Privacy Policy
Last updated: February 2026 · Applies to all EduSpring accounts
UK GDPR Compliant
EduSpring is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As we serve users under the age of 18, we apply the highest standards of data protection, including the ICO's Age Appropriate Design Code (Children's Code).
1 Who We Are
EduSpring is the data controller for personal information collected through this platform. We operate a UK-based educational revision service for secondary school students aged 11–18.
Contact: support@eduspring.co.uk
Website: eduspring.co.uk
2 What Data We Collect
We collect only the minimum data necessary to provide and improve the EduSpring service.
• Email address (for login and account recovery)
• Display name / first name
• Account type (student or parent)
• Year group (students)
• Parent–child relationship links (if applicable)
• Quiz sessions: subject, topic, score, date and duration
• XP points, badges earned and streak information
• Bookmarked questions and personal notes
• Study plan entries (subject, topic, scheduled day)
• Question attempts and accuracy per topic
• Messages sent from parent to child accounts within the platform
• Support enquiries submitted via our contact form
• Login timestamps and session metadata
• Browser type and device type (from our hosting provider's logs)
• We do not use tracking cookies or third-party advertising technologies
3 How We Use Your Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the quiz and revision service | Account + study data | Contract performance |
| Personalising progress tracking and recommendations | Study activity data | Legitimate interest |
| Parental visibility of child's progress | Study activity data | Contract performance |
| Responding to support requests | Contact form data | Legitimate interest |
| Improving the platform (aggregated analytics) | Anonymised usage data | Legitimate interest |
| Account security and fraud prevention | Technical + account data | Legal obligation |
We will never use your data for targeted advertising or sell it to third parties.
4 Children's Privacy
EduSpring is designed for use by school-age children and we take their privacy extremely seriously. In line with the ICO's Children's Code:
- We collect only the minimum data required for the educational service
- We do not serve advertisements to any users, especially children
- We do not use nudge techniques or gamification designed to exploit children
- Parental consent is required for users under 13
- Parents can view and request deletion of their child's data at any time
- Profile information for student accounts is not publicly visible
- We do not share children's data with third parties except our hosting provider (Supabase — see below)
5 Third-Party Services
EduSpring uses a small number of trusted third-party services:
Supabase (database & authentication)
All user data is stored in a Supabase PostgreSQL database. Supabase is SOC 2 Type II certified. Data is stored in EU data centres. Supabase Privacy Policy →
Google Fonts
We load the Outfit typeface from Google Fonts. Google may log the request (IP address, browser, referring page). No personal account data is shared with Google.
Tailwind CSS CDN
Our styling is loaded from the Tailwind CDN. No personal data is shared with Tailwind.
We do not use Google Analytics, Facebook Pixel, or any other advertising or tracking technologies.
6 Data Retention
We retain your data for as long as your account is active. If you delete your account:
- Your personal profile data (name, email) is deleted within 30 days
- Study session logs may be retained in anonymised, aggregated form for up to 12 months to improve our service
- Support messages are retained for up to 24 months for quality assurance
You can request deletion of your data at any time by contacting us at support@eduspring.co.uk.
7 Your Rights
Under UK GDPR, you have the right to:
✅ Access
Request a copy of the personal data we hold about you
✏️ Rectification
Ask us to correct inaccurate data
🗑️ Erasure
Request deletion of your data ("right to be forgotten")
⛔ Objection
Object to processing based on legitimate interest
📦 Portability
Receive your data in a portable, machine-readable format
⏸️ Restriction
Request that we limit processing of your data
To exercise any of these rights, contact us at support@eduspring.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
8 Cookies
EduSpring does not use tracking or advertising cookies. We use only:
- Authentication tokens — stored in your browser's local storage to keep you logged in. These are essential for the service to function and are not shared with third parties.
- Preference storage — your year group and theme preferences are stored in local storage on your device.
9 Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email before they take effect. The current version is always available at this page with the date it was last updated.
10 Contact & Data Requests
For any privacy-related questions or to exercise your data rights:
Email: support@eduspring.co.uk
Contact form: eduspring.co.uk/support
We aim to respond to all data requests within 5 working days, and no later than 30 days.