Privacy Policy

1. Who we are

Avero Learning ("we", "us") is the data controller for personal data collected through the Avero Learning platform, which is operated by Joshua Sebastian John, trading as Avero Learning, a UK sole trader. Until a dedicated Data Protection Officer is appointed, our nominated contact for data protection queries is Joshua Sebastian John at Joshua@averolearning.co.uk.

2. Children's accounts

Much of our Service is used by children under 18. Where a child is under 13, we ask a parent or guardian to create and hold the single account on the child's behalf — there is no separate child profile — in line with UK GDPR requirements for "information society services" offered to children. We design our data collection to be proportionate and age-appropriate, consistent with the ICO's Children's Code (Age Appropriate Design Code).

3. What we collect

This is a specific list of what the Avero Learning platform actually collects and stores today, not a general statement — kept up to date as the product changes:

• Account data: full name, email address, account role (student, tutor, admin), year/grade level, phone number (used for session reminders and to reach a parent/guardian if something comes up during a live session), and profile photo, where provided.
• Usage data: quiz topics, generated questions, your answers, and scores; booking history (subject, time, status); and, for tutors, subjects taught, bio, hourly rate, and DBS verification status.
• Tutor identity checks: before a tutor is approved, an administrator checks a photo ID document against the name on their DBS certificate. We record only that the check happened — the document type, the date, and which administrator carried it out. We do not upload, copy, or store the document itself, so there is no ID image held anywhere in this system. See our Safeguarding Policy section 3.
• AI interaction content: what we send to Google's Gemini API (see section 5), and what we keep afterwards, is different for different features:
  • The AI tutor chat and homework helper send your message (and, for the homework helper, any image you upload) to generate a response. We do not store this content in our own database afterwards — it exists only for the duration of that request.
  • The practice quiz generator stores the AI-generated questions along with your answers and score, so your progress can be tracked over time and shown back to you and your tutor.
  • A guided AI lesson with our AI helper, Ava, stores the full transcript of what was said on both sides, along with which questions you got right and any misconceptions Ava noticed. We keep this so a parent or tutor can review exactly what was said, and so we can check the lesson taught what it was meant to. We do not store any audio — speech is recognised on your device and only the resulting text is kept.
• What Google does with content we send it: under Google's Gemini API terms, content sent on a Paid Service is not used to train or improve Google's products. Because we operate from the United Kingdom, this Paid Service data protection applies to everything we send Google, including any unpaid usage. Google does still log prompts and responses for up to 55 days, solely to detect abuse of its acceptable use policy, and that data may be processed or cached in any country where Google or its data processors operate. See Google's Gemini API Additional Terms of Service for the current, authoritative version of these terms.
• Payment data: we do not store card numbers. All payments — subscriptions, per-session bookings, and the card held (but not charged) to secure a free trial slot — are handled by Stripe, our payment processor, who collects and processes payment details directly under their own privacy policy. We store a reference to your Stripe customer, subscription, and payment IDs only.
• Live session data: video and whiteboard sessions run through our video provider, Daily.co. Sessions are not currently recorded — see our Safeguarding Policy for our full session monitoring approach.
• Messages: if a student and tutor have had a confirmed session together, either can send the other text messages through our own messaging feature. We store the message content, and it's visible to both participants and to administrators for safeguarding review — see our Safeguarding Policy.
• Contact form data: if you use our public contact form, we collect your name, mobile number, email address, your child's school year (optional), your message, and whether you've opted in to marketing updates.
• Technical data: IP address, browser type, and similar data collected automatically, and via cookies (see section 8).

4. How we use your data and our legal basis

5. Who we share data with

We share data with the following processors, each acting under a data processing agreement, only to the extent needed to provide the Service:

• Supabase — hosts our database and handles authentication.
• Google (Gemini API) — processes AI tutor chat, quiz generation, homework helper, progress insight, and Ava AI lesson requests to generate responses. See section 3 for what this involves and what Google does with it.
• Stripe — processes subscription payments.
• Daily.co — provides the live video infrastructure for tutor sessions.

We do not sell personal data. We may disclose data where required by law, or to protect the safety of a child or other user (see our Safeguarding Policy).

6. International transfers

Some of the processors listed above may store or process data outside the UK:

• Google (Gemini API) — content may be stored or cached in any country where Google or its data processors maintain facilities, under the safeguards in Google's Gemini API terms (see section 3).
• Supabase — transfers are covered by Standard Contractual Clauses, with the UK Addendum to those clauses forming part of Supabase's data processing agreement for UK transfers specifically.
• Stripe — transfers are covered by Standard Contractual Clauses or the EU-US Data Privacy Framework, with the UK International Data Transfer Addendum applying to transfers from the UK specifically.
• Daily.co — Daily is certified under the EU-US and Swiss-US Data Privacy Framework. [The specific UK transfer mechanism in Daily's Data Processing Addendum should be confirmed by requesting and keeping a signed copy on file — their public pages describe the DPA's existence but not its transfer clause in a form that can be safely summarised here without the source document.]

7. How long we keep data

We keep data for as long as your account is active. After it closes:

• Account and booking data (profile, booking history, homework, quiz results) is kept for 6 years, reflecting standard UK limitation-period practice for education records.
• AI interaction content — the practice quiz questions and Ava lesson transcripts described in section 3 — is kept for 30 days after account closure, then deleted. We keep it this briefly because it's only useful while the tutoring relationship is active; there's no reason to hold it longer once it isn't.
• Safeguarding records are kept for 6 years — see our Safeguarding Policy section 10.

8. Cookies

We use only essential cookies — the ones required to keep you logged in and the Service functioning. We do not use analytics, advertising, or tracking cookies, which is why you aren't asked to accept a cookie banner. If that ever changes, we will ask for your consent first.

9. Your rights

Under UK GDPR, you (or a parent/guardian on a child's behalf) have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected;
• Request erasure of your data, subject to our legal retention obligations;
• Restrict or object to certain processing;
• Receive your data in a portable format; and
• Withdraw consent at any time where we rely on consent.

To exercise any of these rights, contact us at Joshua@averolearning.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

10. Security

We use reasonable technical and organisational measures — including encrypted connections, access controls, and row-level security on our database — to protect your data. No system is completely secure, and we encourage you to use a strong, unique password.

11. Changes to this policy

We may update this policy from time to time. We'll post the updated version here with a new "last updated" date.

12. Contact us

Questions about this policy or your data? Contact us at Joshua@averolearning.co.uk — see also our Contact page.