Privacy Policy

1. Who We Are

AptiEd ("we", "us") is committed to protecting your personal information and your right to privacy. The data controller is [AptiEd legal entity name], a company registered in England and Wales (company no. [COMPANY NUMBER]), registered office [REGISTERED ADDRESS]. We are registered with the UK Information Commissioner's Office (ICO) under registration [ICO REGISTRATION NUMBER]. Our Data Protection Officer can be contacted at privacy@aptied.co.uk. This Policy explains how we collect, use, and share information when you use our platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: name, email address, date of birth, school name
• Parent Information: phone number, postcode (for parent accounts)
• Educational Data: year group, exam board, subject selections
• Payment Information: for paid plans and tutoring, billing details are collected and processed by our payment provider, Stripe. We receive limited information (e.g. plan, status, last 4 digits) but do not store full card numbers.
• Communications: messages you send (e.g. parent–teacher messages) and support enquiries

2.2 Automatically Collected Information

• Learning Progress: lessons watched, watch time, quizzes completed, scores, streaks
• Usage Data: time spent on lessons, login times, navigation patterns, activity events
• Device Information: browser type, IP address, operating system; push-notification tokens if you opt in

2.3 Tutoring Sessions

• Booking details, session times, and tutor/student pairing
• Session recordings where a tutor chooses to provide one for the student's revision. Recordings are stored securely and retained for [RECORDING RETENTION PERIOD]. For under-18s, recording is subject to parental consent.

3. How We Use Your Information & Lawful Bases

Under UK GDPR we rely on the following lawful bases:

• Contract: to provide the platform, process payments, deliver tutoring, and manage your account
• Consent: for push notifications, session recordings for under-18s, and any optional marketing — you can withdraw consent at any time
• Legitimate interests: to secure the platform, prevent fraud, and improve our services (balanced against your rights)
• Legal obligation / safeguarding: to meet legal duties and protect the safety of children and users

4. Children's Privacy

AptiEd is used by children aged 11–18, and we design our service in line with the UK GDPR and the ICO's Age Appropriate Design Code (Children's Code). For users under 13:

• We require verifiable parent/guardian consent before account activation
• Parents can review, correct, or delete their child's information at any time
• We apply data-minimisation and privacy-by-default settings appropriate to children
• We do not sell children's data or use it for behavioural advertising

5. Information Sharing & Sub-processors

We do not sell your personal information. We share it only as needed to run the service:

• With Parents: a linked child's progress and activity is shared with approved parent accounts
• Payments: Stripe (payment processing)
• Email/notifications: [EMAIL PROVIDER, e.g. Resend] for transactional email
• AI content generation: lesson/quiz/tutor content is generated using Anthropic's Claude API; prompts may include lesson context but are not used to identify students
• Infrastructure: hosting, storage, and video processing providers [LIST KEY PROVIDERS]
• Legal & safeguarding: where required by law or to protect rights and safety

A current list of sub-processors is available on request from privacy@aptied.co.uk.

6. International Transfers

Some of our providers (e.g. Stripe, Anthropic) may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as UK International Data Transfer Agreements or Standard Contractual Clauses to protect your information. [CONFIRM TRANSFER MECHANISMS PER PROVIDER].

7. Data Security

We implement appropriate technical and organisational measures, including:

• Encryption of data in transit (TLS) and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Secure password hashing (bcrypt)

8. Your Rights

Under UK GDPR you have the right to:

• Access: request a copy of your personal data
• Rectification: update inaccurate or incomplete information
• Erasure: request deletion of your account and data
• Portability: receive your data in a machine-readable format
• Restriction / Objection: restrict or object to certain processing
• Withdraw consent: where processing is based on consent

To exercise these rights, contact privacy@aptied.co.uk. You also have the right to complain to the ICO (ico.org.uk), though we'd appreciate the chance to resolve your concern first.

9. Cookies and Tracking

We use cookies and similar technologies to operate and improve the platform. See our Cookie Policy for details.

10. Data Retention

We retain your information for as long as your account is active or as needed to provide services. When you delete your account, we delete or anonymise your personal data within [DELETION WINDOW, e.g. 30 days], except where we must retain it for legal, accounting, or safeguarding purposes. Tutoring recordings are retained for [RECORDING RETENTION PERIOD]; payment records are retained as required by tax/accounting law (typically [RETENTION, e.g. 6 years]).

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date, and where appropriate by email or in-platform notice.

12. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Email: privacy@aptied.co.uk
• Address: [REGISTERED ADDRESS], United Kingdom