Privacy policy

A Quick Guide for Students

This summary is written for you. The full policy is below.

What we collect. Your email address, display name, exam year, target grade, subjects, exam boards, and how you use revision features (flashcard answers, mock scores, notes, and AI marking results). If you use voice or photo marking, those recordings and images are processed to give you a mark and then deleted straight away.

Why. Only to run GCSE Genius: scheduling your revision, marking your work, coaching you through the AI tutor, and sending reports you or your parent asked for. We never sell your data or show you adverts. We do not train AI models ourselves. Our AI platform provider’s terms restrict how your data may be used when it is processed for marking or tutoring; you or your parent can ask us for details.

Who sees it. Our platform provider Lovable, which runs our database (Supabase, in Ireland), our AI features, and our emails. When you use AI marking or the AI tutor, your question or answer may also be processed by Anthropic, OpenAI, or Google to generate a reply. Nobody else sees your data.

Your choices. You can ask to see, correct, export, or delete your data at any time. Your parent or guardian can do the same on your behalf. Deleting your account removes everything.

Questions. Email help@wiseguys-advisory.com.

1. Who We Are

GCSE Genius is operated by WiseGuys Advisory Ltd (company number 17121982), registered at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“we”, “us”, or “our” in this policy). We are the data controller for personal data collected through GCSE Genius. For questions about this policy or your data, contact us at help@wiseguys-advisory.com.

2. What We Collect

2.1 Account information. Email address, display name, exam year, and target grade. For parent or guardian accounts: name, email address, and the link between the parent account and the student account.

2.2 Study choices. Subjects, exam boards, set texts, and chosen AI tutor character.

2.3 Revision activity. Flashcard answers, mock scores, notes, mistakes log, and AI marking results.

2.4 Tutor conversations. Messages typed or spoken during AI tutor sessions.

2.5 Voice recordings and photographs. When a student uses voice input or photographs a written answer for AI marking, the recording or image is sent to our AI provider solely to generate a mark or response. Recordings and photographs are deleted from our systems once marking is complete and are not stored beyond that point.

2.6 Technical data. Device type, browser type, and basic usage data (such as pages visited and session length) to keep the service running and to identify problems.

3. Why We Use Your Data and Our Legal Basis

We process personal data only to run GCSE Genius. We do not sell data or display advertising. We do not use personal data to train AI models ourselves; our AI platform provider’s terms govern how inference data may be used, and details are set out in section 4.2.

3.1 Providing the service. Scheduling revision, generating flashcards, marking answers, running AI tutor sessions, and sending reports that a student or parent has requested. Our lawful basis is our legitimate interest in providing the educational revision service the student has signed up to. We have carried out a Legitimate Interest Assessment, taking into account the age of our users, and are satisfied that our interest does not override users’ rights.

3.2 Safety and moderation. Reviewing content flagged by users or by our automated filters to keep the service safe. Our lawful basis is our legitimate interest in protecting users, particularly children.

3.3 Service maintenance. Fixing bugs, monitoring performance, and improving features. Our lawful basis is our legitimate interest in maintaining a reliable service.

4. Who We Share Data With

We share personal data only with the following categories of processor, and only to the extent necessary to provide the service. All processing described below is managed through a single platform provider, Lovable (lovable.dev), which acts as our primary processor.

4.1 Database and hosting (Supabase). Our database, authentication, and storage services are provided by Supabase (supabase.com) through the Lovable platform. Account data, revision activity, and tutor conversation logs are stored on Supabase servers located in Ireland within the European Economic Area. The United Kingdom recognises the EEA as providing an adequate level of data protection, so no additional transfer safeguards are required for this data.

4.2 AI model providers (Anthropic, OpenAI, Google). When a student submits a question, answer, voice recording, or photograph for AI marking or tutoring, the data is sent through Lovable’s AI gateway to one or more underlying AI model providers, which act as subprocessors. The providers currently available through Lovable’s gateway are Anthropic, OpenAI, and Google. These providers are based in the United States. Lovable’s gateway may route a request to any of these providers depending on the feature and model configuration. AI inference requests may be processed on servers in the United Kingdom or the United States, depending on routing. Student data sent for AI processing is used to generate the requested mark, response, or tutoring output. Lovable’s terms restrict how data submitted by an app’s users may be processed by its AI infrastructure. We monitor these terms and will update this policy if there is a material change to how AI inference data is handled. Details of the current restrictions are available on request by emailing help@wiseguys-advisory.com.

4.3 Email (Lovable and Supabase). Transactional emails (such as parent verification emails, password resets, and requested reports) are sent through the email infrastructure provided by Lovable and Supabase. These emails are processed using the same Supabase infrastructure described in section 4.1. No separate third-party email provider is used. We do not share personal data with any other third parties.

5. International Transfers

5.1 Database, hosting, and email. Account data, revision activity, tutor conversation logs, and transactional emails are stored and processed by Supabase on servers in Ireland within the

European Economic Area. The United Kingdom has made adequacy regulations recognising the EEA as providing an adequate level of protection for personal data. No additional transfer mechanism is required.

