Privacy Policy
Last updated: June 13, 2026
1. Who we are
Crameleon (“Crameleon”, “we”, “our”, “us”) is an AI-powered exam preparation and career tool for engineering students, operated from Ontario, Canada. Questions about this policy or data requests: support@crameleon.com.
2. What we collect and why
We collect the minimum data necessary to provide the service:
Account information
When you sign in with Google (via Firebase Authentication), we receive your name, email address, and profile picture as shared by Google. We use this to create and manage your account.
Uploaded course materials
You may upload lecture notes, syllabi, or past exams to generate practice papers. These files are processed to generate your exam and are stored temporarily in Firebase Storage. They are deleted automatically after processing completes (within 24 hours) or when you delete them from your dashboard, whichever is sooner.
Resumes (personally identifiable information)
The internship feature allows you to upload your resume. Your resume may contain sensitive personal information (name, address, phone number, employment history, education). We use it solely to provide resume feedback and internship-matching suggestions. Resumes are stored in Firebase Storage linked to your account. We do not share your resume with third parties other than the AI subprocessors listed in Section 5 (strictly for analysis purposes, not for storage or model training). You can delete your resume at any time from your account settings, or by emailingsupport@crameleon.com.
Usage data
We collect data about how you use the service: number of exam generations, messages sent to the study helper, pages visited, and feature interactions. This helps us improve the product and enforce plan quotas.
Payment information
Subscription payments are processed by Stripe. We never see or store your full card number — only a Stripe customer ID and subscription status. Stripe's privacy policy governs their handling of payment data.
Email addresses (optional)
If you choose to receive a MyMajor report or quiz result by email (without creating an account), you are explicitly opting in to that email plus occasional study tips and product updates. Every email includes a one-click unsubscribe link. We do not sell or rent email addresses.
Cookies and analytics
We use essential cookies for authentication and session management. We also use Google Analytics (GA4) to understand aggregate traffic and usage patterns. GA4 sets first-party cookies. See Section 8 for our cookie consent approach. We do not use advertising or cross-site tracking cookies.
3. Legal basis for processing
We rely on the following bases under PIPEDA (Canada) and, where applicable, GDPR (EU/UK):
- Contract performance — processing your data to deliver the service you signed up for (exam generation, account management, billing).
- Legitimate interests — analytics and product improvement, fraud prevention, security.
- Consent — marketing emails (opt-in only); non-essential analytics cookies.
- Legal obligation — retaining financial records as required by law.
4. How we use your data
- Generate AI-powered practice exams, solutions, and study-helper responses
- Provide resume feedback and internship-matching suggestions
- Manage your account, subscription, and billing
- Enforce plan quotas and prevent abuse
- Send transactional emails (receipt, account notifications)
- Send marketing emails (only if you opted in; unsubscribe any time)
- Improve service quality through aggregated analytics
We do not sell your personal data. We do not use your uploaded course materials or resumes to train AI models. We do not share your data with third parties except as described in the subprocessor list below.
5. Subprocessors and third-party services
The following third parties process data on our behalf. We maintain data processing agreements with each:
| Subprocessor | Purpose | Data transferred |
|---|---|---|
| Firebase / Google | Authentication, file storage | Account info, uploaded files |
| Anthropic (Claude) | Premium AI exam generation and review | Course materials, prompts (not PII) |
| DeepSeek | Standard AI generation, study-helper chat | Course materials, prompts (not PII) |
| Stripe | Payment processing, subscription management | Billing info (processed by Stripe directly) |
| Resend | Transactional and marketing email delivery | Email address, name |
| Railway | Application hosting and PostgreSQL database | All app data (hosted in the US) |
| Google Analytics (GA4) | Aggregate usage analytics | Anonymized/aggregated usage events |
| ElevenLabs (planned) | AI voice features (not yet live) | Text content (when feature ships) |
We take reasonable steps to ensure all subprocessors maintain appropriate security standards. When data is transferred outside Canada (e.g., to US-based providers), we rely on contractual protections or applicable adequacy frameworks.
6. Data retention
- Account data — retained while your account is active. Deleted within 30 days of account deletion request.
- Uploaded course materials — deleted automatically within 24 hours of generation, or immediately on manual deletion.
- Resumes — retained until you delete them or your account is deleted. You can request deletion at any time.
- Billing records — retained for 7 years as required by Canadian accounting and tax law.
- Analytics data — retained in GA4 per Google's default retention periods (14 months).
- Free user session data — not saved between sessions.
7. Your rights
Under PIPEDA (and GDPR where applicable), you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate data.
- Deletion — request deletion of your account and all associated personal data (including uploaded resumes and course materials).
- Export — request your data in a portable format.
- Withdraw consent — opt out of marketing emails at any time (unsubscribe link in every email).
- Complaint — lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.
To exercise any right, email support@crameleon.com. We will respond within 30 days.
8. Cookies
We use two categories of cookies:
- Essential cookies — required for authentication and session management (set by Firebase). These cannot be disabled without breaking the service.
- Analytics cookies — set by Google Analytics (GA4) to measure aggregate usage. These are non-essential. You can decline them via the cookie banner shown on your first visit, or change your preference at any time in your browser settings.
We do not use advertising or cross-site tracking cookies.
9. Age and children
Crameleon is intended for users aged 16 and over. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has created an account, contact us and we will delete it promptly.
10. International data transfers
Crameleon is operated from Ontario, Canada. Our subprocessors (including Firebase, Railway, Anthropic, DeepSeek, Stripe, and Resend) are primarily located in the United States. When your data is transferred outside Canada, we rely on contractual protections (standard contractual clauses or equivalent) to ensure it receives a comparable level of protection.
11. Security
We implement reasonable technical and organizational measures to protect your personal data: HTTPS everywhere, Firebase security rules, Stripe's PCI-compliant payment handling, and access controls on our database. No system is perfectly secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected users and the OPC as required by PIPEDA.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version here and update the “Last updated” date. For material changes, we will notify registered users by email.
13. Contact
Privacy questions, access/deletion requests, or concerns about our data practices:
support@crameleon.com
Crameleon, Ontario, Canada