Privacy notice
- We collect as little as we can. Children use a username that is not their real name. We never ask for a child's real name, photo, address or the school they go to now. You can choose to tell us which grammar schools your child is aiming for and the test date, so we can plan their practice.
- We use information only to run Myndzet: to let your family sign in, to set questions at the right level, and to show you how your child is getting on.
- We do not show adverts, we do not sell information, and we do not use trackers from advertisers or social networks.
- You can see, correct and delete your family's information, and you can ask us anything at any time.
1. Who we are
Myndzet is run by [companyName] (company number [companyNumber]), of [address]. We are the "controller" of the personal information described here, which means we decide how and why it is used. We are registered with the Information Commissioner's Office (ICO), registration number [icoNumber].
Questions about this notice: [privacyEmail].
2. What we collect, and why
| Information | Whose | Why we use it | Our legal basis |
|---|---|---|---|
| Name and email address | Parent | To create and run your account and contact you about it | Contract (providing the service you asked for) |
| Password | Parent | To keep your account secure. We store it scrambled so that even we cannot read it | Contract |
| Username (not a real name), age, daily goal, chosen picture (avatar) and, if given, school year | Child, entered by the parent | To set up the child's profile and choose suitable questions | Contract |
| Grammar schools your child is aiming for and the test date (optional) | Child, entered by the parent | To plan practice towards the test and show relevant advice | Contract |
| 4-digit PIN | Child | To let your child sign in. Stored scrambled | Contract |
| Learning progress: points and levels, weekly totals, how many questions were answered and correct in each skill, difficulty settings, and a short list of questions answered wrongly | Child | To adjust difficulty, run the weekly race, let the child practise past mistakes, and show you progress | Contract |
| Subscription and payment status | Parent | To manage your plan. Card details are handled by Stripe. We never see or store them | Contract, and legal obligation (keeping accounts) |
| Security records, such as sign-in attempts, lockouts, account changes and the invite code used | Parent and child | To keep accounts safe and spot misuse | Legitimate interests (keeping the service secure) |
| Approved devices: the name you give each device, when it was approved and last used, and a secret code kept on that device | Parent | So children can only sign in on devices you have approved | Legitimate interests (keeping children's accounts secure) |
| The internet (IP) address of a device that types a wrong child PIN | Visitor or child | To slow down anyone trying to guess PINs. Kept for no more than 2 days | Legitimate interests (keeping the service secure) |
| Record of questions already answered (short codes, not the answers) | Child | So your child is not given the same question again for about 6 months | Contract |
| When you accepted our Terms and this notice, and which version | Parent | To show what you agreed to | Legitimate interests and legal obligation |
| Error reports: technical details when a page crashes, such as the page and browser. Names, emails, usernames and page addresses with personal details are removed before sending | Anyone using the site | To find and fix problems quickly | Legitimate interests (keeping the service working) |
| Reports of mistakes in questions | Child or parent | To correct or remove questions. Reports do not include a name | Legitimate interests (keeping content accurate) |
| Waitlist email address | Visitor | To tell you when there is space | Consent. You can ask us to remove it at any time |
| Messages you send us | Parent | To answer you and to keep a record of what we agreed | Legitimate interests |
If we add a feature that collects more, we will update this notice before it goes live.
3. What we do not do
- We do not show advertising, and we do not sell or rent personal information.
- We do not use analytics or tracking cookies from advertisers or social networks.
- Children cannot chat with each other or with strangers. There is no messaging in the child's app.
- We do not use your child's information to train artificial intelligence systems, and we do not send it to AI services.
- We do not make decisions that have legal or similarly significant effects on you. Myndzet does automatically adjust question difficulty to suit your child. This only affects which practice questions they see, and you can see how it is working in the parent dashboard.
4. Children's information
Myndzet is bought and managed by a parent or guardian, who must be at least 18. Children use the service through their parent's account. We have designed the service with the ICO's Children's Code (the Age Appropriate Design Code) in mind: we collect the minimum we need, the strictest privacy settings are the default, we do not use techniques designed to push children into spending more time than they should, and children can read a short, child-friendly explanation on our page for children.
Parents can see everything we hold about their child, download a copy of it ("Download my data" on the dashboard), reset their PIN, unlock their login, choose which devices they can use, pause a week of practice, and remove the child and all their progress at any time from the parent dashboard.
5. Who we share information with
We use a small number of trusted companies ("processors") to run the service. They may only use information on our instructions.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Stores our database and handles sign-in | Data is stored in the European Union (Sweden) |
| Stripe | Takes payments and holds card details | UK, EU and USA |
| Cloudflare | Delivers the website and protects it from attacks | Servers around the world |
| GitHub | Stores our software and our nightly database backups. Backups are encrypted with a key only we hold, so GitHub cannot read them | USA |
| Sentry | Receives error reports when a page crashes (see section 2) | European Union (Germany) |
| Our email provider | Sends account and service emails | To be confirmed when email sending starts. We will update this table |
We may also share information if the law requires it, for example if a court or the police ask us to, or to protect a child from serious harm.
6. Sending information outside the UK
The UK treats the EU as providing an adequate level of protection. Some of our providers also handle information in other countries, including the USA. Where they do, we rely on the safeguards the UK allows, such as the UK's approved transfer terms or an adequacy decision.
7. How long we keep information
| Information | How long |
|---|---|
| Parent and child account information and progress | While your account is open |
| If you cancel, or a trial ends without payment | Your children's access ends when the plan ends. We keep the information for 30 days in case you return. After 30 days we delete the children's accounts and all their progress permanently |
| If you delete a child or your whole account | Deleted straight away, apart from the records below. Deleting your account also cancels any subscription. Copies in our encrypted backups are removed automatically within 30 days |
| Internet addresses linked to wrong PINs | Up to 2 days |
| Record of questions already answered | About 6 months |
| Error reports | Up to 90 days |
| Security records | Up to 12 months |
| Payment and invoice records | 6 years, because the law requires us to keep accounts |
| Waitlist emails | Until we invite you, or for 12 months, or until you ask us to remove them |
| Messages to us | Up to 12 months after the matter is closed |
8. Your rights
Under UK data protection law you have the right to:
- be told what we hold about you and your child, and receive a copy;
- have mistakes corrected;
- have information deleted;
- ask us to restrict how we use it;
- receive it in a portable format;
- object to uses that rely on our legitimate interests; and
- withdraw consent where we rely on it, for example for the waitlist.
To use any of these, email [privacyEmail]. We will reply within one month and we do not charge. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
9. How we keep information safe
- Information is encrypted as it travels between your device and our servers.
- Passwords and PINs are stored in a scrambled form that cannot be turned back into the original.
- Each family's information is separated by database rules, so one family cannot see another's.
- Repeated wrong sign-in attempts are slowed down or blocked, and children can only sign in on devices a parent has approved.
- Our database is backed up every night, encrypted, and kept for 30 days.
- We keep a written plan for what to do if something goes wrong. If a breach is likely to put people at risk, we will report it to the ICO within 72 hours and tell the families affected.
10. Cookies and browser storage
We only use small pieces of browser storage that the service needs to work: to keep you signed in, to remember that a child is signed in on this device, to remember that you approved this device for your children, to hold practice results until they can be saved if the connection drops, and to remember display choices such as the colour theme. We do not use advertising or tracking cookies. If we ever add anything else, we will ask first.
11. Changes to this notice
If we change this notice in a way that matters, we will tell parents by email before the change takes effect. The date at the top shows when it was last updated.
12. Contact
[companyName]
[address]
Privacy questions: [privacyEmail]
Everything else: [email]