Privacy Policy

This service is operated by aitutors, based in United Kingdom(the "Controller"). For privacy questions, contact help@aitutors.uk.

When you use aitutors we collect the following categories of personal data:

• Account: email, display name, year group (Cambridge Primary Stage), school (optional).
• Submissions: writing text you submit, uploaded/scanned images of your writing, OCR-extracted text.
• AI scoring output: scores, feedback, and generated analysis produced by Claude-based scoring.
• Analytics and feedback: none as of 18 August 2026. Until that date we used Google Analytics 4 (page events, year group, submission scores) and the Userback feedback widget. Data collected before then is held by those providers under their own retention policies — see Sections 5 and 11.
• Technical: IP address, user agent, request logs collected by Vercel and Sentry for operating the service.

• Provide the writing-practice and AI-scoring service you requested.
• Personalise practice recommendations based on your progress.
• Respond to support enquiries sent to help@aitutors.uk.
• Detect abuse and protect the service (rate limiting, error monitoring).
• Improve scoring quality through aggregate, non-identifying analysis.

We do not use your personal data for advertising profiling.

• Contract (Art.6(1)(b)) — to provide the service you signed up for.
• Legitimate interest (Art.6(1)(f)) — abuse detection, rate limiting, error logging via Sentry. You can object at any time.

We use the following processors, each bound by a Data Processing Agreement (DPA):

• Supabase — database, authentication, file storage (hosted in EU / Northeast Asia). DPA
• Vercel — application hosting, edge delivery. DPA
• Anthropic — AI scoring (Claude API) in the United States. DPA
• Resend — transactional email delivery. DPA
• Sentry — error and performance monitoring. DPA
• Userback — in-app feedback widget. Discontinued on 18 August 2026; the widget is no longer loaded. Feedback submitted before that date may still be held by Userback and is deleted on account deletion or on request (Section 11). DPA
• Upstash — rate-limit counter store. DPA
• Cloudflare — DNS and email routing for the aitutors.uk domain. DPA

Some processors (Anthropic, Sentry, Cloudflare) process data outside the UK/EEA. Transfers are protected by the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCC) included in each processor's DPA. You can request copies of these safeguards by emailing help@aitutors.uk.

• Account & submissions: retained while your account is active.
• After deletion request: soft-deleted immediately (you lose access), then permanently deleted after a 30-day grace period — see Section 9.
• Sentry logs: ~30 days on current plan.
• Supabase backups: rolling 7 days on current plan.
• Audit logs (admin actions, deletion records): retained indefinitely with personal identifiers anonymised after hard-deletion — required for GDPR compliance records (Art.30).

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (also available in Settings).
• Erasure — delete your account (Settings → Delete My Account).
• Objection — object to processing based on legitimate interest.
• Restriction — ask us to pause certain processing.
• Portability — request your data in a machine-readable format.

To exercise any of these rights, email help@aitutors.uk. We will respond within one month (UK GDPR Art.12).

You can delete your account from Settings → Delete My Account. The flow is:

1. You confirm deletion in the in-app modal (type "DELETE" + consent checkbox).
2. We immediately soft-delete your account: your sessions end on all devices, your writings become inaccessible, and shared public links are revoked.
3. You receive a confirmation email. For 30 days you can log in to restore your account and cancel the deletion.
4. After 30 days a scheduled job permanently deletes your submissions, files, authentication record, and best-effort notifies third-party processors (Section 11).

aitutors is designed for Cambridge Primary students (typically ages 5–11). We follow the UK Age Appropriate Design Code:

• We collect the minimum data needed to provide scoring.
• We do not profile children for advertising.
• We do not use third-party analytics or feedback tools.
• If you are a child, please talk to a parent or guardian before deleting your account. You have 30 days to change your mind.
• Parents can request access, correction, or deletion on a child's behalf by emailing help@aitutors.uk.

When you delete your account we make reasonable efforts to notify the third-party processors listed in Section 5 and request deletion of any personal data they hold:

• Sentry — we clear user context and attempt to delete matching issues via the Sentry API. Events that remain fall under Sentry's own retention policy (~30 days).
• Userback — we attempt to delete matching feedback entries via the Userback API.
• Upstash — rate-limit counters keyed to your user ID are removed.
• Resend — we do not store feedback-style personal data in Resend beyond transactional email delivery logs, which are handled under Resend's own retention policy.

We record the outcome of each external deletion attempt (success, failure, or unsupported) internally as audit evidence. Where a provider does not offer a user-level delete API, the data is deleted according to the provider's own retention policy.

For privacy questions, email help@aitutors.uk.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/.