1. Who We Are

Rescoping Education Ltd is the data controller. This means our company decides how and why the personal information of our users is collected, used, and protected.

2. The Information We Collect

We collect different types of data for specific purposes, as outlined below:

a) Website Usage Data

We believe in respecting user privacy. We use the browser's local storage for functional purposes without requiring an account login. This includes saving learning progress, streak counts, active subjects, website theme preferences (Light/Dark mode), and temporarily caching search queries (which automatically expire after 24 hours). You can clear this stored data at any time using the in-app options or through your browser settings.

We use a randomly generated daily session identifier stored in your browser to evaluate site usage and measure learning tool activity (such as time taken per question). This identifier automatically resets every 24 hours or after a period of inactivity, allowing us to understand usage patterns without identifying real-world individuals or tracking behaviour across multiple days.

Please Note: Because this data is first-party and essential for monitoring site health, it is not currently disabled by 'Do Not Track' settings. Using 'Incognito' or 'Private' mode will clear the user's learning progress after the user closes their browser but will not prevent the transmission of usage data during the user's session.

Because this usage data is linked only to a temporary daily identifier and not to a user account, we cannot identify which specific records belong to individual users to fulfil targeted deletion requests. This is a privacy-preserving measure designed to keep user activity disconnected from real-world identities.

b) Infrastructure Hosting, Security & Transaction Processing

Our website is hosted on Netlify and protected via Cloudflare's proxy services. While our core web architecture does not use cookies, Cloudflare may issue strictly necessary security cookies (such as cf_clearance) to verify human traffic if automated threats, VPNs, or datacentre IP addresses are detected. Netlify and Cloudflare process standard technical network data, such as the user's IP address within secure server logs, strictly to route traffic, mitigate malicious activity, and ensure the website operates reliably. For more details, please refer to their respective privacy documentations.

We do not host open payment gateways or automated donation tools on this website. To process community contributions securely and protect the user's privacy, transactions are handled individually via secure corporate bank transfer or direct, private billing links that completely isolate the user's payment data from our website environment.

c) Our Commitment to the User's Privacy

We are committed to being transparent about the information we collect and how we use it. We do not sell or share user data with third parties for marketing purposes. The personal information we collect is held in the strictest confidence and is used only for the purposes outlined above.

3. How We Use the User's Information

We use the user's personal information for the following purposes and with the following legal bases:

To maintain administrative and legal records (Legal Basis: Legitimate Interest & Legal Obligation): We collect information sent to us by email. These records are necessary for internal record-keeping. We also keep a record of Subject Access Requests (SARs) and related documentation to demonstrate our compliance with data protection laws. Emails are retained for administrative and communication purposes related to our services.

For initial inquiries (Legal Basis: Legitimate Interest): We process the personal data collected by email, including the user's name, email, and message, to respond to the user's inquiries and facilitate potential services. This is a necessary step for our business to operate and is a legitimate interest that the user would reasonably expect.

To process voluntary support contributions and maintain financial records (Legal Basis: Legal Obligation and Legitimate Interest): The company processes the personal data and transaction data provided during manual billing or bank transfers to ensure contributions are recorded correctly and to comply with UK legal and tax obligations.

To ensure website security, reliability, and functionality (Legal Basis: Legitimate Interest): We process technical data, such as IP addresses, session IDs, and basic browser information, to route traffic, serve the learning tool, monitor for security threats, and prevent fraudulent activity. This is necessary to operate our services securely, enforce our UK-only service restrictions, and protect both our business and our users.

What is Legitimate Interest?

We process certain personal data based on our legitimate interests. This legal basis is used when we have a legitimate business need to process the user's data in a way that the user would reasonably expect, and where this processing has a minimal impact on the user's privacy. We have determined that our legitimate interests are to provide our services securely and reliably.

4. How We Protect the User's Information

We take the security of the user's data seriously. All personal information we hold is stored on secure systems and is protected by appropriate security measures to prevent unauthorised access, use, or disclosure. We have implemented appropriate physical, technical, and administrative measures to protect the information we collect.

For enhanced security, we protect all data sent to our email addresses using a two-factor verification (2FA) process. This ensures that only authorised personnel can access and handle the user's information, providing an additional layer of protection against unauthorised access.

All records and data containing user personal information are stored using industry-standard encryption. This means that even if a data storage device were compromised, the information would be unreadable without the correct decryption key.

In addition to our own systems, we ensure that our payment processors and other third-party services employ robust security measures to protect user data.

5. Our Third-Party Data Processors

To provide our services and to fulfil our legal obligations, we engage with trusted third-party data processors. These processors act on our instructions and handle relevant data on our behalf for specific infrastructure and billing purposes. They are carefully vetted to ensure they meet our high standards for data security and privacy and are compliant with UK GDPR.

Infrastructure Providers: Netlify and Cloudflare handle secure cloud web-hosting, automated bot detection, and network proxy management, safeguarding technical server requests.

Payment Processors: Stripe provides payment processing services for voluntary contributions initiated via secure off-site links. They process limited personal and transaction data when the user completes a transaction to ensure security and prevent fraud. The user can view their privacy practices at stripe.com/privacy.

6. The User's Data Rights

Under GDPR, the user has the right to request access to, correction of, or erasure of their personal data. The user also has the right to object to or restrict processing, and the right to data portability (to receive an electronic copy of their data).

We will respond to all SARs without undue delay and at the latest within one month of receiving the request. If the request is complex, we may extend this period by a further two months, but we will inform the user of this within the initial one-month period.

To ensure the security of the user's data, we will need to verify the user's identity before we can fulfil the request. We may ask for information to confirm the user's identity or their authority to act on behalf of their child.

To exercise any of these rights, the user can contact us at

[email protected]

Please note that we may need to verify the user's identity before fulfilling their request.

7. No Automated Marketing and No Data Sales

We will never sell the user's personal data. We do not operate automated marketing mailing lists or subscriptions. We may contact the user personally via email only to respond to the user's direct inquiries or to provide specific information the user has requested. If we ever intend to use the user's email for broader marketing purposes, we will seek the user's explicit consent first.

8. Data Retention

We will only keep the user's personal data for as long as is necessary to fulfil the purposes for which we collected it. In the event of a safeguarding issue that requires a longer investigation, we will retain the relevant data for as long as is legally necessary to cooperate with the relevant authorities.

We retain financial communication, banking records, and invoice data related to voluntary contributions for a period of 6 years to meet our legal obligations for UK financial record-keeping. Records of SARs are kept for 7 years in compliance with data protection laws.

Data collected from emails is retained for a period of one year from the date of submission. This is to allow us to refer back to the inquiry for administrative, legal, and operational purposes, or until the purpose for which the data was collected has been fulfilled.

Pseudonymous session logs and aggregated operational parameters may be retained to train, analyse, and structurally improve the learning tool. Because this data does not contain personal identifying characteristics or trace back to real-world identities, it is preserved strictly for systemic optimisation.

9. The User's Consent and Agreement

By accessing or using the Website, the User agrees to be bound by this Privacy Policy.

The processing of technical data (IP address, session metrics, etc.) is based on our Legitimate Interest in maintaining a secure and functional service, as detailed in Section 3.

10. How the User Can Complain

If the user has any concerns about our use of their personal data, the user can contact us at

[email protected]

If the user is not satisfied with our response, the user has the right to lodge a complaint with the UK data protection regulator, the Information Commissioner's Office (ICO).

This Privacy Policy may be updated from time to time to reflect changes in our practices or for legal reasons. We will notify the user of any significant changes.