1. Who we are
Avero Learning ("we", "us") is the data controller for personal data collected through the Avero Learning platform. Our registered details are: [Company name] Ltd, company number [00000000], registered office [registered address]. Our nominated contact for data protection queries is [name/role, or "our support team" until a Data Protection Officer is appointed] at Joshua@averolearning.co.uk.
2. Children's accounts
Much of our Service is used by children under 18. Where a child is under 13, a parent or guardian must create the account and provide consent on the child's behalf, in line with UK GDPR requirements for "information society services" offered to children. We design our data collection to be proportionate and age-appropriate, consistent with the ICO's Children's Code (Age Appropriate Design Code). [Confirm the actual account-creation flow — e.g. whether a parent/guardian account creates linked child profiles — matches this description before publishing.]
3. What we collect
- Account data: full name, email address, account role (student, parent/guardian, tutor), year/grade level.
- Usage data: lesson and quiz activity, quiz scores, booking history, pages visited, and similar interaction data used to run and improve the Service.
- AI interaction content: messages sent to the AI tutor chat, homework helper, and quiz generator, and any images uploaded to the homework helper. This content is sent to our AI provider (see section 5) to generate a response.
- Payment data: we do not store card numbers. Subscription payments are handled by Stripe, our payment processor, who collects and processes payment details directly under their own privacy policy.
- Live session data: video and whiteboard sessions run through our video provider. See our Safeguarding Policy for our session monitoring/recording approach. [Confirm here whether sessions are recorded, and for how long recordings are retained, before publishing.]
- Technical data: IP address, browser type, and similar data collected automatically, and via cookies (see section 8).
4. How we use your data and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing the AI tools, lesson content, and tutor bookings you've signed up for | Performance of a contract |
| Processing subscription payments | Performance of a contract |
| Keeping the Service secure and preventing misuse, including safeguarding | Legitimate interests / legal obligation |
| Sending you service updates (e.g. booking confirmations) | Performance of a contract |
| Sending optional marketing communications | Consent (you can withdraw this at any time) |
5. Who we share data with
We share data with the following processors, each acting under a data processing agreement, only to the extent needed to provide the Service:
- Supabase — hosts our database and handles authentication.
- Anthropic — processes AI tutor chat, quiz generation, homework helper, and progress insight requests to generate responses.
- Stripe — processes subscription payments.
- Daily.co — provides the live video infrastructure for tutor sessions.
We do not sell personal data. We may disclose data where required by law, or to protect the safety of a child or other user (see our Safeguarding Policy).
6. International transfers
Some of the processors listed above may store or process data outside the UK. Where they do, we rely on the UK's International Data Transfer Agreement, an adequacy decision, or equivalent safeguards. [Confirm the actual data residency/transfer mechanism for each processor above before publishing.]
7. How long we keep data
We keep account and usage data for as long as the account is active, and for a reasonable period afterwards to meet legal, accounting, and safeguarding record- keeping obligations. [Set and document specific retention periods per data category — e.g. AI chat logs, session recordings, safeguarding reports — before publishing.]
8. Cookies
We use essential cookies required to keep you logged in and the Service functioning. [Add detail here, and a consent banner, if you introduce analytics or marketing cookies.]
9. Your rights
Under UK GDPR, you (or a parent/guardian on a child's behalf) have the right to:
- Access the personal data we hold about you;
- Have inaccurate data corrected;
- Request erasure of your data, subject to our legal retention obligations;
- Restrict or object to certain processing;
- Receive your data in a portable format; and
- Withdraw consent at any time where we rely on consent.
To exercise any of these rights, contact us at Joshua@averolearning.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
10. Security
We use reasonable technical and organisational measures — including encrypted connections, access controls, and row-level security on our database — to protect your data. No system is completely secure, and we encourage you to use a strong, unique password.
11. Changes to this policy
We may update this policy from time to time. We'll post the updated version here with a new "last updated" date.
12. Contact us
Questions about this policy or your data? Contact us at Joshua@averolearning.co.uk — see also our Contact page.