Privacy Policy

1. Who we are

Flexrep School. Contact: flexrepschool@gmail.com. For pupils who join through a school, the School is the controller of school-related data and we process it on the School's behalf; for your own account, Flexrep School is the controller.

2. Data we collect

Account data (email for seniors and teachers, username, authentication identifiers); profile data (age band, year group, exam board, subjects, target grades, exam dates, school and class membership, avatar); study content you upload (photos, PDFs, documents, text, links); usage data (quiz results, XP, streaks, topic mastery, leaderboard activity, features used); teacher and school data (name, school email, school, role, billing contact; card details are handled by Stripe and never reach us); parent contact email if you choose to add one; basic technical data (browser, device type, IP address for security); and messages sent to support.

For under-13 pupils: a generated username, year group, age band, class, picture-password credential (stored securely), learning activity and progress, and any work the school allows the pupil to upload (deleted automatically within 24 hours). If the school adds a pupil's first name to its roster, only that school's teachers can see it.

3. How and why we use it

To provide the Service (contract); to generate quizzes and feedback with AI (contract); to run leaderboards, assignments and live quizzes (contract); to share progress with your school (the school's legal basis, or our contract with you); to send emails you have opted into (consent, withdrawable at any time); to process school payments (contract); to keep the Service secure and prevent abuse (legitimate interests); to improve the Service using aggregated usage information (legitimate interests); and to meet legal obligations.

4. Children and teens

The Service is for learners aged 5 and over. Children under 13 cannot create their own accounts. Their accounts are created by a school (where the school is the data controller and we act as processor) or by a parent or guardian who gives verified consent. For under-13 accounts we collect the minimum data needed (a generated username, year group, age band, class membership, learning activity and progress) and do not require an email address, real name, phone number or address from the child. We follow the ICO Age Appropriate Design Code: high-privacy defaults, no advertising, no selling of data, no behavioural profiling, no public profiles, no free-text communication between users, no pressure-based notifications or streak penalties for children, and children cannot weaken their privacy settings. If we learn that we hold data about an under-13 without a school or parental basis, we delete it.

4A. Parents

Parents can ask their child's school, or contact us at flexrepschool@gmail.com, to see, correct or delete their child's data. Where the school is the controller we will refer requests to the school and help them respond.

5. Who we share data with

Supabase (database, authentication, storage, hosting); Anthropic (to process uploaded content to generate quizzes and feedback; not used to train their models); Stripe (school payments); an email delivery provider; and your School if you are a member. We do not sell personal data and do not use it for advertising. We do not currently use analytics or advertising trackers. We may disclose data if required by law.

6. International transfers

Where data is transferred outside the UK we rely on UK adequacy regulations, the UK IDTA/Addendum or equivalent safeguards.

7. Retention

Account and study data are kept while your account is active. Uploaded files are deleted automatically within 24 hours of processing. When you delete your account we delete your personal data within 30 days, except limited records we must keep by law (such as financial records). Backups are overwritten on a rolling basis.

8. Your rights

Under UK GDPR you can access, correct, delete, restrict or object to our use of your data and request a portable copy. You can export your data and delete your account in Settings, or email flexrepschool@gmail.com. For school-controlled data you may also contact your school. You can complain to the Information Commissioner's Office at ico.org.uk.

9. Cookies

We use only strictly necessary cookies and local storage (for login and preferences). We use no advertising or analytics cookies, so no cookie banner is needed. If this changes we will add consent controls first.

10. Security

We use encryption in transit, access controls and row-level security. No system is completely secure.

11. Leaderboards

Where your teacher has enabled them, your username, avatar, XP, streak and school name are visible to other users on leaderboards. Do not use your real name as your username.

12. Changes

We will notify you of material changes.