systems within 30 days after processing, unless you save them in your account, your school or organization's settings require a different retention period, or we need to retain them for security, safety, legal, or compliance reasons. Generated study materials, account records, logs, metadata, and related information may be retained for different periods as described in this policy and our retention practices.

Information We Retain for Longer

In some cases, we may retain Personal Data for longer, including after you request deletion, where reasonably necessary to:

For example, if specific User Content or an account is suspended or terminated for violating our Terms or policies, we may retain relevant information as reasonably necessary to prevent further abuse, enforce our Terms, or protect the Service. If we receive a lawful subpoena, court order, or other legal request, we may retain relevant information for the duration of the legal or regulatory obligation. If you purchase a subscription, we may retain payment and transaction-related information as needed for accounting, tax, dispute resolution, fraud prevention, and regulatory compliance purposes.

Backups

Deleted information may remain in backups or archival copies for a limited period. We maintain such copies in accordance with our ordinary backup and disaster recovery practices, and they are deleted or overwritten in the ordinary course of business. We do not use backup copies for ordinary business purposes.

School-Licensed Accounts

If you use a school-licensed account, retention, deletion, and return of Personal Data may be governed by our agreement with the applicable school or organization. If you are a student and request deletion, access, or correction of Personal Data associated with a school-licensed account, we may direct your request to your school or organization consistent with applicable law and our agreement with that organization.

Retention Criteria

In determining retention periods, we consider factors such as:

Service Providers

We require our service providers, including AI providers and subprocessors, to retain Personal Data only as necessary to provide services to us or as otherwise permitted by our contracts and applicable law.

Your Choices and Rights

Account Information

You may review and update certain account information by logging into your account. You may also request access to, correction of, or deletion of your personal information by contacting us at https://www.theastudy.com/contact.

School-Licensed Accounts

If you use the Service through a school, university, district, teacher, employer, or other organization, your account may be managed by that organization. Requests to access, correct, or delete personal information associated with a school-licensed account may need to be directed to the applicable school or organization, consistent with applicable law and our agreement with that organization.

Cookie Choices

We use essential cookies and similar technologies to operate, secure, and provide the Service. These cannot be disabled through our cookie preference tool. Where we use non-essential analytics or performance cookies, you may accept or reject them when prompted and may change your choice at any time through the cookie preferences tool in the Service. If you reject non-essential cookies, essential cookies will still be used. You can also manage cookies through your browser settings, but disabling certain cookies may affect Service functionality.

Marketing Communications

You may opt out of marketing emails by using the unsubscribe link in those emails or by contacting us. We may still send transactional, administrative, security, billing, and service-related messages.

Privacy Rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or portability of your personal information, and to object to or restrict certain processing. You may submit a request by contacting us at https://www.theastudy.com/contact. We may need to verify your identity before fulfilling your request.

Appeals

If applicable law gives you the right to appeal our decision on a privacy request, you may appeal by replying to our decision email or contacting us at https://www.theastudy.com/contact. We will respond as required by applicable law.

Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

In addition to the rights listed above, EEA, UK, and Swiss users have the right to object to processing based on our legitimate interests, request restriction of processing, data portability, and withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local supervisory authority. Contact details for EU authorities are available at https://edpb.europa.eu/about-edpb/about-edpb/members_en, for the UK at https://ico.org.uk, and for Switzerland at https://www.edoeb.admin.ch.

International Data Transfers

The Service is operated from the United States. If you use the Service from outside the United States, including from the EEA, UK, or Switzerland, your Personal Data may be transferred to and processed in the United States and other countries where Thea or its service providers operate.

Where required, we use appropriate safeguards for international transfers. Depending on the context and the vendor, these may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where applicable, reliance on vendors' certification under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework.

We also apply data minimization, access controls, security measures, and other technical and organizational measures designed to reduce transfer risk. You can contact us at https://www.theastudy.com/contact to request more information about these safeguards and, where applicable, a copy of the relevant contractual commitments.

Legal Bases for EEA, UK, and Swiss Users

If you are located in the EEA, UK, or Switzerland, our legal bases for processing Personal Data include:

Where we process School-Licensed Student Data on behalf of a school or educational institution, that organization may be responsible for identifying the applicable legal basis for its use of the Service.

Children

The Service is not intended for, and may not be used by, children under 13 in the United States or by individuals below the applicable minimum age required to use the Service in their jurisdiction. We do not knowingly collect Personal Data from children who do not meet these minimum age requirements. If we learn that we have collected Personal Data from a child who does not meet these requirements, we will take reasonable steps to delete it.

Schools and other organizations may not invite or authorize users who do not meet these minimum age requirements unless Thea has expressly agreed otherwise in a written agreement and the use is permitted by applicable law.

We do not knowingly sell or share the Personal Data of consumers under 16 years of age, as "sell" and "share" are defined under applicable privacy laws.

If you are a parent or guardian and believe your child has provided us with Personal Data in violation of this policy, please contact us at https://www.theastudy.com/contact.

FERPA and Education Records

For school-licensed accounts, information provided by or on behalf of a school may include student education records subject to the Family Educational Rights and Privacy Act, "FERPA." Where FERPA applies, Thea processes such information as a service provider to the school and uses it only to provide and support the Service, as authorized by the school and our agreement with the school. Schools are responsible for determining whether and how FERPA applies to their use of the Service and for responding to student and parent requests under FERPA.

