Privacy Policy

1. Who we are and our roles

EdEvo (edevo.co.uk) is operated by EdEvo (operating as a sole trader (no company registration); ICO registration [[TO COMPLETE]]). Contact for privacy matters: edevouk@gmail.com. Where a school or trust uses EdEvo with its pupils, the school is the data controller and EdEvo processes pupil data as its processor under our Data Processing Agreement — the school's own privacy notice applies to that processing. Where you use EdEvo directly (for example a teacher registering an account, or a visitor browsing), EdEvo is the controller.

2. What we collect

Without an account (Learning, Tools, Games, Glossary): no account data. Standard technical logs are processed by our hosting provider to deliver and secure the site. We run no analytics or advertising trackers. Some features save preferences (such as dark mode) in your browser's local storage, which stays on your device.

With an account: • Account — email address, name/display name, sign-in method (managed by our authentication provider), role (student/teacher/admin). • School links — school/trust membership (teachers) and class enrolments (students). • Learning data — revision question attempts (including answers given), course/lesson completions and scores, simulator usage counts and saved settings, flashcard progress, game scores, assignment completion. • Preferences — theme, chosen avatar icon (from our provided set) and player tag (from our provided word lists). • Technical — activity events (such as sign-in or a revision attempt) with timestamps, and administrative audit logs. We do not knowingly collect special category data, and the Service is designed not to invite it — there is no student-to-student messaging, and avatars and player tags come from curated, admin-controlled lists.

3. Why we process it

• Providing the Service to school-managed pupils — as processor on the school's documented instructions (the school's basis is typically public task or legitimate interests). • Providing accounts and the Service to direct users — contract (UK GDPR Art. 6(1)(b)). • Security, abuse prevention and audit logging — our legitimate interests in protecting the Service and its users. • Legal compliance — legal obligation. We do not use personal data for advertising or marketing to pupils, we do not sell personal data, and we do not carry out automated decision-making with legal or similarly significant effects. Our revision feature schedules practice questions using your past answers — educational adaptivity under your and your teacher's control, not commercial profiling.

4. Children

EdEvo is designed for secondary-age pupils (11–18) and conforms to the ICO's Age Appropriate Design Code: privacy-protective defaults, no advertising, no third-party marketing, no commercial profiling, minimal data collection, and public game leaderboards that show pseudonymous player tags only — never real names. Where pupils are under 13, the school (as controller) is responsible for the lawful basis and any parental information or consent.

5. Who we share data with

We use a small number of service providers (sub-processors) to run EdEvo. They process data only on our instructions: • Vercel — hosting and content delivery (London (lhr1); UK Addendum/SCCs). • Supabase — database for accounts, classes and progress (London, UK (AWS eu-west-2); encrypted at rest; SOC 2 Type II). • Supabase — authentication and sessions, in the same London project as the database. • Upstash — content store for educational content and teaching images (teaching content only, no pupil records). • Google (YouTube) — embedded videos via the privacy-enhanced player; loads only on pages containing a video. No personal data is transferred outside the UK/EEA without appropriate safeguards (adequacy regulations, SCCs with the UK Addendum, or the UK Extension to the EU–US Data Privacy Framework). The maintained list appears in our Data Processing Agreement.

6. How long we keep data

• Activity events — about 13 months (395 days), then deleted automatically. • Student accounts inactive for 2 years (730 days) — deleted automatically. • Account and learning data — for the life of the account; deleted on account deletion or on the school's instruction. • Administrative audit logs — retained for accountability and reviewed periodically. • Local storage on your device — until you clear your browser data. Deletion runs as an automated daily job. Schools can request earlier deletion at any time.

7. Security

Data is encrypted in transit (TLS) and at rest; access is role-based with least privilege; the database enforces row-level security as a backstop; administrative actions are audit-logged; and we operate hardened security headers, rate limiting and automated dependency monitoring. We will notify affected controllers without undue delay of any personal data breach and, on becoming aware, assess ICO notification within 72 hours where required.

8. Your rights

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. We support these with built-in tools: a complete machine-readable export of a user's data and full account deletion. • Direct users: contact edevouk@gmail.com. • School-managed pupils: ask your school — we assist the school as its processor. • You may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113); we would appreciate the chance to resolve any concern first.

9. Cookies

Only strictly necessary authentication and security cookies are used — no analytics or advertising cookies. See the Cookie Policy for the full list.

10. Changes to this policy

We will post any changes here with a new version number and date, and notify schools of material changes. Previous versions are available on request.