Privacy Policy

• Adult account data: name, email address, authentication records, role, and account preferences.
• Child profile data: an adult-chosen display name or nickname, school year group, avatar, username, and protected PIN credentials.
• Learning data: assignments, answers, scores, attempts, topic progress, active-time and session events, and reward activity used to deliver learning, provide feedback, prepare linked adult reports, support safe session operation, and improve the service in a child-safe way.
• Billing data: plan, subscription status, invoices, and payment references. Stripe handles full card details.
• Service and security data: support messages, email delivery records, device and browser information, IP address, and technical logs used to operate and protect the service.
• Public-site analytics: page path and controlled navigation or call-to-action identifiers collected by Google Analytics on public marketing pages. Server-side measurement can also record a coarse funnel milestone against the consenting adult acquisition record. It does not include a child identifier, answer, score, skill result, or profile.
• Adult campaign attribution: allowlisted Google or Microsoft click IDs, UTM values, referrer host, landing path, first-touch and last-touch timestamps, and an opaque first-party attribution key. These can be linked to parent or tutor activation, diagnostic and report milestones, trial or checkout milestones, and the first successful paid invoice.

• Contract: to create and administer an adult account, provide the subscription and support an adult requests, and process adult billing.
• Legitimate interests in providing the requested educational service: to deliver assignments and practice to a linked child, score attempts, maintain topic progress, provide parent or tutor reports, and keep the learning experience consistent. We balance these interests against the child's rights and apply protective defaults and data minimisation.
• Legitimate interests in safety and service quality: to protect accounts, investigate safeguarding or security concerns, prevent abuse, diagnose faults, measure reliability, and improve the learning service using data that is aggregated, pseudonymised, or otherwise minimised where practical.
• Legitimate interests in understanding adult acquisition: to assess aggregate funnel performance, control campaign spend, and prevent duplicate conversion reporting. Optional browser storage and identifiable provider measurement are activated only after the adult visitor's consent.
• Legal obligation: to keep required financial records and respond to valid legal requests.
• Consent: for adult marketing messages where consent is the appropriate basis. Consent can be withdrawn.

We do not sell personal data. We do not use child learning data for advertising, unrelated profiling, or public-site Google Analytics, and we do not ask children to provide an email address or phone number.

A parent or tutor creates every learner profile. We aim to collect only the data needed to provide age-appropriate learning, progress and linked-adult reporting, session safety, and tightly scoped service improvement. Privacy settings are protective by default, and the child experience has no advertising or social messaging. Adults can manage or request deletion of the profiles they control.

We assess child-data features against the UK Information Commissioner's Children's code. More detail about the product design is available on our Safeguarding page and GDPR page.

Essential browser storage keeps accounts signed in, preserves short-lived learning state, protects sign-up, and supports checkout. Google Analytics loads on public marketing pages only. It does not load on learner, parent, tutor, sign-in, sign-up, or token routes, and its personalized advertising remains disabled. A separate opaque API cookie can link allowlisted campaign fields to coarse funnel milestones against the adult acquisition record. Provider events can identify the kind and time of a milestone, including diagnostic completion, but do not contain child names, email addresses, learner identifiers, answers, scores, skills, progress, or diagnostic results.

See the Cookie Policy for the current browser-storage details.

We share data only when needed to run the service, comply with law, protect users, or follow your direction. Stripe receives adult checkout and payment information; Resend handles account and service email; Cloudflare hosts public web content and processes Turnstile anti-abuse checks; Google Cloud provides infrastructure and database hosting; Google Analytics receives controlled public-site events; and error-monitoring services receive technical fault context. Where an advertising conversion connector is configured, Google Analytics or Microsoft Advertising can receive a consented measurement identifier or matching click identifier plus a coarse conversion name, time, opaque order reference, currency, and value. Each provider receives only the data needed for its role.

Some providers may process data outside the UK. Where UK data-protection law requires it, we use an approved transfer mechanism or rely on an applicable adequacy regulation.

We keep adult accounts, child profiles, and core learning records while needed to provide the service, preserve requested progress history, resolve disputes, protect users, and meet legal obligations. Our current automated schedule keeps raw trace and session events for 90 days, learning decision logs for 180 days, and result summaries and mastery snapshots for up to 1,095 days. Raw campaign touch records are kept for up to 90 days. Linked attribution identities and browser measurement context are anonymised after 90 days; durable adult conversion and delivery records can be kept with billing and audit records. A failed telemetry delivery can also be buffered in first-party browser storage for up to 3 days, as explained in the Cookie Policy. Billing and audit records may be kept longer where financial-record or dispute rules require it.

When information is no longer needed, we delete or anonymise it. An account-deletion request does not override a legal duty to retain a limited billing, security, or dispute record.

We use access controls, protected credentials, encryption in transit, backups, monitoring, and data-minimisation practices. No online service can promise absolute security.

Depending on the circumstances, UK data-protection law may let you:

• Ask for a copy of personal data about you or a child profile you control.
• Correct inaccurate or incomplete data.
• Ask for deletion or restriction of processing.
• Object to processing based on legitimate interests.
• Receive certain data in a portable format.
• Withdraw consent where processing relies on consent.

To make a request, email [email protected]. We may need to confirm your identity and your authority over a child profile.

Please contact us first so we can investigate a concern. You can also complain to the UK Information Commissioner's Office at ico.org.uk.

We may update this policy when the service, providers, or law changes. The effective date at the top shows when this version took effect.