Privacy Policy

Last updated: 19 February 2026

Introduction

This Privacy Policy explains how GCSE Coach ("we", "us", "our"), operated by Haiven Technologies Ltd, collects, uses, and protects your personal information when you use our AI-powered revision coaching service.

We are committed to protecting your privacy, particularly the privacy of young people using this service. This policy is written in plain language so that students aged 13 and above can understand it, as required by the ICO Age Appropriate Design Code.

This policy should be read alongside our Terms of Service and Cookie Policy.

Who we are

GCSE Coach is an AI revision tool for GCSE students aged 14-17. The service provides subject-specific AI tutors that assess your exam answers against mark schemes and give you feedback.

Data controller: Haiven Technologies Ltd, trading as GCSE Coach.
Contact: legal@gcsecoach.co.uk

What information we collect

When you sign in (Google account):

  • Your name and email address (from Google)
  • Your Google account ID (used to keep you signed in)

We do not store your Google profile photo. We only request the permissions we need.

When you practise (exam answers and feedback):

  • The answers you type into the practice panel
  • The AI feedback you receive
  • Your marks and scores for each question
  • Timestamps of when you practised

This data is stored only on your device (in your browser's local storage). It is not stored on our servers.

Your progress data (stored on your device only):

  • XP, levels, and streaks
  • Settings (such as your daily question target)
  • Which questions you have attempted

We do not collect:

  • Your school or year group
  • Any health or medical information
  • Your location
  • Any information about you beyond what is listed above

How we use your information

We use your information only to:

  • Sign you in and keep your session secure
  • Send your exam answers to our AI so it can give you feedback
  • Track your XP, streaks, and progress (on your device)
  • Send you a confirmation email when you join the waitlist
  • Manage your subscription (if you subscribe)

We do not use your information for advertising, profiling for commercial purposes, or selling to third parties.

Legal basis for processing

Under UK GDPR, we process your information based on:

  • Contract: Processing your answers through the AI is necessary to provide the revision coaching service you have signed up for.
  • Consent: For optional features such as email notifications.
  • Legitimate interests: Keeping the service secure and preventing misuse — balanced against your privacy interests.

Third parties who process your data

When you submit an exam answer, that answer text is sent to Anthropic (our AI provider) on servers in the United States. This is how the AI feedback works. Here is what you need to know:

Anthropic (AI inference)

Your exam answers are processed by Anthropic's Claude AI. Anthropic does not use API data to train its models by default. The transfer to the US is covered by the UK-US Data Bridge (in force October 2023). We have reviewed Anthropic's data processing terms.

Vercel (hosting)

Our website is hosted on Vercel. Vercel's servers process requests when you sign in or submit an answer. Vercel may retain server logs temporarily. We have a Data Processing Agreement with Vercel.

Google (sign-in)

We use Google OAuth for sign-in. Google processes your authentication. We receive your name, email, and account ID. We do not receive your Google search history or other Google data.

Resend (email)

If you join the waitlist or subscribe, we use Resend to send you transactional emails (confirmation, receipt). Resend processes your email address only.

Stripe (payments)

If you subscribe, payments are processed by Stripe. We never see or store your card details. Stripe processes your payment and subscription data under their own privacy policy.

We never sell your data. We never share it with advertisers.

How long we keep your information

Sign-in data (name, email, Google ID): kept while your account is active. Deleted within 30 days of account deletion.

Exam answers and feedback: stored only on your device. Deleted when you use "Delete all my progress" or clear your browser data.

Progress data (XP, streaks): stored only on your device. No server-side copy.

Subscription records: kept for 7 years as required by UK financial record-keeping obligations.

Waitlist email: deleted within 30 days of launch or at your request.

Young people's information

GCSE Coach is designed for students aged 14-17. We take the privacy of young people seriously and comply with the ICO Age Appropriate Design Code (Children's Code).

Age of consent:

Under UK GDPR, students aged 13 and above can consent to their own data processing for online services. Students under 13 must have a parent or guardian consent on their behalf. GCSE Coach requires all users to confirm they are 13 or over at sign-up.

Privacy-protective defaults:

  • We collect the minimum data necessary
  • Your revision data stays on your device, not our servers
  • We do not share student data with third parties for marketing
  • The gamification system (XP, streaks) is designed to support revision goals, not maximise screen time beyond what is educationally useful

For students aged 13-17:

You can exercise your data rights yourself (see below).

For students under 13:

A parent or guardian must create the account and consent on your behalf.

Your rights

Under UK GDPR you have the right to:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Ask us to correct inaccurate information
  • Deletion: Request deletion of your account and personal data
  • Restriction: Ask us to limit how we process your data
  • Objection: Object to processing based on legitimate interests
  • Portability: Receive your data in a portable format
  • Withdraw consent: Withdraw consent at any time for consent-based processing

To delete your account: use the "Delete all my progress" button in Settings. This clears all locally-stored revision data. To also delete your sign-in record, email us at legal@gcsecoach.co.uk and we will remove your account within 7 days.

To exercise any other right, contact us at legal@gcsecoach.co.uk. We will respond within 30 days.

Security

We use appropriate technical measures to protect your information, including:

  • HTTPS encryption for all data in transit
  • Server-side API keys (your exam answers are never processed client-side with our credentials)
  • Google OAuth for authentication (we never handle passwords)
  • Your revision data stored locally — not on our servers, so cannot be leaked in a server breach

No internet transmission is completely secure. If we become aware of a data breach affecting you, we will notify you promptly.

Your right to complain

If you are unhappy with how we have handled your information, please contact us first at legal@gcsecoach.co.uk so we can resolve it.

You also have the right to complain to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Helpline: 0303 123 1113
  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this policy

We may update this policy. If we make significant changes, we will notify you by email or via a notice in the app. The "Last updated" date at the top shows when changes were last made.

By using GCSE Coach, you confirm you have read and understood this Privacy Policy.

Students under 13: a parent or guardian should review this policy and create the account on your behalf.