Legal
Privacy Policy
What Studio collects, what it does with it, which companies touch it on the way, how long it is kept, and how to get a copy or have it deleted.
- Last updated
- November 5, 2026
- Effective
- November 5, 2026
- Who you are dealing with
- Jeremy Bolls, a sole proprietor doing business as Bolls, with a mailing address at PO Box 2865, Brentwood, TN 37024
- Contact
- hello@stu.now
01
Who this is about
Studio is run by Jeremy Bolls, a sole proprietor doing business as Bolls, with a mailing address at PO Box 2865, Brentwood, TN 37024. This policy covers the site at stu.now and the product at studio.stu.now, and no other product.
If you use a workspace somebody else owns, the content in it is theirs. We handle it for them, and a request about it goes to them first.
02
What we collect
- Account details
- Your name, your work email, which workspace you belong to, and your role in it. Signing in is a link sent to your email, so there is no password for us to hold.
- What you put in
- The goals, sources, voices, briefs, drafts, approvals and published pieces you create, and the notes and files you attach to them.
- Connections
- The tokens and API keys you connect so the product can draft or publish for you. They are encrypted at rest and read back only as whether a key is set and its last four characters.
- Billing details
- Your plan, the state of your subscription, and the customer record Stripe keeps for you. Card numbers go to Stripe and never reach us.
- Usage and model records
- What ran, when it ran, which model it called, what that call cost, and the decisions people made. This is how a workspace's budget is metered and how a run can be read back later.
- Technical records
- The request details our hosting provider logs, including an IP address, kept for security and for finding problems.
03
How we use it
- To run the product: plan, research, draft, check, schedule and publish what somebody approves.
- To sign you in, and to keep your workspace separate from everybody else's.
- To bill you, and to meter your workspace's monthly model budget.
- To answer you when you write to us.
- To keep the service working and secure, and to find and fix what is broken.
- To meet an obligation the law puts on us.
We do not sell your personal information. We do not share it for advertising, and we do not use your content to train AI models of our own.
04
AI processing
Drafting sends your prompt, the sources behind it and the draft itself to Anthropic, because a model has to read them to write. A workspace uses our Anthropic key or adds one of its own, and a workspace on its own key is billed by Anthropic directly.
Citation checks and the panel that measures what answer engines say run on our own keys, not yours. A check sends the question being asked and looks for your site in the answer; the panel sends the questions a workspace is measured on.
A model's answer is a draft and it can be wrong. Nothing is scheduled or published until somebody with the approver role approves it.
Every model call is recorded against its workspace, and a call an agent makes is also recorded against its run, so what was asked for and what it cost are both readable afterward.
05
Who processes it for us
These companies handle data on our behalf, on our own accounts. Each one gets only what its job needs.
- Vercel
- Hosting for this site and for the product, and the request logs that come with it.
- Neon
- The Postgres database where workspaces, content and records are stored.
- Stripe
- Checkout, subscriptions, invoices and the customer portal. Card details go to Stripe rather than to us.
- Resend
- Transactional email: a sign-in link, an invitation, or a digest to a workspace's owner.
- Anthropic
- The model provider behind drafting and the checks that run on a draft.
- Perplexity
- Citation checks, and the panel that measures what answer engines say. Both on our key.
- DataForSEO
- Search data on our account: keyword and volume figures, rank tracking, mentions, and the answer-engine panel. Every plan uses it, the free one included, so a search term you research is sent there.
- Google Fonts
- The product's web fonts are loaded from Google, so Google sees the request your browser makes for them. This marketing site serves its fonts itself.
- Linear and GitHub
- Where a bug report you send with the in-app reporter may be filed as an issue, in our own accounts. The reporter is its own section below.
There is no advertising network and no analytics product in that list, because neither this site nor the product loads one. We update this list when it changes.
06
Services you connect
These are yours. You connect each one with your own account or credential, we send it only what you ask us to, and that company's own terms apply to what it does next.
- Buffer
- Publishing an approved post to LinkedIn, X or Substack Notes, through the account you connect.
- GitHub
- Opening a pull request in your own repository for an approved article, for a workspace that publishes that way.
- WordPress, Webflow and HubSpot
- Creating or updating a post on your own site, for a workspace that publishes to one of them.
- Profound, PromptWatch and Otterly
- Answer-engine visibility measurement, for a workspace that connects one of them with its own credential.
07
The bug reporter in the product
The product carries a button for telling us something is broken. Pressing it captures what was true at that moment, so that a bug can be fixed from the report rather than from a conversation.
- A screenshot of the screen you are looking at, which can therefore hold whatever was on it.
- The recent requests the page made, as addresses, statuses and timings. No request or response body is recorded.
- The console output the page produced, and what you pressed and in what order.
- The page's address and the exact version of the product you were running.
A recorder runs in your browser from the moment a page loads, which is the only way the request that failed before you pressed is still there to report. It keeps a short rolling buffer locally, strips values shaped like credentials before they reach it, and sends nothing anywhere until you press the button.
When you do press, you see the screenshot before it goes. The report is then scrubbed on our server for anything that still looks like a secret, written up as a brief, and may be filed as an issue in our own Linear or GitHub so that somebody can work on it.
09
How long we keep it
Your content stays while your workspace does. The record of what ran, what was decided and what was spent is kept as that workspace's history, and a correction is a new row rather than an edit, so what was there before stays readable.
Billing records are kept as long as tax and accounting rules require.
Server logs are short lived, on our hosting provider's own schedule.
There is no delete button for a workspace. Write to hello@stu.now and we delete it and the content in it within 30 days, then confirm. Copies sitting in our database provider's backups age out on that provider's schedule.
10
Getting a copy, or having it deleted
Write to hello@stu.now from the address on your account. You can ask for a copy of what we hold about you, a correction to it, or its deletion. A deletion is something we carry out for you: the product has no delete button for a workspace.
We answer within 30 days. If we need longer we say so, and why.
Some records have to stay even after a deletion, an invoice being the usual one. We tell you which ones and why.
An owner or an admin can make a request for their workspace. If you are a member of somebody else's workspace, ask them, because the content is theirs.
11
Security
The parts of the product's own security page that are about your data:
- Membership is checked: Every request checks that the person signed in is a member of the workspace.
- Credentials stay sealed: The publishing tokens and model keys you connect are encrypted at rest, used only on the server, and shown back as their last four characters.
- Everything is on the record: Runs, decisions and outcomes are written down as they happen, and a correction is a new row rather than an edit.
No system is perfectly secure, and we claim no certification and no compliance program. If something happens that affects your data, we tell you.
12
Children
Studio is not for children. You have to be at least 16 to use it, we do not knowingly collect anything from anybody younger, and if we learn that we have, we delete it.
13
Where this applies
We sell and run Studio in the United States only, and your data is processed there by us. Some of the companies above operate in other countries as part of their own service.
If you are outside the United States, Studio is not being offered to you today.
14
Changes to this policy
We can change this policy. The date at the top says when it last changed, and the version on this page is the one in force.
If a change matters, for example a new kind of data or a new reason for using it, we email the address on your account at least 14 days before it takes effect.
15
Contact
Email hello@stu.now with anything about this policy, or about your data.
By mail:
Bolls (Jeremy Bolls, sole proprietor)PO Box 2865Brentwood, TN 37024Last updated: November 5, 2026. Questions about this document go to hello@stu.now.