Privacy Policy

Last updated: 19 July 2026

Plain English: We only collect what we need to help you revise — your name, email, the questions you answer and the chats you have with the AI tutor. We never sell your data. You can ask to see it, change it or delete it any time. If you're under 16, please ask a parent or carer to read this with you.

Who we are

USERIQO LTD (trading as "GCSE.now") is the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO) under registration number TBD — pending ICO registration.

Contact our Data Protection lead at seun@lotipic.com.

What data we collect

• Account data: your name, email address, and password (stored as a one-way hash).
• Learning data: your answers, scores, AI tutor conversations, flashcards, mock exam results, and revision plans.
• Usage data: pages visited, time spent, and feature usage — only with your analytics consent.
• Support data: the subject and message you send to our support team.
• Consent records: a timestamped log of your consent choices (marketing, cookies, parental consent, terms acceptance).

Why we use your data (lawful basis)

• Contract: to provide the tutoring, marking and revision features you signed up for.
• Legitimate interests: to improve the service, keep it secure, and prevent misuse.
• Consent: for marketing emails and non-essential analytics cookies. You can withdraw this at any time.
• Legal obligation: to keep records where required by law.

Children's data

GCSE.now is designed for students aged 13 to 16 in the UK. Under UK GDPR Article 8, a child aged 13 or older may consent to information society services themselves in the UK. If you are under 13, you must not use GCSE.now. We do not knowingly collect data from children under 13; if you believe we have, please contact seun@lotipic.com and we will delete it.

We follow the ICO Age Appropriate Design Code. We minimise the data we collect, use age-appropriate language, default to the most privacy-protective settings, and avoid nudge techniques designed to keep you online longer than is good for you.

How long we keep your data

• AI conversations: up to 12 months after your last message, then automatically deleted.
• Learning data: kept while your account is active, then deleted within 30 days of account closure.
• Consent records: kept for the lifetime of your account as an audit trail.
• Support tickets: kept for 24 months after resolution.

Who we share your data with

• Supabase — our database and authentication provider (EU data centres).
• Our email provider — to send you transactional and (with consent) marketing emails.

We never sell your data to third parties.

International transfers

Some processors operate outside the UK. Where data is transferred internationally, we rely on the UK Addendum to the EU Standard Contractual Clauses or an International Data Transfer Agreement, and we complete a transfer risk assessment. See the DPIA for details.

Your rights

• Access — ask what data we hold about you (use "Download my data" in Account settings).
• Rectification — correct inaccurate data.
• Erasure — delete your account and data (Account settings → Delete account).
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests, including AI profiling (adaptive difficulty). You can turn this off in Account settings.
• Restriction — ask us to limit processing while a concern is resolved.
• Withdraw consent — for marketing and analytics at any time.

To exercise any right, email seun@lotipic.com. If you're unhappy with our response, you can complain to the ICO at ico.org.uk or on 0303 123 1113.

AI and profiling

We use AI to mark your answers, estimate grades, and adapt the difficulty of questions to your level. This is automated decision-making that affects your learning experience. You have the right not to be subject to solely automated decisions with legal or significant effects — our AI does not make such decisions; a teacher should always be consulted for official grades. You can disable adaptive difficulty in Account settings.

Security

We use encryption in transit (HTTPS) and at rest, row-level security on all data, and strict access controls. See our Security page for more.

Changes to this policy

We will notify you of material changes by email or in-app notice before they take effect.