Privacy Policy

1. Who we are

Schoogle is operated by Consulaw Tech Services Ltd. References to "Schoogle", "we", "us" or "our" mean Consulaw Tech Services Ltd.

We run the platform at schoogleuk.com and any associated mobile apps (the "Service"). This policy explains how we collect, use, share and protect personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Schools and Schoogle

When a school sets up Schoogle for its pupils and staff, the school is the data controller for that pupil and staff data and we act as its data processor, following the school's instructions under a data processing agreement. Questions about how a school uses Schoogle should go to the school first; we will help schools respond to requests.

For individual learners, parents and tutors who sign up directly, we are the data controller.

3. Information we collect

3a. Information you give us

• Account details (name, email address, password)
• Profile information (role, school name, nation, year group, subjects, exam boards)
• Content you submit (AI tutor questions, notes, quiz and test answers, uploaded materials)
• Messages and support requests you send us
• Tutors: qualifications, DBS check status and teaching information you provide for your profile

3b. Payments

Payments are processed by Stripe. We never see or store your full card details. Tutor payouts are made through Stripe Connect: Stripe collects and verifies tutors' identity and bank details directly, and we do not store bank account numbers or sort codes.

3c. Information collected automatically

• Log data (IP address, browser type, pages visited, time of visit)
• Device information (device type, operating system)
• Learning activity (lessons completed, quiz scores, streaks, session length)
• AI usage data (token counts, model used, feature used) to calculate credit costs and prevent abuse
• Tutor earnings and payout records
• Cookies (see section 9)

4. How we use your information and our lawful bases

• To provide the Service (accounts, lessons, AI tutor, quizzes, tutoring, library): contract, or for school accounts, the school's own lawful basis with us as processor
• To take payments and pay tutors: contract and legal obligation (tax and accounting records)
• To keep the Service safe (fraud prevention, abuse detection, safeguarding moderation): legitimate interests and, where applicable, legal obligation
• To improve the Service using aggregated, de-identified analytics: legitimate interests
• Marketing emails: consent, which you can withdraw at any time
• Analytics cookies: consent (see section 9)

We do not sell personal data. We do not use your content to train AI models.

5. AI features

Questions you send to the AI tutor and AI teaching tools are processed by our AI providers to generate a response. We send only what is needed to answer the request, our providers are bound by contracts that prohibit using that data to train their models, and responses are not used to make decisions with legal or similarly significant effects about you.

6. Sharing your information

• Service providers (sub-processors), each under a data processing agreement: Supabase (database and authentication), Vercel (hosting), Stripe (payments and tutor payouts), Google Firebase (sign-in), Resend (email), Upstash (rate limiting), Cloudflare (security) and our AI model providers.
• Your school, if your account is part of a school plan: authorised school staff can see your progress within the platform.
• Tutors you choose to work with can see the progress and session notes relevant to your lessons.
• Parents and guardians linked to a pupil account can see that pupil's progress.
• Legal requirements: where required by law, court order, or to protect someone's safety, including safeguarding referrals.
• Business transfers: if Schoogle is sold or merged, personal data may transfer as part of that transaction, and we will tell you first.

7. International transfers

We aim to store personal data in the UK or the European Economic Area. Some sub-processors may process data in other countries, including the United States. Where that happens we rely on UK adequacy regulations (including the UK-US data bridge where the recipient is certified) or the ICO's International Data Transfer Agreement or Addendum, together with appropriate safeguards.

8. How long we keep data

We keep personal data for as long as your account is active. After an account is closed we delete or anonymise personal data within 12 months, except where we must keep records for longer by law (for example, payment and tax records are kept for six years). School accounts follow the retention period agreed with the school.

9. Cookies

We use strictly necessary cookies to keep you signed in and secure, and functional storage to remember preferences such as your theme. These do not need consent.

With your consent we use Google Analytics cookies to understand how the Service is used. Analytics only loads if you choose "Accept analytics" in the cookie banner. To change your choice, clear this site's data in your browser and the banner will appear again. We do not use advertising cookies.

10. Children

Many Schoogle users are under 18. We design the Service with the ICO's Age Appropriate Design Code in mind: high-privacy settings by default, no advertising, no selling of data and no profiling for marketing.

In the UK, children aged 13 or over can consent to online services themselves. For children under 13 who sign up directly, we require consent from a parent or guardian. Where a school provides Schoogle to its pupils, the school is responsible for the lawful basis and for informing parents.

If you think we hold a child's data without appropriate consent, contact privacy@schoogleuk.com.

11. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased in certain circumstances
• Restrict or object to certain processing, including processing based on legitimate interests
• Data portability
• Withdraw consent at any time, where processing is based on consent

Email privacy@schoogleuk.com to exercise any of these rights. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

12. Security

We use encryption in transit and at rest, role-based access controls, row-level security in our database and regular security reviews. No system is completely secure, and we will notify you and the ICO of a personal data breach where the law requires us to.

13. Changes to this policy

We will tell you about material changes by email or a notice on the Service at least 14 days before they take effect.

14. Contact us