5.2 AI processing. Student data sent through Lovable for AI marking and tutoring may be processed on servers in the United Kingdom or the United States. The underlying AI model providers (Anthropic, OpenAI, and Google) are based in the United States. Where personal data is transferred to the United States, it is protected by: (i) the UK Extension to the EU-US Data Privacy Framework, where the recipient is a certified organisation; or (ii) the UK International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as applicable.

5.3 Details on request. You may request details of the specific safeguards we rely on for any international transfer by contacting us at help@wiseguys-advisory.com.

6. Automated Decision-Making and AI

GCSE Genius uses artificial intelligence to mark answers and to provide tutoring through AI tutor characters.

6.1 AI marking. When a student submits an answer for marking, it is assessed by an AI model against a mark scheme. The AI assigns a score and provides feedback. AI marking is a revision tool; it is not a substitute for a teacher’s assessment, and it can make mistakes. Every AI mark is shown alongside the mark scheme so the student can check it. Every AI mark includes a “This marking looks wrong” button that sends it to our team for human review.

6.2 AI tutoring. The AI tutor generates responses based on the student’s questions and the conversation history within that session. Tutor characters are AI, not real people.

6.3 No solely automated decisions with legal or significant effect. AI marking and tutoring are revision aids. They do not produce decisions that have a legal effect on any user or that significantly affect any user in a similar way. If a student believes an AI mark or response is incorrect, they can flag it for human review at any time using the button described in section 6.1.

7. Children and Young People

GCSE Genius is designed for students aged 14 to 16. We take our responsibilities to young users seriously and comply with the ICO’s Age Appropriate Design Code (the Children’s Code).

7.1 Minimum age. Students under 13 may not use GCSE Genius. During sign-up, students confirm their date of birth. Accounts that we reasonably believe belong to users under 13 will be removed and all associated data deleted.

7.2 Parent or guardian verification. When a student creates an account, they must provide a parent or guardian’s email address. The parent or guardian receives a verification email and must confirm they are aware of and agree to their child’s use of the service. Until verification is complete, the student may access flashcards and practice questions but may not use AI marking or AI tutor features.

7.3 Parental access and control. A verified parent or guardian may at any time: (i) view their child’s revision activity and reports; (ii) request a copy of their child’s personal data; (iii) request correction of inaccurate data; and (iv) delete their child’s account and all associated data.

7.4 Data minimisation. We collect only the personal data needed to provide the revision features a student is actively using. Student profiles are set to private by default. We do not profile students for advertising or marketing purposes. We do not use geolocation.

7.5 Best interests. The best interests of our young users are a primary consideration in how we design and operate GCSE Genius. We do not use design patterns that encourage students to share more personal data than is necessary for their revision, to extend their time on the service beyond what their revision requires, or to weaken their privacy protections.

7.6 Age-appropriate defaults. All privacy and data-sharing settings are set to their most protective level by default. Students cannot lower these settings. Nudge techniques, reward loops, and other design features intended to extend engagement are not used.

8. How Long We Keep Your Data

We keep personal data for as long as the account exists.

8.1 Account deletion. A student or verified parent or guardian may delete the account at any time from Account, then My subjects, tutor and settings, then Delete account. Deletion permanently removes the account and all associated revision data, notes, tutor conversations, and AI marking results. The deletion process begins immediately.

8.2 Voice recordings and photographs. As described in section 2.5, these are deleted once marking is complete. They are not stored.

8.3 Backups. Routine encrypted system backups may retain copies of deleted data for up to 30 days after account deletion, after which they are permanently overwritten. During this period, backup data is not accessible to any user or staff member and is not used for any purpose.

9. Your Rights

Under UK GDPR, every user (and a parent or guardian acting on behalf of a student under 18) has the right to: 1. Access: receive a copy of the personal data we hold about them. 2. Rectification: ask us to correct inaccurate personal data. 3. Erasure: ask us to delete their personal data. 4. Restriction: ask us to limit how we use their personal data in certain circumstances. 5. Data portability: receive their personal data in a structured, commonly used, machinereadable format. 6. Object: object to our processing of their personal data where we rely on legitimate interests as our lawful basis. Where a user objects, we will stop processing unless we can demonstrate compelling legitimate grounds that override the user’s interests. 7. Automated decision-making: not be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects on them. To exercise any of these rights, email help@wiseguys-advisory.com. We will respond within one calendar month. If we need more time (up to two further months for complex requests), we will tell you within the first month and explain why.

10. Complaints

If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner’s Office: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Website: ico.org.uk. Telephone: 0303 123 1113. We would appreciate the chance to address your concern first, so please contact us at help@wiseguys-advisory.com before raising a complaint with the ICO.

11. Changes to This Policy

If we make changes to this policy, we will update the “Last updated” date at the top. If we make changes that materially affect how we use personal data, we will notify users and verified parents or guardians by email or through a notice within the service at least 14 days before the changes take effect.

12. Contact

WiseGuys Advisory Ltd Company number: 17121982 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ Email: help@wiseguys-advisory.com