Privacy Policy

DURMAH LEARNING PTE. LTD., registered in Singapore (UEN 202606247E), owns and operates Durmah and is responsible for the personal data it collects through this independent service. It is not part of a university. Contact us at admin@durmah.ai about your data or privacy rights.

The restricted-use requirement covers study files, notes, prompts, responses, summaries and derived representations such as embeddings. They must not become a shared training, fine-tuning or model-evaluation collection. A request for help does not authorise that secondary use. Necessary storage, access control, security, support and legal obligations are distinct service operations; they must be proportionate and disclosed, and do not create an unrestricted “service improvement” permission.

Data Categories

1. Institutional Pack Data

Institution and module context whose source rights and currency must be checked. Public availability alone is not a licence for reuse; institutional content is withheld from AI pending review.

2. Student Uploaded Data

Materials you upload or generate in your account (for example permitted notes, files, prompts and independent practice drafts). These are separated from other student accounts, subject to the processing and operational access described here.

This can include essays, assignment briefs, draft answers, lecture notes, uploaded documents, Mark My Paper submissions, AI feedback history, module choices, YAAG/calendar data, planner data, saved study materials, anddeclared learner profile details and, if you choose Premier Lounge membership, university mailbox verification and community records.

Independent study records and contact preferences

For service monitoring, we record successful sign-ins, membership and trial starts, visible browser-session observations and the time and broad tool area of saved study actions. These operational records are linked to your account, are retained for up to 90 days and are available only through protected administration. They do not copy your study text, audio, raw page URLs or IP addresses into the activity history. A visible session does not prove attention or learning. Founder alert emails and daily summaries omit student names, email addresses and study content. You can request deletion through account privacy controls. Optional public visitor analytics and the Google Analytics integration have been discontinued. Historical observations do not establish current visitor totals.

The independent writing editor keeps its text in the current browser page's memory until you download it or explicitly request AI assistance. It is not automatically saved or submitted to an AI provider. Closing or reloading the page can lose undownloaded text.

For signed-in users, we store task declarations, the relevant policy version, expiry and revocation status, and content-free activity events such as permission decisions and provider-request attempts. These records identify your account and may include short task labels and course references; keep academic content and sensitive information out of those labels. You can export these records and request deletion through account privacy controls.

Optional product and research email preferences are separate, default to off and can be withdrawn in the independent workspace. Acceptance of a social-media connection is not treated as marketing consent. Promotional and referral emails remain off unless separately chosen. Standard-trial service reminders may be sent once at about three days before expiry, once at about one day before expiry and once after expiry. Controlled-access accounts are excluded.

AI and upload availability depends on the current checks for each feature. The current database region is Singapore. The provider inventory, review limitations and feature status are described on Service transparency. We have not verified a universal zero-retention or no-training commitment for all providers, or a single fixed retention period for every existing data category.

External processing and sign-in

Signing in with Google provides account identity information to Durmah. A personal Google account and an accurate learner profile are sufficient for private study; university email verification is not required. UK law students provide their university and course; independent learners can choose that status without claiming university attendance. Profile declarations do not establish institutional approval. We do not ask for your university password.

Durmah's first release is for learners aged 18 and over. We ask you to confirm that you are 18 or older and record the version and time of that statement with your account. We do not collect your date of birth for this confirmation. The statement is self-declared, not an identity or age-verification check.

Premier Lounge membership has a separate university mailbox check and community agreement. We retain the private verification address, verification time, declared name and institution, membership status, agreement record and most recent successful Lounge access for admission, support and security. Authorised administrators can review membership and access status. Names, institutions and contributions are visible to admitted members after you choose to join; email addresses and private study content are not published. Mailbox control is not proof of current enrolment or legal identity. See Lounge privacy and membership rules, including withdrawal and report handling. Optional connections enable one-to-one text messages after both members agree. Reactions, requests and messages are stored to provide those functions. Reported messages may be reviewed by authorised moderators; other members do not receive access to your conversations. Unwind appearance, timer and generated sound remain on your device without a mood history.

Hosting, storage, authentication, email delivery, payment and AI providers process data needed for the services you use. AI features send relevant prompts, uploaded content or extracts to the provider used by that feature. Account privacy does not mean that content stays only on your device or that no provider can access it.

Processing may take place outside the UK. Do not assume UK-only storage, zero provider retention or that an upload is suitable for confidential or restricted university material. Contact us before sharing material that has specific processing or location requirements.

