Privacy Policy

1. Who we are

Syllabi provides live, online group tutoring for UK secondary-school students (Years 7–11, roughly ages 11–16). Lessons are delivered as live video classes.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Syllabi is the data controller for the personal data described in this policy. We are based in the United Kingdom.

You can reach our team, including for any data-protection or privacy matter, at admin@syllabi.co.uk. Please address privacy requests to "Data Protection".

2. The data we collect, and why

We collect only what we need to run the tutoring service:

• Parent / guardian (account holder):name, email address and phone number. Used to create and secure the account, to contact you about your child's learning, and for billing.
• Student: first and last name, year group, and (optionally) date of birth, target grades and exam boards. Used to place the student in the right classes and personalise learning.
• Chat messages exchanged with tutors and Student Success Managers (SSMs). Used to support learning and answer questions.
• Assessment submissions— the answers a student gives. Used to mark, give feedback and track progress.
• Push-notification device tokens (via Firebase Cloud Messaging) where you enable notifications. Used to send lesson reminders and important account messages.
• Billing reference:a Stripe customer identifier. Payments are handled by Stripe — we do not store card numbers on our systems.
• Technical / usage data:basic information needed to keep you logged in and to keep the service secure and working (see "Cookies and local storage" below).

3. Our lawful bases (Article 6 UK GDPR)

We rely on the following lawful bases:

• Contract— to provide the tutoring service you (the parent) have signed up for, including scheduling lessons, marking work and processing payments.
• Legitimate interests— to keep the service secure, prevent abuse, and improve our teaching. We balance these against your and your child's rights and interests.
• Legal obligation— to keep records we are required by law to keep (for example, certain financial records).
• Consent— for optional marketing email and for push notifications. You can withdraw consent at any time (see below). Where we send marketing by email, we also comply with the Privacy and Electronic Communications Regulations (PECR).

4. Children's data and parental consent

Our service is designed to be used by children, so we follow the UK Age Appropriate Design Code (the "Children's Code") and treat children's data with extra care.

• A parent or guardian must create the account.The account holder must be 18 or over. They provide the student's details and agree to this policy on the child's behalf.
• Verifiable parental consent. For children under 13, the account is created and controlled by the paying parent or guardian, whose email is verified during sign-up. This acts as our verifiable parental-consent gate.
• We collect the minimum data needed for tutoring, we do not profile children for advertising, and we never sell anyone's personal data(children's or adults').
• Parents can review and request changes to their child's data, and can delete the account at any time (see "Your rights" and our account deletion page).

5. The companies that help us run Syllabi

We use a small number of trusted third-party processors. They act on our instructions and only receive the data they need:

• Stripe— processes payments. Receives the account holder's billing details to take payment; we store only a Stripe customer reference.
• Resend (email)— sends our transactional and (where you have opted in) marketing emails. Receives name and email address.
• Zoom— powers our live video lessons. Receives the information needed to join a class.
• Firebase Cloud Messaging (Google)— delivers push notifications. Receives device tokens.
• Notion— used internally to manage our operations and support. May hold limited account details for support and administration.

6. International transfers

Some of our processors are based outside the UK (for example, in the United States). Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law — such as UK "adequacy" decisions or the UK Addendum to the EU Standard Contractual Clauses — so that your data continues to be protected.

7. How long we keep data (retention)

We keep personal data only for as long as we need it for the purposes above, and then delete or anonymise it.

• Account and learning data— kept while the account is active. When an account is deleted, profile data, messages, assessment submissions and push tokens are removed (see our account deletion page).
• Financial and legal records— kept for as long as the law requires (for example, tax and accounting records are generally retained for several years), even after an account is deleted.

8. Your rights

Under UK GDPR you (and, for a child, their parent) have the right to:

• be told how your data is used (this policy);
• access a copy of your data;
• ask us to correct data that is wrong;
• ask us to eraseyour data ("right to be forgotten");
• ask us to restrict or object to certain processing;
• ask for your data in a portable format (data portability);
• withdraw consent for marketing or push notifications at any time.

How to exercise your rights:

• In the app, open Profile and use "Download my data" to get a copy of your information.
• In the app, open Profile and use "Delete account" to erase the account and its data (see our account deletion page).
• For any other request, email admin@syllabi.co.uk. We will respond within one month.

9. Cookies and local storage

We keep things simple. To keep you signed in, we store an authentication token in your browser's localStorage. This is strictly necessary for the service to work — without it you would be logged out on every page. We do not use third-party advertising or tracking cookies. Clearing your browser storage, or logging out, removes this token.

10. Push notifications

If you allow notifications, we register a device token (via Firebase Cloud Messaging) so we can send lesson reminders and important account messages. You can turn notifications off at any time in your device settings; doing so withdraws your consent for this feature.

11. How to complain

If you have a concern about how we handle personal data, please contact us first at admin@syllabi.co.uk so we can try to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

12. Changes to this policy

We may update this policy from time to time. When we make significant changes we will update the "last updated" date above and, where appropriate, let you know in the app or by email.