Security

We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, no method of transmission or storage is fully secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for using appropriate safeguards when accessing the Service.

Required U.S. Disclosures

Certain U.S. state privacy laws require that we provide additional disclosures about the categories of personal information we collect, the sources of that information, the purposes for which we use it, and the categories of recipients to whom we disclose it. This section applies to the extent required by applicable U.S. state privacy laws.

Categories of Personal Information We Collect

Depending on how you use the Service, we may collect identifiers; customer records information; commercial information; internet or other electronic network activity information; approximate geolocation information; education-related information; User Content; audio, visual, or similar information if you choose to upload content containing that information; inferences; and sensitive personal information if you choose to provide it or include it in content you upload. We do not require sensitive personal information to use the Service and ask that you not upload it unless necessary for your authorized use of the Service and you have the right to provide it.

Sources of Personal Information

We collect personal information from you directly; from your use of the Service; from schools, universities, districts, teachers, employers, or other organizations that provide, manage, or administer accounts; from login, authentication, and single sign-on providers; from payment processors and subscription management providers; from service providers, security partners, and fraud-prevention vendors; from business and institutional contact sources, but not for School-Licensed Student Data; and from other users if they choose to share content or information with you or about you through the Service.

Purposes

We collect and use personal information for the purposes described in this App Privacy Policy, including to provide, operate, maintain, secure, support, and improve the Service; create and administer accounts; generate and display practice questions, explanations, summaries, study materials, and other outputs; support school-licensed accounts; process payments and manage subscriptions; communicate with you; provide support; send service-related and, where permitted, marketing communications; conduct internal analytics, troubleshooting, product testing, product research, and service improvement; administer optional surveys, promotions, or feedback features for eligible users; prevent and address fraud, abuse, security incidents, and misuse; comply with law; enforce agreements; protect rights, safety, and security; and create aggregated or de-identified information. For school-licensed accounts, we use School-Licensed Student Data only to provide, secure, support, maintain, and improve the Service as authorized by the applicable school or educational institution and our agreement with that organization.

Categories of Recipients

We may disclose personal information to vendors, service providers, and subprocessors; AI providers; payment processors and subscription management providers; schools, universities, districts, teachers, employers, or other organizations that provide, manage, or administer accounts; authorized account administrators; login, authentication, and single sign-on providers; affiliates; professional advisors; government authorities, courts, regulators, law enforcement, or other third parties where required or permitted by law or necessary to protect rights, safety, security, or legal interests; counterparties and advisors in business transactions; and other users or third parties when you direct us to share information, use sharing features, or otherwise consent.

Sale, Sharing, and Targeted Advertising

We do not sell personal information collected through the Service, as "sell" is defined under applicable U.S. state privacy laws. We do not share personal information collected through the Service for cross-context behavioral advertising or process it for targeted advertising, as those terms are defined under applicable U.S. state privacy laws. We do not use mobile device advertising identifiers, social media advertising pixels, or similar technologies in the Service for targeted advertising, cross-context behavioral advertising, or sale of personal information. We do not use or disclose School-Licensed Student Data for targeted advertising, cross-context behavioral advertising, survey monetization, data broker disclosures, or other monetization unrelated to providing the Service.

Profiling

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning users.

Sensitive Personal Information

We do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

Retention

We retain each category of personal information for as long as reasonably necessary to fulfill the purposes described in this App Privacy Policy, including to provide, secure, support, maintain, and improve the Service; comply with legal obligations; resolve disputes; enforce agreements; prevent fraud, abuse, and misuse; maintain business and financial records; and satisfy our operational, security, and compliance needs. The retention period depends on the type of information, the purpose for which it is processed, your settings, applicable law, and, for school-licensed accounts, our agreement with the applicable school or organization.

Your U.S. Privacy Rights

Depending on where you live, you may have the right to request that we confirm whether we process your personal information, provide access to your personal information, correct inaccurate personal information, delete personal information, provide a copy of personal information in a portable format, opt you out of certain processing where applicable, and appeal our decision on a privacy request where applicable. You may submit a privacy request by contacting us at https://www.theastudy.com/contact. We may need to verify your identity before fulfilling your request. If you use a school-licensed account, we may direct your request to the applicable school or organization, consistent with applicable law and our agreement with that organization.

Authorized Agents

Where permitted by applicable law, you may designate an authorized agent to submit certain privacy requests on your behalf. We may require the agent to provide proof of authorization and may also require you to verify your identity directly with us, unless otherwise prohibited by law.

Appeals

If applicable law gives you the right to appeal our decision on a privacy request, you may appeal by replying to our decision email or by contacting us at https://www.theastudy.com/contact. We will respond to your appeal as required by applicable law. If your appeal is denied, you may have the right to contact your state Attorney General or other privacy regulator.

Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

Changes to the Privacy Policy

We may update this policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law.

Contact Us

If you have questions, need this policy in an alternative format, or would like to exercise your privacy rights, contact us at https://www.theastudy.com/contact or:

1201 Wilson Blvd. Suite 2110
Arlington, VA 22209