Privacy Policy

Who we are

Edumate Grow is a calm 11+ preparation app for children, built by a qualified teacher. This policy explains, in plain English, what personal information we collect, why, and what choices you have. We've tried to keep it honest and readable rather than full of legal hedging.

The data controller is Edumate Ltd ("we", "us", "our"), a company registered in England and Wales, company number 17277398, registered office 18 The Broadway, East Lane, Wembley, Middlesex, HA9 8JU. "Data controller" means we are responsible for deciding how and why your information is used. We are registered with the Information Commissioner's Office (registration reference ZC195271).

For any privacy question, or to exercise your rights, write to us at privacy@edumateuk.com.

What's covered by this policy

Edumate has two parts, and this policy covers both:

• The waitlist (live now). If you join our waitlist on edumateuk.com, we collect your email address so we can let you know when we launch.
• The Edumate Grow app (coming soon). When the app launches, parents will create an account and set up profiles for their children. The sections below describe how that will work, written in the future tense because the app isn't open to families yet.

Our lawful bases, in plain English

UK data protection law requires us to have a "lawful basis" for using your information. Here is what we rely on, and why:

• Sending you waitlist updates: your consent.
• Running parent accounts and child profiles: performing our contract with you.
• Providing learning activities, progress tracking and the parent dashboard: performing our contract with you.
• Improving, testing and securing the service: our legitimate interests, balanced against your and your child's rights.
• Payment records (once subscriptions launch): contract, and legal obligation.
• Preventing fraud and keeping the service secure: our legitimate interests.
• Handling privacy requests and keeping required records: legal obligation.
• Free family place requests: consent or contract, depending on the route.

The waitlist

If you join the waitlist, we collect your email address only. We use it to contact you about Edumate Grow (launch updates, early access, and your place on the waitlist) and to confirm you've joined. We won't bombard you, and we won't send you anyone else's marketing.

We do not sell your email or share it for anyone else's marketing. We use Resend to send emails for us (see "The companies that help us" below).

Lawful basis: your consent. You can ask us to remove you at any time by writing to privacy@edumateuk.com.

Using Edumate Grow (when it launches)

The parent account

Edumate is set up to be parent-led: an adult creates and controls the account. When you create one, we will store:

• Your email address (used to sign you in securely by a one-time link).
• An optional parent PIN, stored only as a secure one-way "hash" (see "PINs" below), never the PIN itself.
• A flag noting whether you've completed setup, and the dates your account was created and updated.

We will not collect your name, phone number, postal address, or any marketing profile directly for your Edumate account, although, if you subscribe, Stripe may collect billing details (such as your billing name) directly (see "Payment information" below).

Your child's profile

Children's privacy matters to us, and the app is designed around protecting it. For each child you set up, we will store:

• A nickname, never their real name. Children are identified in the app by a nickname only.
• Their year group (Year 1 to 6), not a date of birth or age, just the school year, so we show suitable content.
• A general area/region: a coarse area (not a precise location), used to show the right regional content.
• A learning goal, and cosmetic items they earn in the app (theme, avatar, coins, points).
• Accessibility preferences: simple on/off settings to make the app easier to use. These are preferences only; we do not collect or infer any diagnosis or health information.
• A picture-PIN, stored only as a secure hash (see below).
• Their learning progress and stats (see "Learning information").

What we never ask for about a child: the child profile does not ask for, and does not store, a child's real name, date of birth, exact age, address, school, or photograph. Please don't include those details in messages to us.

PINs

Both parent and child PINs are stored only as a secure, one-way "hash" (using bcrypt). In plain terms: we keep a scrambled version that lets us check a PIN is correct, but the actual PIN is never stored, never written to our logs, and cannot be read back or recovered, not even by us. PINs are only ever set and checked through controlled server functions.

Learning information

As a child uses the app, we will record information about their learning so the app can support them and so you can see how they're getting on:

• Their answers to practice questions and the pace of their practice.
• How they use the support tools and the Calm Coach.
• Self-reported confidence check-ins and practice "sprint" results.
• A progress and score summary shown on their profile.

This is practice information, used to help learning, not exam results. Where we describe a "test" experience, it produces a practice readiness picture for you as a parent, not a formal record held about your child.

The Calm Coach and AI, in plain terms

Because Edumate involves a friendly in-app guide (the "Calm Coach"), and because parents rightly want to know what that means for their child's data, here is exactly how it works at launch:

• At launch, nothing your child types or does is sent to any AI company. The Coach gives pre-written, carefully bounded guidance (a fixed bank of helpful lines and simple rules), not free text to an external AI.
• We do not use your child's information to train AI models. Full stop.
• At launch, the app makes no outbound AI calls. It connects only to our own secure backend; there is no external AI service involved in running it.
• No microphone. The Coach's voice is pre-recorded audio played on the device. The app does not listen to your child.
• For full honesty: the Coach's voice recordings were created when we built the app using an AI voice tool, based on the founder's own voice. This happened once, during development, using no child or user data; it is not part of the running app.

