MathsEleven — Privacy Policy
MathsEleven · a trading name of Essex Education Academy Ltd
1. Who is responsible for your data
The data controller is Essex Education Academy Ltd, a company registered in England and Wales under company number 17451080, trading as MathsEleven.
Our registration with the Information Commissioner's Office (ICO) has been applied for and is awaiting confirmation. We will publish our registration number here as soon as it is issued.
Registered office: 105 High Street, Brentwood, Essex, CM14 4RR. Contact: admin@mathseleven.co.uk.
MathsEleven is an online 11+ maths preparation platform. Parents hold the account; children use the platform through logins their parent creates.
2. The short version for parents
We collect only what we need to run the service: your account details, your child's first name, year group and target schools, their practice answers so we can show progress, and payment handled entirely by Stripe. We never sell data, never show advertising, and never use your child's data for anything except their maths preparation.
3. A note for children
Hello! When you practise on MathsEleven, we save your answers so you and your grown-up can see how you're improving. We only know your first name and your school year — and we never share your work with anyone except your grown-up. If anything on here worries you, tell your grown-up and they can ask us about it.
4. What we collect
- From parents: name, email address, password (stored encrypted), and the messages you send us.
- About your child (entered by you): first name, year group, target schools, and their username for the child login.
- Generated by use of the platform: answers to questions, scores, mock-exam results, syllabus-tracker progress, XP/achievements, and messages typed to the AI tutor.
- Payments: handled by Stripe. We see the payment status and the last four digits of the card, never the full card number.
- For printed paper orders: your delivery name and address.
- Technical: device/browser type, IP address, and essential cookies needed to keep you logged in (see section 11).
We deliberately do not collect your child's surname, date of birth, photo, school attended, or any special category data.
5. Why we use it (lawful bases)
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Providing the platform, accounts and child logins | Parent + child account data, usage data | Performance of a contract |
| Showing progress and reports to the parent | Answer/performance data | Performance of a contract |
| Powering the AI tutor | The messages/questions sent to it | Performance of a contract |
| Taking payment and delivering printed papers | Payment status, delivery address | Performance of a contract |
| Service emails (receipts, renewal and trial reminders) | Parent email | Performance of a contract / legal obligation |
| Marketing emails to parents | Parent email | Consent (opt-in; unsubscribe any time) |
| Improving the service (aggregated, de-identified analysis of question difficulty and performance) | Usage data | Legitimate interests — balanced against users' rights; no decisions about individual children |
| Security, fraud prevention, record-keeping | Technical + account data | Legitimate interests / legal obligation |
We do not use children's data for marketing, advertising, or profiling beyond the educational purpose (e.g. adapting question difficulty), and we do not make automated decisions with legal or similar effects.
6. Children's data and the ICO Children's Code
The platform is designed around the ICO's Age Appropriate Design Code:
- Parental control: children cannot create accounts; only parents can, and only parents can add, manage or delete a child profile and reset passwords.
- Data minimisation: child profiles use first name and year group only.
- High privacy by default: there are no public profiles, no leaderboards comparing children, no chat between children, and no behavioural advertising of any kind.
- AI tutor: children's messages to the AI tutor are processed by our AI provider (Anthropic) solely to generate the tutoring response. We instruct that these are not used to train the provider's models, and we retain tutor conversations for 90 days for quality and safety review, then delete them.
- Transparency: the child-friendly summary above is shown in the child app.
7. Who we share data with
We share data only with the processors needed to run the service, under contracts that meet UK GDPR requirements:
- Stripe — payments.
- Anthropic — AI tutor responses.
- Lovable Cloud (built on Supabase) — platform hosting and database.
- Resend — service and (with consent) marketing emails.
- Hostinger — domain and web hosting.
- Royal Mail — receives the delivery name and address on the parcel for printed paper orders.
We also disclose data if the law requires it. If the business is sold, reorganised or transferred, your data transfers with it under the same protections and we will notify you.
We never sell personal data.
8. International transfers
Some providers process data outside the UK (for example, Stripe and Anthropic in the United States). Where they do, transfers are protected by UK adequacy regulations (including the UK–US Data Bridge where applicable) or the UK International Data Transfer Agreement/Addendum.
9. How long we keep data
- Account and child data: while your account is active, then deleted 12 months after closure (so returning families can restore progress), unless you ask us to delete sooner.
- AI tutor conversations: 90 days (see section 6).
- Payment and order records: 6 years (tax and accounting law).
- Marketing consents: until you withdraw them.
You can ask us to delete your account and your child's data at any time — see section 10.
10. Your rights
You (and, exercised through you, your child) have the right to: access the data we hold; correct it; delete it; restrict or object to processing; data portability; and to withdraw consent (for marketing) at any time. Email admin@mathseleven.co.uk and we will respond within one month.
You also have the right to complain to the ICO: ico.org.uk / 0303 123 1113. We'd appreciate the chance to resolve any concern first.
11. Cookies
We use essential cookies to keep you signed in and the platform secure — these don't need consent. If we add analytics or any non-essential cookies, we will ask for your consent through a cookie banner first, in line with the Privacy and Electronic Communications Regulations (PECR).
12. Security
Data is encrypted in transit, passwords are hashed, access to the database is restricted, and payment data never touches our systems. No system is perfectly secure, but if a breach ever put your rights at risk, we would notify you and the ICO as the law requires.
13. Changes to this policy
We'll post updates here and, for significant changes, email account holders. The "last updated" date at the top shows the current version.