Privacy Policy

Revisionary Limited ("Revisionary", "we", "us") operates the Revisionary platform at getrevisionary.co.uk — a smart revision platform for UK GCSE and A-Level students, designed to tailor studying to each user.

Revisionary Limited is a private company registered in England & Wales, company number 17152360, with its registered office at 66 Paul Street, London, EC2A 4NA.

We are the data controller for the personal data we collect, and we are registered with the UK Information Commissioner's Office under registration number ZC127004. For data protection queries, contact us at: privacy@getrevisionary.co.uk

Account information: When you sign up, we collect your name, email address, date of birth, and password (stored as a secure hash — we never see your actual password). We ask for date of birth so we can apply the right privacy defaults under the Children's Code, and to enforce our minimum age of 13.

Usage data: We record your study activity — flashcard ratings, quiz scores, Pomodoro sessions, exam papers generated, and XP earned. This powers your progress tracking and, if you opt in, the leaderboard.

Payment data: If you subscribe, payments are handled by Stripe. We store your subscription status and tier but never your card details — those stay with Stripe.

Device and technical data: Standard web server logs including IP address, browser type, and pages visited. Used for security and debugging only.

Smart marking and tutor interactions: When you submit written answers for marking, or ask the in-app tutor a question, the text you entered is sent to a third-party large language model (Anthropic's Claude) to generate the response. We do not send your name, email or ID, only the text of the submission. Anthropic does not use this data to train its models. See section 6 for more detail on transfers.

We use your data only to:

• Provide and personalise the Revisionary service
• Track your progress and award XP and badges
• Process subscription payments
• Send account-related emails (e.g. password resets, receipts)
• Improve the platform through aggregated, anonymised analytics
• Comply with legal obligations

We will never sell your personal data or use it for advertising purposes.

Revisionary is designed for students, most of whom will be aged 14–18. We take children's privacy seriously and comply with the UK General Data Protection Regulation (UK GDPR) and the Children's Code (Age Appropriate Design Code).

Minimum age: Our self-serve signup is only for users aged 13 or over. We ask for date of birth at signup and block accounts for under-13s. Under-13s can only be enrolled via a school or by a parent setting up the account on their behalf.

High-privacy defaults: In line with Standard 7 of the Children's Code, optional social features (the leaderboard) are off by default for every account. You can turn them on in Account settings; you can turn them back off any time.

No profiling, no behavioural ads: We do not profile users or serve behavioural advertising. We do not sell data. We do not use dark patterns or nudges to extend engagement beyond what's useful for revision.

School use: When Revisionary is deployed through a school, the school acts as a data controller and Revisionary acts as a processor for the school-provided data. We will provide a Data Processing Agreement (DPA) on request — email privacy@getrevisionary.co.uk.

Under UK GDPR, we process your data on the following bases:

• Contract: Processing necessary to provide the service you signed up for
• Legitimate interests: Platform security, fraud prevention, and service improvement
• Legal obligation: Where we must comply with law
• Consent: For any optional marketing communications

We use a small number of trusted third-party sub-processors to operate Revisionary:

• Supabase — database and authentication. Primary data stored in the EU (London region).
• Anthropic — processes the text of written answers submitted for marking, and questions sent to the in-app tutor, to generate responses. Anthropic is based in the United States.
• Stripe — processes subscription payments. Stripe is based in the United States.
• Vercel — website hosting. Vercel is based in the United States, but our application runs out of EU edge regions where supported.

Transfers outside the UK: Where data is transferred to the US (for LLM processing, payments, or hosting), the transfer is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and where available by the UK Extension to the EU-US Data Privacy Framework. We only send the minimum data required (e.g. the text of an answer, not your name) and these providers act strictly as processors on our instructions.

All sub-processors are contractually bound to protect your data and may only use it to provide their services to us. They cannot use your data to train their own models. We do not share your data with any other third parties except where required by law.

We keep your account data for as long as your account is active. If you delete your account from your Account settings, it stays recoverable for 30 days and is then permanently erased. You can cancel the deletion at any point during that 30-day window by signing back in.

Subscription and payment records are retained for 7 years after the end of the relevant accounting period, as required by UK tax law. When your account is deleted, those records are anonymised (your personal identifiers are stripped) but the transaction record itself is kept for compliance.

Aggregated, anonymised analytics data (with no personal identifiers) may be retained indefinitely.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and data
• Portability — receive your data in a machine-readable format
• Object to certain types of processing
• Restrict processing in certain circumstances
• Withdraw consent for any processing based on consent (e.g. marketing emails)

The fastest route: most rights are self-serve from your Account settings — download your data, change your name, toggle privacy settings, or delete your account, all in one click. No need to email us or wait.

For anything that isn't in Account settings, or for complaints, email privacy@getrevisionary.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

We use only essential cookies required to keep you logged in and keep the service secure. We do not use advertising cookies or third-party tracking cookies.

A session cookie is set when you log in and expires when you log out or close your browser. No cookie consent banner is required as we only use strictly necessary cookies.

We take security seriously. Your password is hashed and never stored in plain text. All data is transmitted over HTTPS. We regularly review our security practices.

If you believe you have found a security vulnerability, please disclose it responsibly by emailing security@getrevisionary.co.uk.

We may update this policy from time to time. If we make significant changes, we will notify you by email or a notice in the app. The "last updated" date at the top of this page reflects the most recent version.

For any privacy-related questions or to make a data request:

📧 privacy@getrevisionary.co.uk

Revisionary Limited · Company no. 17152360 · 66 Paul Street, London, EC2A 4NA