Privacy Policy | Achieve Academy

1. Who We Are

Achieve Academy ("we", "our", "us") is the data controller for the personal data we process about users of this website. We provide free GCSE revision resources and a paid Premium subscription for UK students.

You can contact us by email at info@achieve-academy.co.uk. The Site is operated, and personal data is controlled, by Achieve Academy London Limited (trading as Achieve Academy), a private limited company registered in England and Wales (company registration number 17467724), with registered office at 124 City Road, London, EC1V 2NX, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) as a data controller under registration reference ZC255889.

2. Information We Collect

We may collect the following personal data:

Account information: Email address and password when you create an account to track your revision progress.
Profile details (optional): Display name, full name, school, year group, and your exam board and science-route choices, which we use to tailor content.
Suggestions and feedback: Anything you submit through our suggestions or feedback forms.
Session and security data: Sign-in session records, including IP address and device/browser information, kept by our authentication provider to keep your account secure.
Contact messages: Your name, email address, and the contents of any message you send us via our contact form. We also record the sender's IP address for spam prevention and delete it after 30 days.
Usage data: Revision progress, quiz scores, bookmarks, and notes progress stored against your account.
Subscription data: Your Premium subscription status and billing period, linked to your account so we can provide Premium features. Payment card details are handled entirely by Paddle — we never see or store them.
Technical data: Browser type, device information and IP address, recorded in our hosting provider's server logs. We do not use advertising or cross-site tracking cookies, and we do not build marketing profiles of visitors.
Educational progress insights (Premium): For Premium members we analyse your own quiz scores, question progress and flashcard reviews to show a readiness score, projected grade, weak-topic heatmap and suggested next topics. This is a form of profiling carried out solely to support your revision, based on our contract with you; it has no legal or similarly significant effect, is never used for advertising, and you can ask us to delete this data at any time.

3. How We Use Your Information

To provide and personalise our revision resources and track your progress.
To provide and manage Premium subscription features and entitlements.
To respond to messages and enquiries you send us.
To improve our website and educational content.
To send important service-related communications (e.g. password resets, renewal reminders).
To prevent fraud and ensure website security.

We will never sell your personal data to third parties.

4. Legal Basis for Processing (UK GDPR)

We process your data on the following legal bases:

Contractual necessity: To provide the services you have requested, including your account, revision progress, and Premium subscription.
Consent: When you agree to marketing communications.
Legitimate interests: To improve our services, ensure website security, and prevent fraud.
Legal obligation: Where we are required to retain records for tax or legal compliance.

5. Data Sharing & Recipients

We do not sell your personal data. We share it only with the following categories of recipients, each bound by appropriate data-protection terms:

Paddle — our Merchant of Record for the sale of Premium subscriptions. Paddle handles subscription management, payments, tax compliance, and invoicing. Paddle processes payment data (including card details) on its own systems; Achieve Academy does not receive or store your card details. See the Paddle Privacy Policy.
Supabase (database, authentication and file storage) — stores your account, revision progress, and any files you access. See the Supabase Privacy Policy.
Our cloud hosting and AI-infrastructure providers (web hosting and the gateway used to generate revision content, diagrams and quiz feedback).
Professional advisers (legal and accounting) where necessary.
Authorities where required by law.

6. Data Storage & Security

Your data is stored securely using industry-standard encryption and hosted on secure cloud infrastructure. We implement appropriate technical and organisational measures — including encryption in transit and at rest, and strict access controls — to protect your personal data against unauthorised access, loss, or misuse.

Our core account and revision data is stored in the UK/EEA. Some of our providers (including Paddle, our email provider, and hosting/AI infrastructure) may process data in other countries, including the United States. Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK–US Data Bridge.

7. Use of AI

We use artificial-intelligence (AI) models behind the scenes to help produce and check our learning materials. Specifically, AI is used by our team to:

Generate and refine revision notes, worked examples and diagrams, which our team then reviews.
Review the quality of revision materials internally (for example, checking diagrams for accuracy).

Your answers are not sent to any AI provider. Quizzes and practice questions are marked entirely within your own browser by our own matching logic — no answer text, and no personal data of any kind, leaves your device to be marked. AI is only used on our side when preparing the content itself, before you ever see it.

We do not use AI to make solely automated decisions that produce legal or similarly significant effects about you (for example, no automated decisions about exam grades, school admissions or eligibility for our services).