How Academic Data Is Used

Your permitted materials and study records support the study features you choose to use, including explanations, revision, feedback and planning where available. You choose what to share. You can start without uploads and add relevant material later. Availability and the rules for your task still apply.

Academic work is intended to be private to its owner and authorised operations. Account and storage access controls enforce that separation. Student-uploaded academic data is not used to create shared university packs or global legal resources.

Visibility and Account-Based Access

Copyright permission, an instruction to use a feature, and a lawful basis for processing personal data are different questions. An upload declaration does not establish all three. Durmah remains responsible for its own data-protection obligations and provider arrangements. Our responsible-study explanation distinguishes private learning from external processing.

Personal academic material is tied to your own account. Access controls and database access controls are used so student-owned records are separated by account. Admin access is limited to operational support, safety, billing, security, and lawful business needs.

Wellbeing & Support: what we do and do not do

Information about your mental health is special-category personal data under Article 9 of the UK GDPR, and we treat it differently from your academic data. This section explains exactly how.

Durmah is not monitored, and cannot get help for you

No one at Durmah reads, reviews or monitors your wellbeing conversations. Durmah does not raise alerts, does not notify your university, your tutor or your emergency contacts, and cannot contact emergency services on your behalf. Durmah is a student support and navigation service. It is not a healthcare provider, a counselling service, a crisis service or a therapist, and it must not be relied on as one. If you need urgent help, use the services listed on the Wellbeing & Support page — they are staffed by real people.

The wellbeing AI conversation is not enabled

Durmah has not enabled the optional wellbeing AI conversation while its lawful basis, Article 9 condition and related data-protection controls remain under formal review. The endpoint is unavailable and the member page does not send wellbeing text to an AI provider.

The urgent-help contacts, support directory, short resets, workload triage and message-building guidance work without an AI feature. Text entered into those local tools is not sent to Durmah or an AI provider.

Durmah no longer offers a mood check-in or wellbeing score, and does not store mood ratings, stress ratings or wellbeing trend data.

Ordinary study conversations are saved as part of your study history. If you include health or other sensitive personal information in a study message, that text can be stored with the conversation and sent to the AI provider when the study feature is available. Please keep this information out of study messages. The shared study service does not save inferred wellbeing labels or wellbeing scores in its long-term study memory. Supportive replies in a conversation do not mean that anyone is monitoring it or can arrange help for you.

What we do record

When the urgent-support information is shown, we record a single content-free counter noting that it was shown and on which part of the product. That record contains no user identifier, no message text and no indication of what was said. It exists so we can tell how often the support routes are being surfaced. It cannot be used to identify you or to follow anything up, and nobody reviews it for that purpose.

Lawful basis

Special-category processing requires both an Article 6 lawful basis and an Article 9 condition. Not storing the information does not remove that requirement. Durmah will not enable an optional wellbeing AI feature unless those grounds and the required controls have been formally established and described here first.

Security Posture

• Account-based access controls
• Row-level security isolation between users
• Encrypted storage and encrypted data transmission

Data Use Limits

• Data is not sold.
• Student uploads are not reused to build Institutional Packs.
• Processing supports service delivery, necessary administration, billing, support and security.

Student Control and Deletion Requests

The ICO guide to individual rights explains the rights and their conditions. These rights are separate from copyright ownership in your study materials.

Where UK data-protection law applies, you may have rights to access and correct personal data, request erasure or restriction, object to processing and obtain portable data where the relevant conditions apply. A deletion request is not a promise that every record can immediately be erased. You can raise concerns with us or complain to the ICO; other local rights may also apply.

You can request deletion of uploaded personal study data, workspace study data, or account-related app data from your account privacy page or by contacting admin@durmah.ai.

Deletion requests are reviewed before execution so Durmah can avoid deleting the wrong records, shared academic resources, or another student's data. Where records are clearly owned by your account, Durmah can delete or reset them through an owner-scoped workflow. Ambiguous account records may require manual review.

Subscription Cancellation Versus Data Deletion

Cancelling or stopping a subscription does not automatically delete your study workspace. This helps prevent accidental loss of essays, drafts, notes, planning data, or feedback history. If you stop using Durmah.ai and want personal study data deleted, submit a deletion request.

Records That May Be Retained

Minimal audit, legal, security, billing, fraud-prevention, or operational records may be retained where necessary. Durmah does not promise instant deletion, but requests are handled through a reviewed process.