If this ever changes: if we introduce optional, AI-supported guidance in the future, we will update this policy before we do so, explain clearly what changes, and give parents control before any optional AI-supported guidance is enabled. We will never quietly start sending your child's information to an AI service.

How we protect children

Edumate is designed with children's privacy at its centre, in line with the UK's Age Appropriate Design Code (the "Children's Code"). In practice that means:

• Accounts are created and controlled by a parent or guardian, not by children.
• Children are identified by nickname only, never a real name or public identity.
• We collect the least information we can. Child profiles do not ask for or store a child's real name, date of birth, exact age, address, school or photograph.
• We never show advertising to children, and we don't profile children for marketing.
• Settings default to the most private, child-friendly option.

The companies that help us run Edumate

We use a small number of trusted service providers to run Edumate. They process data on our behalf, under contract, and only for the purposes below. We do not sell your data to anyone.

• Resend: sends our emails (the waitlist email today, and the secure sign-in link when the app launches).
• Supabase: will store the app's data and handle secure sign-in. Data is hosted in the European Union.
• Vercel: hosts the website and the app, and provides our privacy-friendly website analytics.
• Stripe (when paid subscriptions launch): will handle payments securely. Payments are not live yet.

Payment information: when subscriptions launch, Stripe handles payment information and may collect billing details directly from you (such as your billing name and card details). We do not see or store full card details. We may receive limited payment information, such as payment status, subscription status, invoice history, and the last four digits of a card, where needed for account support.

Analytics: we don't use third-party advertising or analytics trackers in the app. The website uses Vercel Web Analytics, which does not use cookies, does not collect personal identifiers, and does not track visitors across other sites. It records anonymous information such as pages visited, referrers, approximate country or region, device type and browser. The data it records is anonymous and is not tied to you or your child.

Where your information is processed

We aim to keep data within the UK or the European Economic Area (EEA). Some of our providers may process data outside the UK or EEA. Where that happens, we use the appropriate safeguards required by UK data protection law to keep your information protected.

Our app data is hosted in the European Union. Some of our providers are based in, or may process limited data in, the United States. Where data is transferred outside the UK or the EEA, we rely on the appropriate safeguards required by UK data protection law, such as the providers' own data-protection terms and UK-recognised transfer mechanisms, to keep your information protected.

How long we keep information

• Waitlist: we keep your email until we launch and have contacted you, or until you ask us to remove it, whichever comes first.
• App data: we keep your account and your children's information for as long as your account is open. We intend to reduce detailed activity records to anonymous summaries after up to 12 months.
• After you close your account: we delete your personal information within 28 calendar days, normally sooner, except anything we must keep by law (for example, basic payment records once subscriptions launch).
• Inactive accounts: we plan to introduce a 24-month inactivity process, with a warning email before any deletion. Until that process is built and verified, unused accounts are kept until you delete them or ask us to close your account.

Your choices and your rights

Under UK data protection law you have rights over your information, and over your children's information as their parent or guardian. You can:

• See it: the parent dashboard shows your children's information; you can also ask us for a copy.
• Export it: you can ask us for a copy of your data, and (where the in-app download is available) export it yourself from the app as a file.
• Delete a child's profile: you can delete any child profile from within the app, after a confirmation step. When you do, we remove it from the active app and it cannot be restored by you. Backup copies, if any, expire in line with our normal backup cycle; we do not keep a separate hidden profile for ongoing use.
• Close your account and delete everything: write to privacy@edumateuk.com and we'll delete your account and all associated data within 28 calendar days, normally sooner (subject to anything we must keep by law).
• Correct anything that's wrong, object to certain uses, or withdraw consent: just ask.

To exercise any of these, or if you're unhappy with how we've handled your data, contact privacy@edumateuk.com. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk, though we'd be grateful for the chance to put things right first.

Free family places

If you contact us about a free family place, please share only the information we ask for; there's no need to send detailed personal or financial circumstances. We'll only use what you send to consider and administer your request. Write to access@edumateuk.com.

Changes to this policy

As Edumate grows, in particular when the app and paid subscriptions launch, we'll update this policy to keep it accurate. When we make significant changes, we'll update the date at the top and, where appropriate, let you know.

Contact us

Questions about this policy or your data: privacy@edumateuk.com. General enquiries: hello@edumateuk.com.

Edumate Ltd, registered in England and Wales, company number 17277398. Registered office: 18 The Broadway, East Lane, Wembley, Middlesex, HA9 8JU.