AI outputs can occasionally be inaccurate. We work to correct mistakes promptly, but you should always check important facts against your official exam-board specification and class teacher.

8. Data Retention

We retain your account data for as long as your account is active. Subscription records are retained for as long as needed to provide the service and meet tax/legal obligations, then deleted or anonymised. Contact messages are retained for up to 12 months after your last communication with us. You may request deletion of your data at any time.

9. Cookies

We use essential cookies to keep you signed in and remember your preferences (e.g. theme, exam board selection). We do not use advertising or third-party tracking cookies, and we do not profile you for behavioural advertising. You can manage your cookie preferences at any time using the cookie banner. Essential storage does not require consent under PECR because it is strictly necessary to provide the service you request.

The items we store in your browser are: sb-*-auth-token (keeps you signed in; until you sign out), theme (light/dark preference), achieve-cookie-consent and achieve-cookie-log (your cookie choice and when you made it), and preference items for exam board, tier and study progress. None of these are used for advertising.

When you accept or decline via the cookie banner, we record your choice and the date and time of that choice in your own browser's local storage so that we can evidence the consent given and honour it on future visits. This record stays on your device and is not sent to us or to any third party.

10. International Users

This Site is aimed at students studying UK GCSE qualifications, and our services are directed at users in the United Kingdom. You are welcome to use the Site from other countries, but the content is UK-specific and we do not target or market to users outside the UK.

Wherever you access the Site from, your personal data is stored and processed on infrastructure located in the United Kingdom and the European Economic Area, and is protected under UK GDPR standards. If you are in the EEA, the rights described in this policy apply to you in substantially the same way under the EU GDPR, and you may also complain to your local data-protection authority. If you are in a country whose data-protection law is different, you should be aware that your data will be handled under UK law.

Prices for Premium are shown in pounds sterling and include UK VAT where applicable; our payments partner Paddle applies the correct local tax for your country at checkout.

11. Data Breaches

We keep an internal record of any personal-data breach. If a breach is likely to result in a risk to your rights and freedoms, we will report it to the UK Information Commissioner's Office within 72 hours of becoming aware of it, as required by UK GDPR. If the breach is likely to result in a high risk to you, we will also contact you directly by email without undue delay, telling you what happened, what data was involved, what we are doing about it and what steps you should take (for example, changing your password).

12. Your Rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you.
Request rectification of inaccurate data.
Request erasure of your data ("right to be forgotten").
Restrict or object to processing of your data.
Data portability — receive your data in a structured, commonly used format.
Withdraw consent at any time (where processing is based on consent).
Lodge a complaint with the UK supervisory authority.

We respond to valid requests within one month. To exercise any of these rights, please contact us at info@achieve-academy.co.uk.

You also have the right to lodge a complaint with the UK supervisory authority if you believe we have not handled your personal data in accordance with UK data-protection law. You can contact the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would, however, appreciate the chance to address your concerns first — please contact us before approaching the ICO.

13. Children's Privacy

The Site is intended for users aged 13 and over (primarily GCSE students). We do not knowingly collect personal data from children under 13. Everyone creating an account must confirm, by ticking a required box at sign-up, that they are 13 or older; an account cannot be created without this confirmation. This is an age self-declaration proportionate to the low-risk nature of our service — we deliberately do not ask for a date of birth or any identity document, as that would mean collecting more personal data about children than we need.

If you believe a child under 13 has created an account, please contact us at info@achieve-academy.co.uk and we will delete the account and any associated data.

Because our users are children under 18, we follow the principles of the ICO's Age Appropriate Design Code: we minimise the data we collect, default privacy settings to high, use plain language, do not profile users for marketing, and do not show advertising of any kind. Parents and guardians may contact us at any time to review, correct or delete their child's data.

Premium subscriptions are intended to be purchased by a parent or guardian on behalf of a student. The checkout process is conducted by Paddle; Achieve Academy does not collect payment card details.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at info@achieve-academy.co.uk, or write to us at Achieve Academy London Limited, a private limited company registered in England and Wales (company registration number 17467724), 124 City Road, London, EC1V 2NX, United Kingdom. ICO registration reference: ZC255889.

Data protection contact: For data-protection matters, including subject access requests and other rights under UK GDPR, our data protection contact is info@achieve-academy.co.uk. We respond to valid requests within one month, as set out in Section 12.