Privacy notice

This notice explains what personal data UpperGrades collects, why, who we share it with, how long we keep it, and your rights. Most of our students are 14 to 16 years old, so we collect as little as we can, and we never use anyone's data for advertising.

If you're a student, there's a short version for you in section 1.

Contents

1. For students: the short version
2. Who we are
3. What we collect, and why
4. AI marking
5. How practice uses answers
6. Who can see a student's progress
7. Who helps us process data
8. How long we keep data
9. Emails
10. Your rights
11. Schools
12. Security
13. Cookies
14. Changes to this notice
15. Complaints

1. For students: the short version

• What we know about you: your name, your username, and how you get on with lessons and questions. If your teacher added you, we also know your school email address. Your PIN is scrambled, so not even we can read it.
• Who can see your progress: your parent, if they set up your account, and teachers of the groups you're in. They can see which lessons you've done, your scores, and which topics you've got secure. Nobody else can.
• Other students can't see anything about you. There's no chat or messaging in UpperGrades.
• Longer written answers are marked by AI. We send your answer, but not your name, to Google's AI to mark it. Don't put personal details in your answers. The AI can make mistakes, so treat its marks as a guide.
• We never show adverts, sell your data, or email you about UpperGrades.
• If you want to know what we hold about you, or want something deleted, ask your parent or teacher, or email us at [CONTACT EMAIL].

2. Who we are

UpperGrades is run by Upper Grades Limited, a company registered in England and Wales (company number 17474027), whose registered office is at Unit 29 Highcroft Industrial Estate, Enterprise Road, Horndean, Waterlooville, PO8 0BT. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO NUMBER].

For accounts created by a parent, a teacher who signs up themselves, and everyone else described in this notice, we are the data controller. For students added by a school, the school is the controller and we process their data on the school's behalf (see section 11).

Contact us about anything in this notice at [CONTACT EMAIL].

3. What we collect, and why

We don't ask for dates of birth, photos, locations or profiles, and we don't collect sensitive information (such as health, ethnicity or religion) on purpose.

The free games, the binary and hex assessment and the sample lesson need no account and collect nothing about you.

4. AI marking

Longer written answers are marked by an AI model (Google's Gemini) against the exam board's mark scheme. For those questions only, we send the student's typed answer and the mark scheme to Google. We don't send the student's name, username or email address with it.

The mark is feedback to help with revision. It has no legal or similarly significant effect on anyone, and a person can always look at it again: if you think a mark is wrong, tell us.

AI marking can make mistakes. Students should not put personal details into their answers.

[ADVISER TO CONFIRM: that the Gemini API is used on a paid tier whose terms don't allow Google to use the content to improve its products, where it processes the data, and the UK transfer mechanism. See DPIA action A4.]

5. How practice uses answers

Practice chooses each question from how well the student has been answering, and moves them on to a new topic when they show they understand the current one. To do this, we record each practice answer and how good it was, and keep a running picture of which topics the student has got secure.

We use that picture only to choose questions, to decide when a topic comes back for review, and to show progress to the student's parent and teacher. It is not used for advertising, and it is not a grade or an exam prediction. There is no timer and no ranking against other students.

6. Who can see a student's progress

• A parent sees their own children's progress, including which topics are secure, and nobody else's.
• A teacher or tutor sees only the students in the groups they've been added to as staff: how much they have completed, their scores, which topics are secure, and when they last used UpperGrades. Other teachers can't see those groups.
• Students can't see other students. There is no chat, messaging, profile or sharing between students.

7. Who helps us process data

UpperGrades runs on Microsoft Azure in the UK South region. Data is encrypted in transit and at rest.

These services also handle data for us. Each receives only what it needs.

Stripe is an independent controller of the payment information it collects, under its own privacy policy.

[ADVISER TO CONFIRM: which of these services process data outside the UK, and the safeguard used for each (for example the UK International Data Transfer Agreement, the UK Extension to the EU–US Data Privacy Framework, or adequacy). DPIA action A5.]

We never sell personal data, and we don't share it with anyone else unless the law requires us to.

8. How long we keep data

We check every day for data past these periods and delete it automatically. Each deletion is recorded, with no personal details in the record, so we can show that we keep to these periods. To have your data deleted sooner, ask us (see section 10).

9. Emails

• Sign-in links and result links are sent because you asked for them.
• Mailing list: we only send news and tips if you tick the box to say yes, and every email has a link to stop them.
• We never email students, even when a teacher has entered a student's school email address.
• One-to-one emails: when we email you personally (for example a teacher or a school we've been in touch with), the links to our own website in the email are tracked. We record when a link is clicked, and whether you then sign up or ask us something, so we can see which emails are useful. We keep a scrambled (hashed) version of your internet address, not the address itself, and we delete the record after 12 months. We don't track whether an email is opened. If you'd rather we didn't track links, tell us and we'll stop.

[ADVISER TO CONFIRM: that link tracking in one-to-one emails is acceptable on legitimate interests under PECR. Checked against the code (apps/crm/lib/email/tracking.ts): only links to our own site are tracked, there is no open-tracking pixel, and links to /privacy, /trust and /unsubscribe are never tracked.]

10. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you or your child;
• ask us to correct it;
• ask us to delete it;
• ask us to restrict how we use it, or object to how we use it;
• ask for the data you gave us in a format you can take elsewhere;
• withdraw consent at any time, where we rely on it (for example the mailing list).

To make a request, email [CONTACT EMAIL]. We reply within one month. It's free.

A parent can make a request about their child's account. Students can make requests about their own data too, and we'll take account of their age and understanding.

Parents can cancel a subscription at any time from their account page.

Deleting your data

When you ask us to delete your data, we do it within one month and tell you when it's done. We may ask you to confirm the request from the email address on the account, so nobody else can delete it.

• A family: we delete the parent's account, the children's student accounts, and everything recorded about them. That includes progress, answers, practice, taster mock exam results, sign-in details, invitations, and our emails and notes about you. If the subscription is still active, we cancel it first.
• A student: we delete that student's account and everything recorded about them.
• A teacher or tutor: we delete your own account. Your school's groups and students stay, because they are the school's data.
• No account (for example, you only took a taster mock exam or asked us a question): we delete your result, your messages and our records of you.

We keep:

• Stripe's own payment records, which the law requires;
• a record that the deletion happened: when, why, and how many records, with no personal details;
• backups for at most [35] days, until they are replaced.

Deletion can't be undone.

11. Schools

When a school or teacher adds students, the school is the data controller for those students, and we process their data only on the school's instructions, under a data processing agreement with the school. Parents of those students should contact the school first. We will help the school answer any request.

Independent tutors who add their own students are usually controllers of those students' data themselves. [ADVISER TO CONFIRM.]

12. Security

• Students' PINs are stored only as one-way hashes, so they can't be read back.
• Sign-in is rate-limited.
• Every page that shows a student's data checks that you're allowed to see it.
• Card details are handled entirely by Stripe.
• The database is in the UK, encrypted at rest, and only accepts encrypted connections.

If a breach puts your data at risk, we will tell you and report it to the ICO as the law requires.

13. Cookies

We use the cookies our website needs to work, plus two small cookies for our homepage tests, which hold only the letters of the headline and sample lesson you were shown. We use no advertising or cross-site tracking cookies. We count visits on our own server (see "Website visits" in section 3). See our cookie policy for the full list, and to leave the homepage tests.

14. Changes to this notice

We will update this notice when how we use data changes, and change the date at the top. If a change matters to you, we'll email you before it happens.

15. Complaints

If you're unhappy with how we've handled your data, please tell us first at [CONTACT EMAIL]. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.