Privacy Policy
1. Who we are
ET Trainer is operated by [YOUR NAME / TRADING NAME] based in the United Kingdom. We are the data controller for the personal data described in this policy. We are not required to register with the ICO if our annual turnover is below £632 million and we process only personal data for core business purposes — but if your processing expands, check your ICO registration obligations.
2. What data we collect and why
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address | Account identification, sending password resets (when added), and transactional communications | Contract performance |
| Username / first name | Display in the app (optional — you can leave it blank) | Legitimate interest |
| Hashed password | Authenticating your account. We use PBKDF2 — the original password is never stored. | Contract performance |
| Study progress | Saving your revision sheet, achieved topics, and mock results so they persist across devices | Contract performance |
| AI answers you type | Processing through the AI to produce marking and feedback. We do not store your raw answers long-term — they are passed to Anthropic and the AI response is returned. The question text is stored in the questions bank if it becomes a curated item. | Contract performance |
| Transaction records | Stripe Checkout session IDs and braincell credit amounts for billing accuracy and VAT compliance | Legal obligation / contract |
| Problem reports you submit | Quality improvement — you can submit a text note flagging a question. Stored linked to your user ID. | Legitimate interest |
| Session data (cookie) | An HttpOnly, Secure session cookie holds a random token (hashed server-side) to keep you logged in for 30 days. | Contract performance |
We do not collect: payment card details (handled entirely by Stripe), precise geolocation, or data from children under 13.
3. Cookies
We use one functional cookie (session token) to keep you logged in. It is HttpOnly and Secure (not accessible to JavaScript). We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
If you add analytics (e.g. Cloudflare Web Analytics — which is cookie-free) you should update this section accordingly.
4. Third-party processors
| Processor | Purpose | Location |
|---|---|---|
| Cloudflare | Hosting (Pages), serverless compute (Workers), database (D1). Your data is stored in the EU or UK region where possible. | US (SCCs in place) |
| Anthropic | AI inference — your typed answers and questions are sent to Anthropic's API to generate marking and feedback. Anthropic's API data is not used to train their models by default (as of their API terms). | US (SCCs in place) |
| Stripe | Payment processing. We only receive the Checkout Session ID and amount — not your card number. | US/EU (SCCs in place) |
All transfers to the US are covered by Standard Contractual Clauses (SCCs) with each processor.
5. How long we keep your data
- Account data (email, username, password hash) — until you delete your account, then removed within 30 days.
- Study progress — until account deletion.
- Transaction records — 7 years (UK HMRC requirement).
- Sessions — 30 days from creation, or until you sign out.
- Problem reports — until resolved or 12 months after submission.
6. Your rights under UK GDPR
You have the right to:
- Access — request a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure — request deletion of your data (subject to legal retention obligations).
- Restriction — ask us to stop processing your data in certain circumstances.
- Portability — receive your progress data in a machine-readable format (the portable save code in the app gives you this directly).
- Object — object to processing based on legitimate interest.
- Complain — lodge a complaint with the Information Commissioner's Office (ICO).
To exercise any right, email [email protected]. We will respond within one calendar month.
7. Security
Passwords are stored as PBKDF2 hashes with a random salt. Connections use HTTPS only (enforced via the _headers file). Session tokens are HttpOnly cookies, hashed server-side. We follow Cloudflare's security recommendations including WAF rate-limiting on authentication endpoints.
No security is perfect. If you discover a vulnerability, please disclose it responsibly to [email protected].
8. Under-18s and safeguarding
Many 2365-03 learners are aged 16–18. We do not market to or knowingly collect data from under-13s. We do not collect sensitive personal data. If a parent or guardian believes their child has registered without consent, contact us at [email protected] and we will delete the account promptly.
9. Changes to this policy
We may update this policy. We will notify registered users by email at least 14 days before material changes take effect.
10. Contact
Data controller: [YOUR NAME / TRADING NAME]
Address: [YOUR ADDRESS]
Email: [email protected]
This policy was drafted as a starting point and should be reviewed by a UK-qualified solicitor or data protection specialist before going live with real users.