Last updated: 1 July 2026 · Effective date: 1 July 2026
Section 1
Who We Are and How to Contact Us
GradeMastery operates as an educational technology service. We are the data controller for personal data processed through this platform — meaning we determine the purposes and means of processing.
Contact:hello@grademastery.co.uk Data subject requests: use subject line "Data Subject Request" ICO registration: [To be completed on ICO registration]
If you have concerns about how we handle your data, you can also contact the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Section 2
Data We Collect and Why
Category
What we collect
Why
Legal basis
Account data
Display name, email address, year group, school (if applicable)
To create and manage your account
Contract
Learning data
Flashcard responses, grades (Again / Hard / Good / Easy), study history, Brain Dump content, AI Tutor conversations, card progress, mastery percentages
To power spaced repetition, track progress, and personalise your learning
Contract; Legitimate interests
Personalisation data
Target grade, dream job, learning preferences, study blockers (if you choose to provide these)
To personalise the AI Tutor and Learning Coach to your needs
Consent — you can update or delete this at any time in your profile settings
Technical data
Device type, browser, IP address, usage logs, session data
Security, debugging, and ensuring the Service works correctly
Legitimate interests
Payment data
We do not store card details. Stripe provides us with transaction confirmation only.
To process your subscription
Contract
Communications
Emails and support messages you send us
To respond to you and improve our service
Legitimate interests
We collect only what is necessary. We do not collect geolocation data.
Section 3
Children's Data — Special Protections
This section is especially important. GradeMastery serves students from Year 7 (age 11) upwards. We comply with the ICO Age Appropriate Design Code (Children's Code) and treat the protection of younger users as a primary responsibility.
Age and consent
Users under 13 cannot self-register. A parent, guardian, or school must create the account on their behalf.
Users aged 13–17 should have parental or guardian awareness of their use.
Where parent accounts are linked to student accounts, parents can view their child's progress data through the parent portal.
We recommend schools obtain parental consent before adding students to GradeMastery class accounts.
What we do with under-13 data
We process under-13 data only to the minimum extent necessary to provide the educational service.
No marketing communications will be sent to under-13 users.
AI personalisation for under-13 users is limited to what is strictly necessary for learning — no broader profiling.
Under-13 data is never used for any commercial purpose.
AI Tutor interactions for under-13 users are subject to additional content filtering.
Parents can request complete deletion of their child's data at any time.
What we do not do with any under-18 data
We do not use children's or teenagers' data for commercial profiling or targeting.
We do not share children's data with advertisers.
We do not use dark patterns or nudge techniques designed to lead children to share more personal data than they need to.
We do not use children's data to train AI models for any purpose beyond providing the Service.
We do not collect geolocation data from any user.
ICO Children's Code — our commitments
The best interests of the child are a primary consideration in all design decisions.
Data minimisation — we collect only what is necessary to provide the service.
No profiling of children for commercial purposes.
No use of children's data to target advertising.
Geolocation data is never collected.
Parental controls are available through the parent portal.
Children and young people can ask us to stop processing their data at any time.
All default privacy settings for under-18 users are set to the most privacy-protective options.
We conduct a Children's Code compliance review annually.
Section 4
Who We Share Data With
We do not sell your personal data. We never have and never will.
4.1 Service providers (data processors)
These companies process data on our behalf under our instructions:
Supabase Inc — database storage and authentication. Data held in EU/US data centres; standard contractual clauses apply. Privacy policy →
Anthropic PBC — AI processing for tutoring and marking features. US-based; standard contractual clauses apply. Privacy policy →
Cloudflare Inc — infrastructure and CDN. US-based; standard contractual clauses apply. Privacy policy →
If a parent account is linked to yours, they can see:
Your overall progress and mastery data
Your daily card completion
Your streak
4.4 Legal requirements
We may disclose data where required by law, court order, or to protect the safety of users or the public. We will tell you if we are legally required to share your data, unless we are prohibited from doing so.
