Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
StudyStash
GDPR evidence
StudyStash: ethical, AI-powered adaptive learning built on neuroscience to improve outcomes for students, universities and
Vendor-statedStudyStash and GDPR
StudyStash states it holds a data processing agreement. CertReports captured this on 21 Sep 2026 from its trust centre (Vanta); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 21 Sep 2026 · confidence 90%ExpiredInactive
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Scope
- Types of Personal Data Processed We collect personal data primarily from our users, who are typically students, but may also include educators or administrators utilizing our platform. The types of personal data we process include: - Account Information: This includes your name, email address, password, and your affiliated university or educational institution. - User-Generated Content: This encompasses educational materials you upload, such as notes, flashcards, mind maps, practice tests, past exams, assignments, quizzes, reports, and lab manuals, along with any associated metadata. - Usage Data: We collect information about how you interact with our platform. This includes features accessed, time spent on the platform, completion rates, performance on tests or quizzes, and overall learning progress. It also covers technical data like your IP address, browser type, and device information. - Communication Data: We keep records of your communications with our support team or other StudyStash representatives. Purpose of Processing Specific Data Types Each type of data we collect serves a specific purpose to improve your experience and the effectiveness of our platform: - Providing Core Services: Your account information and user-generated content are essential for you to access, share, and manage study materials. This data also enables us to create personalized learning resources, such as AI-generated flashcards and mind maps, and facilitate engagement with our gamified learning features. - Personalization and Adaptive Learning: We use usage data to tailor your learning experience. This helps us identify areas where you might need more support and optimize how we deliver content to you. Improving Platform Functionality: By analyzing aggregated and anonymized usage data, we gain insights into user behavior and trends. This allows us to continuously enhance the features and overall performance of StudyStash. - Customer Support: Your communication data helps us respond efficiently to your inquiries, troubleshoot any issues you encounter, and provide timely assistance. Security and Fraud Prevention: We process certain data to ensure the security and integrity of our platform and to prevent any fraudulent activities. - Compliance with Legal Obligations: We may process personal data when required to do so by applicable laws and regulations. Disclosure to Third Parties StudyStash is committed to minimizing the disclosure of personal data to third parties. When such disclosure is necessary, it is primarily to support our core services and is always done with appropriate safeguards in place. These third parties may include: - Cloud Hosting Providers: To securely store and manage our platform's data, ensuring reliable service delivery. - Analytics Providers: These providers help us understand user behavior and improve our services, typically using aggregated or anonymized data. - Customer Support Tools: To effectively manage and respond to your inquiries. - LMS Integrations: If StudyStash is integrated with your university's Learning Management System (LMS), data may be exchanged as required for the integration to function, subject to the terms of such agreements. - Legal and Regulatory Authorities: We may disclose data if required by law, court order, or governmental request.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | StudyStash: Inactive | Live pagesha256 67bf591ab1 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is StudyStash GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
- 18 Sep 2026Subprocessor added: BetterStackBetterStack appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: CloudflareCloudflare appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: CookieChimpCookieChimp appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Customer.ioCustomer.io appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Jira Service ManagementJira Service Management appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Microsoft AzureMicrosoft Azure appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: PlanetScalePlanetScale appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: PostHogPostHog appeared on the subprocessor list.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Education category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Civitas Learning
Education
AI built on your data and designed for higher education, helping all teams drive institutional outcomes and better support every
Edpuzzle
Education
Easily create beautiful interactive video lessons for your students you can integrate right into your
Panopto
Education
At Panopto, we believe that video can have a transformative effect on
Magic School
Education
Transform teaching and learning with an AI platform built for school
Digication
Education
AI-powered platform giving institutions the assessment data, accreditation evidence, and student retention signals needed to make learning
Adaptive Security
Education
Human security for the AI
Veracross
Education
Eliminate data chaos with the leading student information system for private & independent K-12
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read