Privacy Policy

1. Who We Are

STAR AI Tutor is an educational platform for P6 and P7 pupils in Northern Ireland preparing for the GL Assessment transfer test. The service is operated by Chris Gregg, trading as STAR AI Tutor, based in Northern Ireland, United Kingdom ("we", "us", "our").

We are the data controller for personal information collected through this website. If you have any questions about this Privacy Policy or how we handle your data, please contact us at staraitutor.support@gmail.com.

ICO Registration Number: C1909458

2. What Data We Collect

Account Data

• Email address (used to create and access your account)
• Password (stored as a secure hash — we never see your actual password)
• Child's first name (used to personalise the learning experience)
• Year group (P6 or P7)
• Parent or guardian email address
• Intended exam year and preferred number of study sessions per week

Learning Data

• Results from practice sessions, topic sprints, and mock exams (scores, correct/incorrect answers per question, topics attempted)
• Session timestamps and duration
• Topic performance summaries used to personalise recommendations

Payment Data

Subscription payments are processed by Stripe, Inc. We do not store your card number, expiry date, or CVV. We receive a subscription status (active, trialing, inactive) and a Stripe customer identifier from Stripe to manage your access. Stripe's privacy policy is available at stripe.com/gb/privacy.

Usage Data

We use Google Analytics 4 to collect anonymised, aggregated data about how visitors use our website (pages visited, time on site, device type). This data is collected at an aggregate level and is not linked to individual user accounts or children's identities. IP addresses are anonymised before transmission to Google. See Section 8 (Cookies) for more detail.

3. How We Use Your Data

• To provide the service: delivering personalised practice sessions, tracking progress, and displaying results to the student and parent.
• To personalise learning: using topic performance data to recommend which areas to focus on.
• To manage your subscription: processing payments via Stripe and controlling access based on subscription status.
• To power STAR Chat: when a student or parent uses the STAR Chat feature, the chat messages and the child's first name are sent to Anthropic's API in real time to generate a response. No email address, surname, or other identifying information is included. See Section 4 for full details.
• To communicate with you: sending account confirmation emails and, where you have opted in, service updates. We do not send marketing emails without your consent.
• To improve the service: using aggregated, anonymised analytics data to understand how the platform is used and where improvements are needed.

Our legal basis for processing personal data is contract performance (to deliver the service you have subscribed to) and, where applicable, legitimate interests (to improve the service and prevent fraud). For children's data, our legal basis is parental consent given at account creation. Practice questions are pre-generated and stored in advance — no student data is sent to any AI service during practice sessions or mock exams.

4. AI and Third-Party Processing

Practice Questions (No Live AI During Sessions)

All practice questions, mock exam questions, and written answer marking on this platform use content that is pre-generated and stored in our database before being served to students. During practice sessions and mock exams, no student data is sent to any AI service. Questions are quality-checked offline using Claude, an AI model developed by Anthropic, PBC. During this quality assurance process, we send only the year group (P6 or P7), topic area, and question text — no names, emails, or personal data.

STAR Chat (Live AI During Chat Sessions)

STAR Chat is an optional in-app chat feature. When a student or parent uses STAR Chat, the following data is sent to Anthropic's API in real time to generate a response: the messages in the conversation, and the child's first name (used to personalise responses). No email address, surname, school name, or other personal identifying information is included. Chat history is held only for the duration of the session and is not stored in our database after the session ends.

Anthropic processes this data as a data processor acting on our behalf. Anthropic does not use API inputs to train its models by default. Anthropic's privacy policy is available at anthropic.com/privacy.

Content Accuracy

AI-assisted content is reviewed before being shown to students, but AI systems can make errors. We strongly recommend that parents review any question or explanation that seems incorrect and contact us. STAR AI Tutor is a supplementary study tool and is not a substitute for qualified professional tutoring.

5. Children's Privacy and UK Children's Code

We comply with the UK Children's Code (Age Appropriate Design Code) published by the Information Commissioner's Office. Our commitments under this Code are:

• Best interests of the child: the design and operation of this service prioritises the educational welfare and best interests of child users above any commercial consideration.
• Parental consent: consent is obtained from the parent or guardian during account registration. By completing registration, the parent or guardian confirms they are aged 18 or over and consents to the collection and processing of their child's data as described in this policy.
• High privacy by default: all privacy settings are configured to the highest level of protection by default. No opt-in is required to protect your child's privacy.
• No profiling or targeted content: we do not profile children for commercial purposes or serve targeted advertising. The only personalisation we apply is educational — recommending which exam topics to focus on based on performance data.
• No nudge techniques: we do not use persuasive design techniques, psychological nudges, or dark patterns that could exploit children's behaviour or encourage excessive use.
• No data sharing beyond service delivery: children's personal data is shared only with the service providers listed in Section 6, solely for the purpose of delivering the educational service.
• Minimum age: the service is intended for children aged 9–12 in P6 or P7. Parents of younger or older children may use the service but it is designed specifically for this age group.

If you believe a child has provided us with personal data without parental consent, please contact us immediately at staraitutor.support@gmail.com and we will delete it promptly.

6. Who We Share Your Data With

We do not sell your personal data. We share it only with the following third-party service providers, solely for the purpose of delivering this service:

• Supabase, Inc. (database and authentication) — your account data and learning records are stored in Supabase's cloud database, hosted on AWS infrastructure in the EU (Ireland). Supabase is ISO 27001 certified and SOC 2 Type II compliant.
• Stripe, Inc. (payment processing) — processes subscription payments. Stripe is PCI DSS Level 1 certified.
• Anthropic, PBC (AI question quality assurance and STAR Chat) — receives anonymised prompts during offline question quality assurance (year group and topic only, no personal data), and receives chat messages plus the child's first name during live STAR Chat sessions. Anthropic does not use API inputs to train its models by default.
• Vercel, Inc. (website hosting) — hosts the STAR AI Tutor website and serverless functions on EU-region infrastructure.
• Google LLC (analytics) — receives anonymised, aggregated usage data via Google Analytics 4. IP addresses are anonymised before transmission.

All third-party providers are contractually bound to handle your data securely and only for the purposes we specify.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you cancel your subscription, your account data and learning records are retained for 12 months to allow reactivation. After 12 months of inactivity, we will delete or anonymise your data.

You may request deletion of your data at any time by contacting us at staraitutor.support@gmail.com. We will action deletion requests within 30 days.

8. Cookies

We use the following cookies on this website:

• Authentication cookies (Supabase) — strictly necessary, used to keep you logged in. These cannot be disabled without preventing the service from functioning.
• Analytics cookies (Google Analytics 4) — used to understand how visitors use our website. These are set only with your consent where required by law.

We do not use advertising or tracking cookies. We do not use cookies to build profiles for commercial purposes.

9. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct inaccurate or incomplete data.
• Right to erasure — you may ask us to delete your personal data (subject to certain legal exceptions).
• Right to data portability — you may request your data in a machine-readable format.
• Right to object — you may object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at staraitutor.support@gmail.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We will notify active subscribers of material changes by email. Continued use of the service after any changes constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, data requests, or concerns, please contact us:

Email: staraitutor.support@gmail.com
Address: STAR AI Tutor, Northern Ireland, United Kingdom