Section 5
International Data Transfers
Some of our service providers are based outside the UK, primarily in the United States. Where we transfer data internationally, we ensure appropriate safeguards are in place, including:
Standard Contractual Clauses approved by the ICO
Adequacy decisions where applicable
Data Processing Agreements with all processors
You can request details of the specific safeguards in place for any transfer by emailing hello@grademastery.co.uk.
Section 6
How Long We Keep Your Data
Data type
Retention period
Reason
Account data
Until account deletion, plus 30 days for backup recovery
To provide the Service and allow account recovery
Learning data
Until account deletion
To maintain your progress history
Payment records
7 years
Legal requirement for financial records
Support communications
2 years
To resolve recurring issues and improve service quality
Technical logs
90 days
Security monitoring and debugging
After your account is deleted, we remove all personal data within 30 days, except where we are legally required to retain it (such as payment records).
Section 7
Your Rights Under UK GDPR
Under UK GDPR and the Data Protection Act 2018, you have the following rights:
AccessRequest a copy of all personal data we hold about you.
RectificationAsk us to correct inaccurate or incomplete data.
ErasureRequest deletion of your data — the "right to be forgotten".
PortabilityReceive your data in a machine-readable format to transfer elsewhere.
RestrictionAsk us to limit how we process your data while a dispute is resolved.
ObjectObject to processing based on legitimate interests.
Withdraw consentWhere processing is based on consent, withdraw it at any time — this does not affect past processing.
ComplaintsLodge a complaint with the ICO if you are unhappy with our response.
To exercise any of these rights, email hello@grademastery.co.uk with the subject line "Data Subject Request". We will respond within 30 days. There is no charge for making a request.
Parents exercising rights on behalf of children
Parents and guardians may exercise these rights on behalf of their child. We may ask for reasonable proof that you are the child's parent or guardian before responding.
If you are unhappy with our response
You have the right to complain to the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would always prefer the chance to address your concern directly first.
Section 8
Cookies and Local Storage
We use browser local storage — not traditional third-party cookies — for the following purposes:
Session management: keeping you logged in between visits
Preferences: remembering settings such as dark mode and view preferences
Performance: storing your card progress locally so the app loads faster
We do not use advertising cookies, third-party tracking cookies, or any technology designed to follow you across other websites.
You can clear local storage at any time through your browser settings. This will log you out of the Service and reset local preferences.
Section 9
AI and Your Data
Our AI features (AI Tutor, Smart Grading AI, AI Learning Coach) are powered by Anthropic's Claude API. Here is how your data is handled when you use them:
Your inputs are sent to Anthropic's API for processing. Anthropic does not store your conversations for model training beyond what their standard API terms provide.
AI conversations are stored in our own database to maintain context within your session and to allow the Learning Coach to identify patterns in your progress over time.
You can request deletion of your AI conversation history at any time by emailing hello@grademastery.co.uk.
We do not use your AI conversations to train our own models or to share with third parties beyond those named in this policy.
For under-13 users, AI interactions are subject to additional content filtering and stricter data minimisation.
For full details of how Anthropic handles data, see their privacy policy at anthropic.com/privacy.
Section 10
Security
We take a layered approach to security:
Encryption in transit: all data is transmitted over HTTPS. We enforce HTTPS on all connections.
Row Level Security: our database uses Supabase Row Level Security (RLS) — each user can only access their own data, enforced at the database layer.
Payment security: payment processing is handled entirely by Stripe. We never see, store, or transmit your card details.
Access controls: access to production systems is restricted to authorised personnel only.
Regular reviews: we conduct periodic security reviews of our infrastructure and code.
No system is completely secure. If you believe you have found a security vulnerability, please report it responsibly to hello@grademastery.co.uk and we will investigate promptly.
Section 11
Changes to This Policy
We will notify you of significant changes to this Privacy Policy by email (if you have provided one) and by displaying a notice on the platform when you next log in. The "Last Updated" date at the top of this page always reflects the most recent version.
Minor changes — such as clarifications that do not affect how we process your data — may be made without direct notification. We encourage you to review this policy periodically.