Privacy notice

Template: have this checked by a solicitor and fill in the [bracketed] details before launch.

Last updated: [date]. The data controller is [legal name], [address]. ICO registration number: [number]. Contact: [privacy email].

What we collect

• Account details: the parent's name and email address. There are no passwords: you sign in with a one-time link or code sent to your email.
• Practice results: the answers submitted, scores, time taken and dates.
• Activity log: when you sign up, log in, buy, use a free-place code, and open or submit a paper. We use it to help with support questions and refund requests, and to keep accounts secure. It contains no card details or IP addresses.
• Payment records: Stripe's payment reference, the amount and the date. Card details are collected and held by Stripe, never by us.

We do not ask for a child's name, date of birth, school or photo. Please do not enter them.

Why we use it (lawful basis)

To provide the service you've paid for (contract), to keep the service secure and prevent account sharing (legitimate interests), and to keep accounting records (legal obligation). We do not sell your data or use it for advertising.

Who we share it with

Stripe (payments); Cloudflare (hosting: the website runs on Cloudflare's network, and your account and results are stored in a database kept in the European Union); Resend (sends the sign-in emails); and Google Fonts (font files are loaded from Google's servers, which receive your IP address). Each is bound by a data processing agreement.

How long we keep it

Account and results data are kept while your account is open, and deleted within 30 days of your asking us to close it. Payment records are kept for 6 years for tax purposes.

Cookies

We use one strictly necessary cookie to keep you logged in. Your in-progress answers are saved in your browser's local storage so they aren't lost. We use no analytics or advertising cookies.

Your rights

You can ask to see, correct, export or delete your data by emailing [privacy email]. You can also complain to the Information Commissioner's Office (ico.org.uk).