Privacy Policy

1. Who we are

GCSE Tutor is operated by Lucian Paduraru ("we", "us"). We are registered with the Information Commissioner's Office (ICO) as a data controller. Contact: privacy@gcsetutor.app

2. What data we collect

• Account data — email address and password hash when you register.
• Payment data — processed entirely by Stripe. We never see or store your card details.
• Usage data — subject activity, XP earned, streak count. Stored locally in your browser and in our database to sync across devices.
• Technical data — browser type, approximate country (for fraud prevention). No IP address is stored.

3. How we use your data

• To provide and improve the tutoring service.
• To process payments and manage subscriptions.
• To send important account emails (receipt, password reset). No marketing without consent.

4. Legal basis (UK GDPR)

We process your data under contractual necessity (to deliver the service you paid for) and legitimate interests (security, fraud prevention).

5. Children's data

This service is designed for students aged 14–16. If you are under 13, please ask a parent or guardian to create the account. We comply with the UK Age Appropriate Design Code. We do not use children's data for advertising or profiling.

6. AI & data processing

Your questions are not sent to OpenAI, Google, or any third-party AI provider, and nothing you write is used to train any model.

Your conversations are not stored anywhere. A question is sent to our server, used to write a reply, and then gone — it is not saved to our database and not saved in your browser. It stays in the page while you have it open and disappears when you close or refresh it. That means we cannot show you your old conversations, because there aren't any.

7. Third parties

• Supabase — database and authentication (EU servers). Privacy policy
• Stripe — payment processing. Privacy policy
• Vercel — hosting. Privacy policy

We do not sell your data to any third party.

8. Data retention and deletion

We delete every account and its data on 30 June each year, at the end of the GCSE exam season. Progress, XP, badges and results are not carried from one exam year to the next. If you sign up again afterwards, you start fresh. Accounts with a subscription still running on that date are deleted when it ends instead.

If you ask us to delete your account sooner, we do it within 30 days. Your access continues until the deletion is carried out, after which the account and everything in it is gone. We do not refund any remaining part of a period you have paid for. Deleting your account is not the same as cancelling a subscription: if you only want to stop being billed, cancel instead and you keep access to the end of the period you have paid for.

One thing survives a deletion, and only one. The 48-hour free trial is available once per email address. So when an account is deleted we keep a one-way encrypted fingerprint of the address — nothing else, no name, no history. It cannot be turned back into an email address, it is not readable by anyone outside our server, and it is used for nothing except refusing a second free trial to the same address.

Payment records are kept for 7 years, as UK tax law requires.

9. Your rights (UK GDPR)

• Right to access your data
• Right to correct inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing

To exercise any right, email privacy@gcsetutor.app. We'll respond within 30 days.

10. Cookies

We use only essential cookies required for authentication and security (session token). No advertising or tracking cookies.

11. Changes

We may update this policy. Significant changes will be notified by email. Continued use after 30 days constitutes acceptance.

12. Complaints

You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.