Privacy Policy

Last updated: 4 October 2026

1. Who we are

GCSE Tutor is operated by Lucian Paduraru ("we", "us"). We are registered with the Information Commissioner's Office (ICO) as a data controller. Contact: privacy@gcsetutor.app

2. What data we collect

  • Account data — email address and password hash when you register.
  • Payment data — processed entirely by Stripe. We never see or store your card details.
  • Usage data — subject activity, XP earned, streak count. Stored locally in your browser and in our database to sync across devices.
  • Technical data — browser type, approximate country (for fraud prevention). No IP address is stored.

3. How we use your data

  • To provide and improve the tutoring service.
  • To process payments and manage subscriptions.
  • To send important account emails (receipt, password reset). No marketing without consent.

4. Legal basis (UK GDPR)

We process your data under contractual necessity (to deliver the service you paid for) and legitimate interests (security, fraud prevention).

5. Children's data

This service is designed for students aged 14–16. If you are under 13, please ask a parent or guardian to create the account. We comply with the UK Age Appropriate Design Code. We do not use children's data for advertising or profiling.

6. AI & data processing

Your questions are answered by an open-source model running on our own server in the UK. They are not sent to OpenAI or Google, and nothing you write is used to train any model.

When our server is offline, a question may instead be answered by the same kind of open-source model running on Cloudflare Workers AI. Cloudflare processes the question only to write the reply: it does not store it and does not use it to train any model.

Your conversations are not stored anywhere. A question is sent to our server, used to write a reply, and then gone — it is not saved to our database and not saved in your browser. It stays in the page while you have it open and disappears when you close or refresh it. That means we cannot show you your old conversations, because there aren't any.

7. Third parties

We do not sell your data to any third party.

8. Data retention and deletion

A 7-Day Sprint or Monthly account is deleted when its subscription ends. If you cancel, you keep access until the end of the period you have already paid for. When that period runs out, your account and everything in it (progress, XP, badges and results) is deleted. The same happens if the subscription ends because a payment fails. Only your email address is kept, as the one-way fingerprint described below, until 30 June, so that the free trial cannot be taken a second time in the same exam year.

Every other account is deleted on 30 June each year, at the end of the GCSE exam season, together with its data. Progress, XP, badges and results are not carried from one exam year to the next. If you sign up again afterwards, you start fresh.

School accounts. Pupil accounts provided under a school licence, and their progress, are deleted at the end of the school's annual contract.

You can delete your account yourself at any time, from your Account page. It is deleted straight away, together with everything in it, and any subscription attached to it is cancelled at the same moment, so access ends then. We do not refund any remaining part of a period you have paid for. If you write to us asking for your account to be deleted instead, we do it within 30 days.

One thing survives a deletion, and only one. The 48-hour free trial is available once per email address. So when an account is deleted we keep a one-way encrypted fingerprint of the address — nothing else, no name, no history. It cannot be turned back into an email address, it is not readable by anyone outside our server, and it is used for nothing except refusing a second free trial to the same address. Every fingerprint is erased on 30 June each year, so the next exam year starts clean.

Payment records are kept for 7 years, as UK tax law requires.

9. Your rights (UK GDPR)

  • Right to access your data
  • Right to correct inaccurate data
  • Right to erasure ("right to be forgotten")
  • Right to data portability
  • Right to object to processing

To exercise any right, email privacy@gcsetutor.app. We'll respond within 30 days.

10. Cookies

We use only essential cookies required for authentication and security (session token). No advertising or tracking cookies.

11. Changes

We may update this policy. Significant changes will be notified by email. Continued use after 30 days constitutes acceptance.

12. Complaints

You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

© 2026 GCSE Tutor · privacy@gcsetutor.app