Legal

Privacy Policy

Last updated: February 2026 · Applies to all EduSpring accounts

UK GDPR Compliant

EduSpring is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As we serve users under the age of 18, we apply the highest standards of data protection, including the ICO’s Age Appropriate Design Code (Children’s Code).

Who We Are

EduSpring is the data controller for personal information collected through this platform. We operate a UK-based educational revision service for students in Years 3–11 (typically aged 7–16).

Contact: support@eduspring.co.uk
Website: eduspring.co.uk

What Data We Collect

We collect only the minimum data necessary to provide and improve the EduSpring service.

Account data

• Email address (for login and account recovery)
• Display name / first name
• Account type (student, parent, teacher or admin)
• Year group (students)
• Parent–child relationship links (if applicable)

Study activity data

• Quiz sessions: subject, topic, score, date and duration
• XP points, badges earned and streak information
• Bookmarked questions and personal notes
• Study plan entries (subject, topic, scheduled day)
• Question attempts and accuracy per topic

Communication data

• Messages sent from parent to child accounts within the platform
• Support enquiries submitted via our contact form

Technical data

• Login timestamps and session metadata
• Browser type and device type (from our hosting provider's logs)
• We do not use tracking cookies or third-party advertising technologies

How We Use Your Data

Purpose	Data used	Legal basis
Providing the quiz and revision service	Account + study data	Contract performance
Personalising progress tracking and recommendations	Study activity data	Legitimate interest
Parental visibility of child's progress	Study activity data	Contract performance
Responding to support requests	Contact form data	Legitimate interest
Improving the platform (aggregated analytics)	Anonymised usage data	Legitimate interest
Account security and fraud prevention	Technical + account data	Legal obligation

We will never use your data for targeted advertising or sell it to third parties.

Children's Privacy

EduSpring is designed for use by school-age children and we take their privacy extremely seriously. In line with the ICO’s Children’s Code:

We collect only the minimum data required to provide the educational service (name, email, year group, and exam board).
We do not serve advertisements to any users.
EduSpring uses educational engagement features — points (XP), streaks, badges, and class leaderboards — to encourage regular study. These are designed in the best interests of the child to build positive learning habits, are visible to linked parents, and are never used to sell products, to extend use against the child’s interests, or with manipulative (“dark pattern”) design. Reminder notifications respect configured quiet hours.
Child accounts in Years 3–8 (under 13) must be created by a parent or guardian via the parent account flow, and parental consent is recorded at that point. Older students (Years 9–11) can self-register using a parent-supplied invite code.
Parents can link to a child’s account and can view or request deletion of their child’s data at any time.
Profile information for student accounts is not publicly visible.
Children’s data is processed by our infrastructure provider (Supabase, EU-hosted) and, where enabled, by our email provider (Resend) to deliver progress reports. Our AI features (explanations, the study assistant, and question generation) send your child’s input to OpenAI to generate the educational response, under OpenAI’s API terms — OpenAI does not use this data to train its models. We do not sell children’s data or share it for advertising.

Third-Party Services

EduSpring uses a small number of trusted third-party services:

Supabase (database & authentication)

All user data is stored in a Supabase PostgreSQL database. Supabase is SOC 2 Type II certified. Data is stored in EU data centres.

Google Fonts

We load the Poppins, Lexend, and Material Symbols typefaces from Google Fonts. Google may log the request (IP address, browser, referring page). No personal account data is shared with Google.

Resend (email delivery)

We use Resend to send account emails and, where enabled, weekly progress reports to parents. These emails may contain your child’s first name and study progress (accuracy, XP, topics studied). Resend processes this data under a data processing agreement.

OpenAI (AI features)

Our AI explanations, study assistant, and question generation are routed through our own server to OpenAI’s API to produce responses. Your child’s input to these features is sent to OpenAI solely to generate the educational reply. Per OpenAI’s API terms this data is not used to train their models, and we do not send it for advertising.

Plausible Analytics (self-hosted)

We use a self-hosted instance of Plausible, a privacy-friendly analytics tool, to understand site usage. It is cookieless and records only anonymous, aggregated data (page views, referrer, country, device type). It sets no cookies, performs no cross-site tracking, and receives no personal account data.

We do not use Google Analytics, Facebook Pixel, or any other advertising or tracking technologies.

Data Retention

We retain your data for as long as your account is active. If you delete your account:

Your personal profile data (name, email) is deleted within 30 days.
Study session logs may be retained in anonymised, aggregated form for up to 12 months to improve our service.
Support messages are retained for up to 24 months for quality assurance.

You can request deletion of your data at any time by contacting us at support@eduspring.co.uk.

Your Rights

Under UK GDPR, you have the right to:

✅ Access

Request a copy of the personal data we hold about you

✏️ Rectification

Ask us to correct inaccurate data

🗑️ Erasure

Request deletion of your data ("right to be forgotten")

⛔ Objection

Object to processing based on legitimate interest

📦 Portability

Receive your data in a portable, machine-readable format

⏸️ Restriction

Request that we limit processing of your data

To exercise any of these rights, contact us at support@eduspring.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Cookies

EduSpring does not use tracking or advertising cookies. We use only:

Authentication tokens— stored in your browser’s local storage to keep you logged in. These are essential for the service to function and are not shared with third parties.
Preference storage — your year group and theme preferences are stored in local storage on your device.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email before they take effect. The current version is always available at this page with the date it was last updated.

Contact & Data Requests

For any privacy-related questions or to exercise your data rights:

Email: support@eduspring.co.uk
Contact form: eduspring.co.uk/support

We aim to respond to all data requests within 5 working days, and no later than 30 days.

← Back to EduSpring Terms of Service Support

EduSpring