Your data, in plain English

Examzi ("we", "us") runs the Examzi app and app.examzi.com, a study platform for GCSE, A-Level and US exam students. For family and individual accounts, we are the data controller: we decide how your data is used and we're responsible for it under UK GDPR.

When a school sets up accounts for its pupils, the school is in charge of that data and we process it on the school's instructions. Questions about a school account can go to the school or to us.

Email privacy@examzi.com about anything in this policy.

Each row shows what we collect, why, and (in the grey label) the legal basis under UK GDPR.

• We never sell or rent personal data to anyone.
• We never show adverts, and we never use your child's data to target them with marketing.
• We don't build profiles of children for anything other than teaching them better.
• We don't track your child across other apps or websites.

When data goes to a company in the US, it's protected by Standard Contractual Clauses (UK GDPR Article 46(2)(c)), the legal safeguard the UK uses for transfers abroad.

To teach and mark, we send OpenAI what it needs for that moment: the lesson conversation, your child's answers, photos of written work and their learning notes. Under our agreement, OpenAI doesn't use this to train its models.

Some practice questions are written in advance, using only a subject and a topic, like "GCSE Biology, cell division". Nothing about any student is ever sent to write them, not even a name. Because those questions contain no personal data at all, OpenAI may use them to improve its models.

• Under 13: can't sign up on their own. A parent or a school has to set up the account.
• 13 to 15: can sign up, and we use their data only to teach them. Parents linked to the account can see their progress, and any parent can contact us about their child's data.
• 16 and over: can give their own consent under UK GDPR.

We follow the ICO's Age Appropriate Design Code. Settings start at the most private option, analytics are off until someone agrees, and we keep data collection to the minimum. In the US, accounts for children under 13 are set up by a parent, who gives consent on their behalf.

• We ask for explicit consent before the first voice lesson. For children under 13, a parent must agree. Voice can count as sensitive data under UK GDPR Article 9, so we treat it that way.
• Audio goes to OpenAI live and is never stored by us. OpenAI may keep it for up to 30 days to check for misuse, then deletes it. It isn't used to train AI.
• A written copy of each lesson (words and whiteboard) is kept in your child's account so Ace can carry on next time. Only your child can read it in full. Parents see a summary of what was learnt.
• You can withdraw voice consent at any time in Settings.

• Essential: a sign-in cookie. Without it, the app can't keep you logged in.
• Analytics (only with consent): PostHog, hosted in the EU, counts which features get used.
• Session replay (only with consent): Sentry can replay a screen when something breaks, with all text masked and images blocked.
• Error reports: crash reports with a user ID only, no name or email, so we can fix bugs.
• Change your mind any time in Settings.

• No cookies: examzi.com stores nothing on your device. It's separate from the app, which has its own settings above.
• Counting visits: we count page views and a few taps (like the App Store button) with PostHog, hosted in the EU. There's no cookie, no ID that follows you, and no profile: every visit is anonymous. If your browser sends a Do Not Track or Global Privacy Control signal, we don't count you at all. Legal basis: legitimate interests, so we know which parts of the site help families.
• Apple's badge: the "Download on the App Store" badge is Apple's own picture, and it loads from Apple's server. Like any website, Apple's server sees your device's IP address when it sends the picture. We send Apple nothing else, and it sets no cookies.
• Emails you give us: if you ask to hear when Examzi is on the App Store or when Access Fund applications open, or you send a school or sponsor enquiry, we keep your email and anything you wrote, only to do what you asked. We delete it within 12 months, or sooner if you ask. Legal basis: consent, which you can take back any time.
• Stopping spam: when a form is sent, we keep a scrambled code made from your IP address that can't be turned back into it, so one person can't flood us.
• Hosting: Vercel serves the website and keeps standard server logs for security for a short time.

• Account and learning data: while the account is open, then deleted when it's closed.
• Voice audio: never stored by us.
• Analytics: 12 months, then made anonymous.
• Error reports: 90 days.
• Unfinished sign-ups: deleted after 30 days.
• Email verification links: deleted after 7 days.

• Everything travels over encrypted (HTTPS) connections and is encrypted where it's stored.
• Database rules mean each student can only read their own data.
• Photos and board snaps sit in private storage and open only through short-lived links.
• If something ever went wrong, we'd tell you and the ICO as the law requires.

• See and download your data: "Export my data" in Settings.
• Correct anything that's wrong: edit the profile in Settings.
• Delete the account and its data: "Delete my account" in Settings.
• Restrict or object to how we use data, or withdraw consent for voice or analytics at any time.

Parents can ask us to do any of this for their child, and anyone can email privacy@examzi.com and we'll reply within one month.

Please email privacy@examzi.com first. If we can't sort it out, you can complain to the UK Information Commissioner's Office at ico.org.uk, on 0303 123 1113 or at casework@ico.org.uk.

We'll update the date at the top whenever this policy changes. For anything important, we'll let you know by email or in the app before it takes effect. You'll find how we protect children in practice on our safety page.