How Aarubi Academy handles student and family data.

1. Who we are

Aarubi Academy is operated by AARUBI LTD, trading as Aarubi Academy. Our company number is 11262123. Our registered office is 66 The Kent, Rugby, England, CV21 4NQ. For privacy questions, contact hello@aarubiacademy.com.

2. What personal data we collect

Depending on how you use the website and app, we may collect:

• Account details such as name, email address, role, sign-in details, and profile type.
• Parent and student profile information needed to create or link accounts.
• Revision data such as uploaded question files, answer images, typed answers, marks, feedback, completed papers, and progress history.
• Support and contact data from emails or messages you send to us.
• Technical data such as IP address, browser type, device information, security logs, cookies, and usage events.
• Payment-related records if paid plans are introduced later. Card details should be handled by a payment provider, not stored directly by us.

3. Children and family accounts

Aarubi Academy is built for GCSE revision, so it may be used by younger students. We aim to use clear language, collect only what is needed, keep privacy settings high by default, and avoid unnecessary profiling or targeted advertising.

If a student is under 13, or under the age where local law requires parent or guardian involvement, a parent or guardian should create, approve, or supervise the account. Parents can contact us to ask about a child's account or request correction or deletion where appropriate.

4. How we use personal data

We use personal data to:

• create and manage student and parent accounts;
• provide question upload, answer, AI-supported marking, feedback, and completed-paper review features;
• save progress and keep revision records connected to the right student profile;
• respond to support requests and product feedback;
• protect accounts, prevent misuse, debug errors, and maintain service security;
• understand whether the service is working well and improve the product; and
• comply with legal, regulatory, accounting, or safety obligations.

5. Our lawful bases

Under UK data protection law, we rely on different lawful bases depending on the activity. These may include contract where data is needed to provide the app, legitimate interests where we improve and secure the service, consent where we ask for optional choices such as non-essential cookies or marketing, and legal obligation where the law requires us to keep or share information.

6. AI-supported feedback and uploads

The app may use AI service providers, including OpenAI where configured, to help extract questions, mark answers, generate feedback, and explain next steps. This means uploaded questions, answer images, typed answers, and related context may be processed by AI systems to provide the feature you asked for.

7. Cookies and similar technologies

The website and app may use essential cookies or similar technologies for security, sign-in, session management, and core functionality. Non-essential analytics or marketing cookies should only be used where the correct consent or legal basis is in place. See our Cookie Policy.

8. When we share data

We may share personal data with service providers who help us operate the platform, such as hosting, database, authentication, storage, AI, email, support, analytics, security, and payment providers. For example, the app may use Supabase for authentication, database, and storage, and AI providers for feedback features.

We may also share information where required by law, to protect rights and safety, to investigate misuse, or as part of a business transfer. We do not sell personal data.

9. International transfers

Some service providers may process personal data outside the UK. Where this happens, we aim to use recognised safeguards such as adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, or other lawful transfer mechanisms.

10. Security and retention

We use reasonable technical and organisational measures to protect personal data. No online service can guarantee absolute security, so students and parents should keep account details private and contact us if they suspect unauthorised access.

We keep personal data only for as long as needed for the purposes described in this policy, including providing accounts, maintaining revision records, responding to support requests, keeping security logs, meeting legal obligations, and handling disputes. We may delete or anonymise data when it is no longer needed.

11. Your privacy rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict, object to, or transfer your personal data. You may also be able to withdraw consent where processing is based on consent. Contact hello@aarubiacademy.com to make a request.

You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

12. Changes to this policy

We may update this Privacy Policy as Aarubi Academy develops, especially if new subjects, payments, analytics, or account features are introduced. The updated date at the top of the page will show when the policy last changed.