Privacy policy

Who we are

This service is run by [your trading name and company number, if any], trading as PrepGrid. We are the data controller for everything described here.

For anything in this policy — including a request to see, correct or delete your data — write to prep11.uk@gmail.com. We aim to answer within a few days, and are required to answer within one month.

Our postal address is [postal address — required on a privacy policy].

What we collect

• Your email address. Either the one you typed when you signed up, or the one your school account gave us when you signed in with Google or Microsoft. This is the only thing we hold that identifies a person.
• Your password, if you chose one. It is stored only as a hash by our authentication provider and we never see it. If you sign in with a school account there is no PrepGrid password at all.
• Your answers. Which question, what you chose or wrote, whether it was right, and when. For written answers this includes the text you wrote and the marks it was given.
• Which advert brought you here, if one did. If you arrive from one of our adverts, its campaign name (for example “youtube / video”) is saved on your account when you sign up, so we can tell whether our advertising works. It is the name of the advert, nothing about you, and it needs no cookie.
• Which classes you are on, and which tasks were set to you.
• Sign-in activity — when you last signed in, and whether your email is confirmed.
• Billing details, if you subscribe as an individual. Card numbers are handled entirely by Stripe and never reach our servers; we store only Stripe’s customer and subscription identifiers and the status of the subscription. Schools are invoiced and pay by bank transfer, so no card details exist for them at all.

We do not collect real names. We never ask for one, there is no field for one, and a teacher’s class register shows email addresses because that is the only name we have.

What a teacher can see

A teacher sees the work they set: who answered what on their tasks, the marks, and a report built from those tasks for their own class.

A teacher does not see revision a student does on their own. Practice you choose yourself, outside a task your teacher set, is yours. This is enforced by the database rather than by policy — the rules that decide what a teacher’s account can read are scoped to the tasks they set — and the student report page says so on the page itself.

Who else sees your data

• Supabase hosts our database and handles sign-in. Data is stored in [the region your Supabase project is in — check the dashboard].
• Vercel hosts the website itself.
• OpenAI marks written answers. See the next section — this is the one worth reading properly.
• Stripe takes card payments from individual subscribers.
• Google provides Google Analytics, but only if you press Accept on the cookie notice. See “Cookies and analytics” below.

We do not sell data and we do not share it for advertising. The only cookies we set without asking are the ones that keep you signed in.

Cookies and analytics

The first time you visit, we ask whether we may use Google Analytics. If you say no, or do not answer, nothing is loaded from Google and no analytics cookie is set. Saying no does not change anything you can do on PrepGrid.

If you say yes, Google Analytics records which pages are visited, roughly where in the world from, what kind of device, and how the visit started — for example from a YouTube advert or a search. We use it to see what is being used and whether our adverts bring people who sign up. We turn off Google’s advertising features: it is not used to build advertising audiences, and we never send it your email address or any account identifier. Its cookies are named _ga and _ga_ followed by a code, and last up to two years unless you clear them.

You can change your mind at any time with the “Cookie settings” link at the bottom of the home page, which also removes the cookies from this browser. You can also open it here: Cookie settings.

AI marking, and what is sent

When a student asks for a written answer to be marked, we send the question, its mark scheme, and the text the student wrote to OpenAI, which returns a mark and feedback. We do not send the student’s email address, their name, their school, or any identifier — the request contains the answer and nothing that says whose it is.

OpenAI is in the United States, so this is a transfer outside the UK. It is covered by [the transfer mechanism you are relying on — OpenAI’s DPA and SCCs, once signed].

Multiple-choice answers are never sent anywhere. They are marked by comparing them with the stored answer, on our own servers.

How long we keep it

Your account and your answers are kept while your account exists, because the point of them is to show progress over two years of a GCSE course.

If you delete your account, we delete your answers with it. A teacher deleting a class removes the class and its tasks; the students keep their accounts and their own work.

Inactive accounts are deleted after [a retention period you decide — 24 or 36 months is usual].

Schools

When a school buys a licence, the school decides which students use PrepGrid and for what. In data protection terms the school is the controller for its students’ use of the service and we act on its instructions; we remain the controller for our own account and billing records.

A school that needs a data processing agreement or a completed DPIA questionnaire should write to the address above and we will provide one. [Have a DPA ready before the first school asks — they will ask.]

Your rights

You can ask to see what we hold about you, to correct it, to delete it, or to receive a copy of it. Write to the address above. If you are unhappy with how we have handled a request you can complain to the Information Commissioner’s Office at ico.org.uk.

If you are a student under 18 and would rather a parent or your teacher asked on your behalf, that is fine — we will answer either.

Changes

If we change this policy we will change the date at the top. If a change materially affects what we do with your data, we will say so on the site rather than only here.