Data and safeguarding

What we collect, who sees it, and who helps us handle it.

Most of our students are under 16, so we collect as little as we can. This is a plain-English summary of how UpperGrades works today. It is not a formal privacy notice.

Last updated 21 September 2026.

What we collect

Parents: Name and email address. Card details are entered on Stripe's own page and never reach us.
Students: Name, a username, a PIN (stored only as a one-way hash), and their progress: lessons completed, quiz answers and scores. If they use practice, we also record each practice answer: which question, which topic, and how well they did.
Teachers and tutors: Name and email address, plus the names of the groups they create.
People we email one-to-one: When we email you personally, links to our own website in the email are tracked. We record when a link is clicked, and whether you then sign up or ask for something, so we can see which emails are useful. We keep a scrambled (hashed) version of your internet address, not the address itself. We don't track emails sent to students.
Students added by a teacher: Name and school email address, supplied by the teacher, plus the same username, PIN and progress as any student.

Who can see it

✓A parent sees their own children's progress, including which topics they have got secure, and nobody else's.
✓A teacher or tutor sees only the students in groups they have been added to as staff: how much they have completed, their scores, which topics are secure, and when they last used UpperGrades. Other teachers cannot see those groups.
✓Students cannot see other students. There is no chat, messaging, profile or sharing between students anywhere in UpperGrades.
✓The free games need no sign-in and collect nothing. Your best score stays in your own browser.

How practice uses your answers

✓Practice picks each question from how well you have been answering. If you show that you understand a topic, it moves you on to the next one automatically. If something is tricky, it tells you and suggests watching the lesson again.
✓To do this we record each practice answer and how good it was, and we keep a running picture of which topics you have got secure. There is no timer and no ranking against other students.
✓That picture is used only to choose your questions, to schedule when a topic comes back for review, and to show progress to your parent and, if you are in a class, your teacher. It is not used for advertising, and it is not a grade or an exam prediction.
✓Longer written answers are marked by AI (see below), and it can make mistakes, so treat what practice says as a guide, not a verdict.

Who helps us process it

Our application and database are hosted on Microsoft Azure in the UK South region, and data is encrypted in transit and at rest. The outside services listed below are separate from this hosting.

These outside services also handle data on our behalf.

Google (Gemini) — Marks longer written answers against the exam board's mark scheme.: For those questions only, the student's typed answer and the mark scheme are sent to Google. We do not send the student's name, username or email with it. A student should not put personal details into a written answer.
Stripe — Takes and manages subscription payments.: Stripe holds the card details. We keep only a reference to the Stripe customer and the subscription's status.
Bunny.net — Delivers lesson videos.: Videos are served from a content delivery network using time-limited links.
Our email provider — Sends sign-in links.: Only your email address and the sign-in message pass through it.

How long we keep it

Active accounts: For as long as the subscription or school access is active.
Family accounts after cancelling: 12 months after the subscription ends, then deleted. This lets you pick up again before exams without losing progress.
Sign-ups that never subscribed: 90 days, then deleted.
Students added by a teacher: While the school's access is active, then 12 months after it ends. A student removed from a group is deleted after 90 days.
Quiz answers: As long as the account they belong to.
Payment records: Stripe keeps its own transaction records as the law requires. We keep only a reference to your Stripe customer, deleted with your account.
Enquiries from schools and teachers: 24 months after we last spoke.
Email link clicks: 12 months, then deleted.
Games mailing list: Until you ask us to remove you, or 24 months with no contact.
Family invitations: The invitations you create (each is for one family), any private note you add to one, and which family joined through each, for as long as either account is open. The families you invite are never shown to you by name.
Founding families applications: 12 months. After that we keep only anonymous before-and-after figures. We only ever quote you with your permission.
Deletion requests: Completed within one month.

What we don’t do

✕Show adverts or sell data to anyone.
✕Use practice results for anything other than choosing your questions and showing progress to your parent and teacher.
✕Use advertising or behavioural-tracking scripts. We only use the cookies needed to keep you signed in.
✕Email students. Student email addresses that teachers enter are used to tell one student from another and to add them to the right group. Teachers hand out the login details.
✕Let anyone contact a child through the service.

Your rights and how to reach us

You can ask to see the data we hold about you or your child, to have it corrected, or to have it deleted. Parents can cancel a subscription at any time from their account. Schools and tutors who want to know more, for example for a data protection review, are welcome to ask us.

Get in touch through the enquiry form on the For teachers page.