Privacy Policy

GCSE Maths Lab is an independent online educational service operated by its owner in England. It is not currently operated through a limited company. The owner is the data controller for the personal information described in this Policy. For privacy questions or requests, email contact@gcsemathslab.com or use the Contact page.

When an account is created, we collect first and last name, username and email address. Supabase Auth receives and securely manages the password; we do not store or have access to the plain-text password. We also process email-verification, password-reset, email-change, session and account-status information needed to keep the account working and secure.

We store learning activity associated with an account, including quiz answers, question and topic progress, completion records, scores, achievements and revision streaks. Interactive paper practice may also store the paper and version, answers entered, current question, hints used, elapsed time, start and completion times, mark and grade. We use this information to save progress, show results and personalise practice. Some guest and mixed-practice progress is kept only in the browser using local or session storage.

Stripe collects payment-method and transaction information directly through Stripe Checkout. We do not store full card details. We receive or store information needed to provide paid access, including the Stripe customer and subscription identifiers, subscription status, product and price identifiers, renewal or access-end date, cancellation status and applicable promotion information. Stripe may use transaction information for its own legal, security and fraud-prevention purposes as explained in Stripe's privacy information.

If you contact us, we process your name, email address, subject, message and subsequent correspondence. The contact form also processes IP address, browser or device user-agent, bot-check token and timing information to prevent abuse and deliver the message. The service processes IP addresses, request and session information, error or security logs, and short-lived hashed rate-limit identifiers where necessary to operate and protect accounts and the website.

Essential cookies and similar browser storage are used for authentication, security, content access, saving a cookie choice, pending email verification, user preferences, guest progress, mixed-practice results and short-lived session functions. These are used only where needed to provide a feature requested by the user or protect the service.

Google Analytics is optional. The Google tag is not downloaded or run unless you select “Accept” in the cookie banner. If accepted, Google Analytics may collect pages visited, approximate location derived from IP address, device and browser information, referral information and general interaction data so we can understand and improve the site. Signed-in users can select “Cookie settings” in the Manage account section of the Account page to change their choice. Declining or later withdrawing consent prevents further Google Analytics collection by this site and removes its first-party analytics cookies where possible.

We use account, learning and subscription information because it is necessary to provide the service and perform our contract with the account holder or adult purchaser. We use transaction and record information where necessary to meet legal and accounting obligations. We use limited technical, contact and security information for our legitimate interests in responding to users, preventing fraud and abuse, securing accounts, diagnosing faults and improving the service; we balance those interests against users' rights, particularly where a user is under 18. We use Google Analytics only with consent, which may be withdrawn at any time.

We use Supabase for authentication and database services; Stripe for Checkout, payment and subscription management; Cloudflare for hosting, network security and Turnstile bot checks; email providers for account and support messages; and Google Analytics only after consent. These providers receive only the information needed for their services. They generally process information for us under contractual safeguards, although providers such as Stripe may also act as independent controllers where they determine their own legal, fraud-prevention or security uses. We may also disclose information where required by law or necessary to establish or defend legal rights.

Some providers operate internationally, so information may be processed outside the UK. Where UK adequacy regulations do not apply, we rely on an appropriate transfer mechanism made available by the provider, such as the UK International Data Transfer Agreement or the UK Addendum to approved contractual clauses, together with additional safeguards where needed. You may contact us for information about the safeguard relevant to a particular provider.

Confirmed account and learning records are generally kept while the account remains open. Unconfirmed registrations that have never signed in and have no subscription may be removed after 90 days. Paper attempts remain until they are restarted, replaced or the account is deleted. Expired email-change records and rate-limit counters are kept only for their operational or security purpose and then removed during routine cleanup. Contact correspondence is kept while needed to answer the enquiry, handle follow-up or complaints, and establish legal claims. Payment and transaction records may be retained for longer where required for tax, accounting, fraud prevention or legal claims. Google and other providers may retain limited records under their own documented retention policies.

Depending on the circumstances, you may ask for access to your personal information, correction, deletion, restriction, objection, or a portable copy. You may withdraw analytics consent at any time through “Cookie settings”. Rights can be exercised by emailing contact@gcsemathslab.com. You also have the right to complain to the Information Commissioner's Office. Some rights are subject to legal exceptions, including records we must retain.

The service is intended for users aged 15 or over. Users aged 15 to 17 should use the service with permission from a parent or guardian, and a paid subscription must be purchased by an adult. We do not knowingly offer accounts to children under 15. If we learn that an under-15 user has created an account, we may restrict or delete it and ask a parent or guardian to contact us. Privacy information is written to be understandable by the young people for whom the service is intended.

Learning activity may be used automatically to identify topics for further practice, display progress, award achievements and select suitable questions. These features support revision and do not make decisions that have legal or similarly significant effects on a user. We do not use personal information for targeted advertising.

We use HTTPS, access controls, secure authentication, restricted server-side credentials, request limits and other technical and organisational safeguards. Payments are handled through Stripe rather than by storing card details on our servers. No online system can be guaranteed completely secure, but we review and improve safeguards as the service changes.

We review this Policy as the service changes. We will publish a new effective date and bring material new uses of personal information to users' attention before they begin where required.