Privacy Policy

5.1 AI Processing: Documents and content you upload are sent to third-party AI providers for processing, including content generation, question creation, and summarisation. These providers process data according to their own privacy policies and terms of service.

5.2 Data Sent to AI Providers: The following data may be sent to AI providers:

• Uploaded document text and content
• Learning lesson titles and descriptions
• User-provided instructions and preferences
• Subject categories and educational context
• Learner profile data including learning needs, subject choices, interests, and aspirations
• Learning history and performance data including accuracy, misconceptions, and mastery levels
• Conversation history from AI chat sessions for contextual continuity
• Hint and retry interaction data to inform adaptive teaching responses

5.3 Data Sent for AI Processing: To provide a genuinely personal learning experience, our AI features process the learner's first name alongside educational context and performance data. This allows the Cogsy learning assistant, progress insights, chat engagement analysis and answer explanations to address the learner warmly by name and tailor their guidance. We practise data minimisation: we only ever send the information needed for the feature to work, and we do not send full contact details such as email addresses or postal addresses to AI providers. We do not sell this data, and it is only used to deliver the educational features you have consented to.

5.4 AI Profiling: We use AI to automatically generate learner preference profiles and communication profiles based on platform interaction data. This profiling is performed to provide a personalised educational experience. You can request deletion of these AI-generated profiles at any time (see Section 10).

5.5 Third-Party AI Providers: We use multiple AI providers including OpenAI and Google (Gemini). Please review their respective privacy policies. The specific providers and models may change without notice as we optimise service quality. As described in Section 5.3, we minimise the personal data shared with these providers to what is needed to deliver each feature.

5.6 Hosting: Your data is stored on secure cloud infrastructure, which provides secure hosting, authentication, and database services. Data is stored in secure, encrypted databases.

6.1 Within the Platform:

• Parent and teacher accounts can view data for child/learner accounts they supervise, including learning progress, session history, and performance metrics
• Admin accounts can access user information for platform management and support purposes
• Leaderboard entries display pseudonymous display names and aggregate statistics

6.2 Third-Party Processors:

• OpenAI (for AI content generation)
• Supabase (for hosting and authentication)
• Stripe (for payment processing, if applicable)

6.3 Legal Requirements: We may disclose your data if required by law, court order, or governmental authority.

6.4 Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity.

6.5 No Selling of Data: We do not sell, rent, or trade your personal data to third parties for marketing purposes.

7.1 Supervised Accounts: Child and learner accounts must be created and supervised by a parent or teacher account holder who is 18 years or older.

7.2 Parental Control: Parents and teachers have full access to view, manage, and delete data associated with child/learner accounts they supervise. Primary parents retain exclusive control over critical account actions including permission management and account deletion.

7.3 Multiple Guardians: A child account may be linked to multiple guardians (parents and teachers). Each guardian can view the child's learning data. The primary parent controls which guardians have access.

7.4 Comprehensive Profiling of Children: We collect detailed data about child learners to provide a personalised educational experience. This includes:

• Special educational needs and diagnoses (provided by the supervising adult)
• Subject choices, exam boards, and target grades
• Personal interests, likes, dislikes, and aspirations
• Examination schedules (mock and final exam dates)
• Weekly study schedules
• AI-inferred personality and communication traits (learning style, motivation type, responsiveness to humour and challenge)
• Detailed learning analytics (concept mastery, misconceptions, hint usage, retry patterns, gap quiz outcomes)
• AI chat conversations between the child and our AI learning assistant

7.5 Purpose Limitation: All data collected about children is used solely for educational purposes: to personalise learning content, adapt AI teaching approaches, track progress, and provide reports to supervising adults. We do not use children's data for any other purpose.

7.6 No Marketing: We do not use children's data for marketing purposes, third-party advertising, or behavioural targeting outside the educational context of this platform.

7.7 AI Profiling Safeguards: AI-generated profiles about children (learning preferences, communication style, personality traits) are used exclusively to improve the educational experience. These profiles:

• Are not shared with any third party for non-educational purposes
• Can be viewed by linked guardians at any time
• Can be deleted upon request from the primary parent
• Are automatically deleted when the child's account is deleted

7.8 Data Minimisation: While we collect detailed educational data, we do not collect unnecessary personal information from children such as location data, social media accounts, or browsing history outside the platform.

7.9 Age-Appropriate Design: Our platform is designed with children's privacy in mind. The AI assistant operates within strict educational boundaries and does not solicit personal information beyond what is needed for learning.

8.1 Storage Location: Your data is stored on Supabase servers. Please refer to Supabase's documentation for information about data center locations.

8.2 Security Measures: We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of passwords using secure hashing algorithms
• Row-level security (RLS) policies to restrict data access
• Regular security audits and monitoring
• Access controls and authentication mechanisms

8.3 No Absolute Security: While we take security seriously, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

9.1 Active Accounts: We retain your data for as long as your account is active and you continue to use our services.

9.2 Account Deletion: If you delete your account, we will delete your personal data within 90 days, except where we are required to retain it for legal or regulatory purposes.

9.3 Backup Data: Backup copies may be retained for up to 90 days for disaster recovery purposes.

9.4 Legal Retention: Some data may be retained longer if required by law or for legitimate business purposes (e.g., audit logs for security incidents).

10.1 Right to Access: You can request a copy of the personal data we hold about you.

10.2 Right to Rectification: You can request correction of inaccurate or incomplete data.

10.3 Right to Erasure: You can request deletion of your personal data (subject to legal obligations).

10.4 Right to Restrict Processing: You can request that we limit how we use your data.

10.5 Right to Data Portability: You can request your data in a structured, machine-readable format.

10.6 Right to Object: You can object to processing based on legitimate interests.

10.7 Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

10.8 Right to Lodge a Complaint: You can file a complaint with the Information Commissioner's Office (ICO) if you believe we have mishandled your data.

To exercise these rights, contact us at: info@sidecog.com

11.1 Essential Cookies: We use cookies to:

• Maintain your login session
• Remember your authentication state
• Provide core platform functionality

11.2 Advertising Measurement on Public Pages: On our public marketing pages only, we use the Meta (Facebook) Pixel to measure how well our advertising works. It records that a step happened, such as a page view, a diagnostic being started or finished, an account being created or a subscription starting. It is never loaded inside the signed-in learning area, and we never send Meta any child or learner information: no names, email addresses, answers, subjects, results, scores or report content. The only additional detail sent is the price of a subscription.

11.2.1 Opting Out: Blocking third-party scripts in your browser, or using an ad or tracking blocker, stops this measurement entirely and has no effect on how the platform works.

11.3 Browser Controls: You can control cookies through your browser settings, but disabling essential cookies may prevent the platform from functioning properly.