Student Data & GDPR

Revise Right is committed to protecting the privacy and security of student data. We understand that students under 18 require special protection, and we take our responsibility seriously.

Age Requirements: Our platform is designed for students aged 13 and above. Children under 13 must not create an account or use the service directly.

This page explains how we handle student information and requests under UK data-protection law, including additional protections for children.

Where age is uncertain or cannot be verified with sufficient confidence, we may apply child-safety protections more broadly, request additional information, or limit access to certain features until concerns are resolved.

Account Information: Name or username, email address, authentication details handled by our sign-in provider, age-related information you provide for eligibility or safeguarding purposes, exam board preferences, and subject interests.

Learning Data: Study progress and completion, quiz and exam results, time spent on different topics, learning preferences and patterns, content accessed and created.

What We Don't Collect: School name or location (unless voluntarily provided), teacher names or contact information, personal addresses or phone numbers, sensitive personal information beyond what is necessary.

• Provide personalised learning experiences
• Track progress and suggest study paths
• Generate customised study materials
• Provide personalised tutoring assistance
• Improve our educational content

No Student-Data Advertising: We do not use students' answers, scores, progress, tutor conversations, uploaded content, or learning patterns to target advertising or third-party marketing. We do not sell student data to third parties. We may use account contact details, not learning activity or student-content data, to send Revise Right service emails and permitted Revise Right updates, with unsubscribe for non-essential emails.

If you are 13 to 17, you may use Revise Right only with permission from a parent or guardian, or where your school has authorised your use. Unless we separately tell you that a school-managed or parental-consent flow applies, we rely on your confirmation and may request more information or restrict access if eligibility is unclear. Parents can contact us to discuss a child's account where appropriate.

Data-protection rights belong to the child. A young person who can understand and exercise those rights can make a request themselves or authorise someone to act for them. We check identity, authority, the child's understanding and wishes, and their privacy and best interests before responding to a request made on their behalf.

Where a child cannot exercise their own rights, a person with parental responsibility may usually act for them in their best interests. Parental responsibility or payment for a subscription does not automatically give access to private conversations or the whole account.

Access, correction, deletion and withdrawal requests are subject to applicable legal requirements and exceptions. Withdrawing consent affects processing that relies on that consent; other lawful processing may continue. We assess requests individually and may ask for the child's authorisation or further information.

To make a request, contact the Revise Right Team at info@reviseright.io. Please describe your request and, if acting for a student, your relationship and authority. Do not send identity documents unless we request them through an appropriate secure process.

Weekly parent or guardian updates: A student may add the email address of a parent, guardian, or trusted adult for weekly revision summaries. We send a confirmation request first and do not share revision activity until the recipient approves. Summaries may include days active, questions answered, subjects studied, and progress. The student can see the recipient and status in Settings, and the recipient can unsubscribe from any update email. An invitation authorises those summaries, not access to other account information.

We may withhold or limit disclosure where necessary to protect the privacy rights of other users, maintain security, comply with law, or avoid disclosing information that cannot lawfully be shared.

We use a combination of technical safeguards, platform rules, and review processes intended to reduce the risk of students receiving unsafe, exploitative, sexually explicit, hateful, or otherwise age-inappropriate AI outputs.

If we identify prompts or outputs that raise safeguarding concerns, we may block the response, restrict access to the relevant feature, preserve records, and escalate serious cases to relevant authorities or support services where appropriate and lawful. We may contact a parent or guardian where doing so is justified and permitted.

Parents or guardians who believe a child has received unsafe content should contact info@reviseright.io and clearly mark the message as urgent safeguarding.

We use security measures to protect student data, including:

• Encryption of data in transit and at rest
• Secure authentication systems
• Security reviews and checks
• Access controls and monitoring

In the event of a personal data breach, we will provide notifications to affected users, parents, and relevant authorities as required by applicable law.

We retain student data for as long as the account is active or as needed to provide services. When an account is deleted, we remove personal data in line with applicable legal, regulatory, and operational requirements.

Current defaults for some operational records are more specific: tutor usage analytics events are retained for about 90 days, standard safety logs for about 180 days, and red-flag safeguarding alerts for about 365 days unless a longer period is required.

We may retain anonymised, aggregated data for analytical purposes after account deletion. This data cannot be linked to individual students.

Some records, such as billing data, support correspondence, and safeguarding or abuse-prevention logs, may be retained longer where reasonably necessary to meet legal obligations, resolve disputes, or protect users and the platform.

Under UK GDPR and the Data Protection Act 2018, you have important rights regarding your personal data:

• Right of Access: Obtain confirmation that we process your data and access a copy. We'll provide your data in a commonly used format (JSON or CSV) within applicable statutory timelines.
• Right to Rectification: Have inaccurate data corrected and incomplete data completed.
• Right to Erasure: Request deletion of your data when it's no longer necessary, you withdraw consent, or the data has been unlawfully processed.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format to transmit to another service.
• Right to Object: Object to processing for direct marketing, legitimate interests, or research purposes.
• Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing. Our systems do not make significant decisions without human review.
• Right to Withdraw Consent: Where we process data based on consent, you can withdraw it at any time through your account settings.

To exercise any of these rights, contact us at info@reviseright.io with your name, email address, and the right you wish to exercise.

Response Time: We respond to valid requests within applicable statutory timelines (typically one month). If your request is complex, we may extend this where permitted by law and will notify you accordingly.

No Fee: Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

We encourage you to contact us first at info@reviseright.io so we can try to resolve your concern directly.

We aim to acknowledge privacy and safeguarding complaints within 5 business days and to respond substantively as quickly as reasonably possible. Particularly urgent child-safety concerns may be triaged sooner.

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority:

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Website: ico.org.uk

Phone: 0303 123 1113