DRAFT for review: not yet in force, and not legal advice.
This page was drafted to help you get started. Have it checked (ideally by a solicitor), fill in every part in [square brackets], then remove this notice.
Privacy Policy
Last updated: [date]
The short version (for students)
- You don’t need an account for past papers or topic lists.
- If you make an account, we only ask for your email address and, if you want, a first name or nickname.
- We use your information to run your account, save your work and show your teacher the work they set you.
- We don’t show adverts, we don’t track you around the internet, and we never sell your information.
- You can delete your account, and everything saved with it, at any time from your account page.
- If you’re worried about anything, talk to a parent, carer or teacher, or email us at hello@examonaut.co.uk.
1. Who we are
Examonaut is run by [Your company or trading name], [Your postal address] (“we”, “us”). We are the data controller for the personal data described here. Our ICO registration number is [ICO registration number]. You can contact us about privacy at hello@examonaut.co.uk.
2. Children and young people
Many of our users are under 18. We have designed the site with the ICO’s Children’s Code in mind:
- Privacy is set high by default. There are no public profiles, no messaging between students and no sharing settings.
- We collect the least data we need. We don’t ask for a date of birth, school, address or photo.
- We don’t profile users, show adverts, use third-party tracking or analytics, or sell or share data for marketing.
- We don’t use design tricks to make you share more data or stay on the site longer.
- Teachers only see work from students in their own classes. Students only see their own work.
If you are under 13, please ask a parent or carer before creating an account, or use the account your school or teacher asks you to make. Payments must be made by an adult. [Review: decide whether to require parental confirmation for under-13s.]
3. What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Email address, optional display name, and your password (stored only as a secure one-way hash) | To create your account, let you sign in, and send account emails (confirming your email, resetting your password) | Contract (providing the service you asked for) |
| If you sign in with Google: your Google account ID, email address and first name | To sign you in. We don’t keep Google’s access tokens or your profile picture. | Contract |
| Practice papers you generate, quiz answers and scores, and your progress by topic | To save your work and show your progress | Contract |
| Classes you join, work your teacher sets, your answers, marks and teacher comments | To let your teacher set and mark work for your class | Contract; for school licences, also our school’s legitimate interests or public task [review per school agreement] |
| Subscription details: plan, status and renewal dates, and a customer reference from our payment provider | To provide Premium. Card details are handled by Stripe and never reach us. | Contract; legal obligation (tax records) |
| For teachers: the schools you join with a staff code | To give you access through your school’s licence | Contract |
| School quote requests: school name, contact name, work email, package and number of students | To reply with a quote | Legitimate interests (responding to your enquiry) |
| Security records: your email address and IP address when you sign in, sign up or request emails | To stop people guessing passwords or sending spam. Deleted after 24 hours. | Legitimate interests (keeping accounts secure) |
| Error reports about the site (what broke, on which page, your browser type) | To fix problems. They contain no names, emails, IP addresses or answers. | Legitimate interests (keeping the site working) |
4. Who we share data with
We only share data with companies that help us run the site, under contracts that protect it:
- Supabase: our database and file storage. [Region: confirm, e.g. London (eu-west-2).]
- Vercel: hosts the website.
- Stripe: takes payments for Premium (Stripe is also responsible for the card data it collects).
- Resend: sends account emails.
- Google: only if you choose “Sign in with Google”.
- Sentry: error reports, with personal data removed. [Region: confirm, e.g. EU.]
Some of these providers may process data outside the UK. Where they do, we rely on the UK’s adequacy regulations or the International Data Transfer Addendum / Agreement. [Review each provider’s terms and region.]
Teachers in your class can see your name or email, your answers, marks and progress for the work they set. Nobody else can.
5. How long we keep data
- Your account and saved work: until you delete your account (or it has been inactive for [2 years], when we [delete it / ask you first]).
- When you leave a class, your work for that class is deleted.
- Security records: 24 hours.
- Payment and invoice records: 6 years, as UK tax law requires (held by Stripe and us).
- Backups: up to [7] days after deletion.
- Error reports: [90] days.
6. Cookies
We only use cookies that are needed to keep you signed in and secure. See our Cookie notice.
7. Your rights
You (or your parent or carer, if you are a child) can:
- get a copy of your data, and have it corrected;
- delete your account at any time from your account page (this deletes your saved work too);
- object to, or ask us to limit, how we use your data;
- ask for your data in a format you can take elsewhere.
Email hello@examonaut.co.uk. We will reply within one month. If you’re unhappy with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.
8. Keeping data safe
Connections are encrypted, passwords are stored as one-way hashes, sign-in attempts are rate limited, and only authorised staff can reach the admin area. If something went wrong with your data, we would tell you and the ICO where the law requires.
9. Changes
If we change this policy in a way that matters, we’ll tell you on the site and, for big changes, by email.