Last updated: 29 October 2026. This notice describes the current Zahlon Study website and student workspace.
1. Who is responsible
The data controller is Shamil Niyas, trading as Shamrocks Games (sole proprietor / Einzelunternehmer), Neue Heimat 16, 65795 Hattersheim am Main, Germany. For all privacy questions, rights requests and account requests, contact support@zahlon.com. Full provider details are in the legal notice.
2. What we collect
- Account information: your email address, authentication credentials handled by Supabase, account identifiers and authentication events.
- Study workspace information: the name, planning preferences, programme or employer links, application stages, dates, notes, tasks, document-readiness statuses, self-reported language practice and budget values you choose to enter.
- Technical information: IP address, request and device/browser information, security checks and operational logs processed by the hosting and authentication providers.
- Correspondence: the information you send when contacting support.
We do not request passport scans, health data, bank statements or document uploads in this release. Do not include sensitive personal information in notes or support emails. Public guides can be read without creating an account.
3. Why we use it and the legal bases
| Purpose | GDPR legal basis |
|---|---|
| Create your account, authenticate you, store your requested workspace and respond to service enquiries | Article 6(1)(b): providing the requested service or taking steps at your request |
| Protect the service, prevent abuse, troubleshoot and handle general enquiries | Article 6(1)(f): legitimate interests in operating a secure, reliable service and responding to communications |
| Meet applicable legal obligations or required record retention | Article 6(1)(c), where a legal obligation applies |
The agreement checkbox accepts the service terms and acknowledges this privacy notice; it is not blanket consent to marketing or unrelated processing. This release does not subscribe users to marketing emails.
4. Shared Zahlon sign-in, separate Study records
Zahlon Study uses the existing Zahlon Travel authentication service. If you already have a Zahlon Travel account, you can use the same email and password. Your Study workspace is created when you explicitly opt in, and its records are stored in separate tables with account-ownership access rules.
Resetting the shared account password affects both services. Logging out of Study ends that Study session. Deleting your Study workspace does not delete the shared authentication account or Travel records. See account and data deletion.
5. Service providers and recipients
- Supabase: account authentication and Study data storage in the existing project’s Mumbai region (ap-south-1), with operational processing by Supabase and its subprocessors.
- OpenAI Sites and Cloudflare: website hosting, content delivery, connection handling and security/bot checks.
- Resend: delivery of account-verification and password-reset emails through the existing Zahlon email service.
- Email-service providers: delivery and handling of correspondence you send to support.
- OpenAI: AI-assisted processing of relevant Study support and partnership correspondence to help research, prepare and review responses. Routine replies may be sent after automated review; requests involving payments, contracts, sensitive records or a request for human review are escalated.
- Authorised service personnel or authorities: only where needed for operation, support or a legal obligation.
We do not sell Study workspace data. We do not automatically send your plans to universities, employers or visa authorities. Our support office may use relevant information in your enquiry for AI-assisted replies. You can request human review by replying “human review” or contacting support@zahlon.com; avoid sending sensitive documents. Clicking an external resource link connects you to that provider, whose own privacy terms apply.
6. International processing
Because the existing database is hosted in India and some providers operate globally, information may be processed outside the European Economic Area. Provider arrangements may use an applicable adequacy decision or appropriate safeguards, including the European Commission’s standard contractual clauses, as required for the transfer.
Supabase’s data-processing addendum and Resend’s data-processing addendum describe their transfer provisions. Contact support@zahlon.com for information or a copy of the safeguards applicable to your data, subject to protecting confidential information.
7. How long information is kept
Your active Study workspace remains available until you delete it or request removal. Self-service deletion removes the active Study profile and its applications, tasks, planner and budget. Shared authentication data remains until the shared account is separately deleted.
Support correspondence is kept for as long as necessary to resolve the enquiry and meet applicable legal or claims-related obligations. Provider backups and security records may remain for the relevant provider retention periods, or longer where a specific legal obligation requires it. They are not retained as an active student workspace. Contact us for information about a particular record.
8. Your rights and choices
Subject to the conditions in applicable data-protection law, you can request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests. If a future activity relies on consent, you can withdraw that consent without affecting processing already lawfully completed.
Export your Study records from My profile → Download my Study data, edit your own records, or delete your Study workspace. For other requests, email support@zahlon.com, preferably from your account email. We may request proportionate information to confirm your identity; do not send a passport scan unless a secure, necessary process has been explained. Requests are handled within the applicable GDPR time limits, normally one month.
9. Complaints
You can complain to a competent data-protection supervisory authority, including in your place of habitual residence or work. For this German provider, the regional authority is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit). Submit a complaint to the Hessian authority.
10. Browser storage and sharing
Necessary browser storage keeps your sign-in session and temporary planning choices. Hosting security may use necessary cookies. See the cookie and browser-storage notice for purposes and controls.
Sharing a public guide shares its page link, not your private workspace. Exporting your records creates a file on your device; you control any later sharing. Contact links open your own email app and do not send a message automatically.
11. Optional information, young users and automated decisions
You do not have to create an account to read the guides. An email and authentication information are needed for an account; you choose which additional Study records to save. Without those details, the corresponding workspace features cannot operate.
If you cannot independently enter into this service arrangement under applicable law, involve a parent or guardian before creating an account. Public guides remain available. We do not knowingly seek sensitive information about children.
The pathway planner uses your choices to suggest research steps. It does not make legally binding or similarly significant automated decisions about you, assess admission eligibility or submit applications.
12. Changes
We update this notice when data practices change. Material changes will be reflected in the date and communicated through an appropriate service channel. Questions: support@zahlon.com.