DRAFT. This is a draft of the privacy notice for parents and guardians. It is not yet final. Details in [SQUARE BRACKETS] are still to be filled in by the owner, and a qualified adviser must approve this text before it goes live.
Privacy notice for parents and guardians
Version [0.1] · Last updated [DATE] · Previous versions: [LINK]
1. Who we are
11Prep Detectives is run by [LEGAL NAME OF OWNER OR COMPANY; company number if any], [REGISTERED OR TRADING ADDRESS]. We are the controller of the personal data in this notice. Privacy contact: [PRIVACY EMAIL]. ICO data protection fee registration: [ICO REGISTRATION NUMBER]. [DPO: we are not required to appoint a Data Protection Officer: REVIEWER TO CONFIRM.]
2. Who the service is for
11Prep Detectives is an online revision game for children preparing for 11+ selection tests (about ages 8 to 11). Only a parent or guardian aged 18 or over can create an account. Children play inside the parent's account. We do not knowingly accept an account created by a child. We do not use any artificial-intelligence model on your child's data. [If this changes we will update this notice first.]
3. What we collect, why, and our lawful basis
[REVIEWER: confirm bases, especially for children's data, where the parent is the contracting party.]
| Data | Detail | Purpose | Lawful basis (UK GDPR Art 6) |
|---|
| Parent email | Sign-in, verification and password-reset emails, deletion warnings, service messages | Run the account | Contract |
| Password and parent PIN | Only one-way salted hashes (scrypt). We cannot read them | Secure sign-in; protect the parent area | Contract; legitimate interests (security) |
| Child's first name or nickname | Up to 20 characters, up to 6 profiles, entered by the parent | Show in the game and in reports | Contract |
| Practice results | Per round or test: question numbers, the option chosen, right or wrong, hints used, time taken, date. Each result also carries a random identifier made by the device so that a retry never saves it twice | Save progress, show weak spots, unlock the next case | Contract |
| Game progress and settings | Tokens, unlocked cases, options set in the parent area | Make the game work on every device | Contract |
| Plan and access status | Your plan, its status and end date, and any invite or access code you enter (which code, and when). While the service is free and invite-only this is all we hold. We never see or store card numbers. [Paid plans are not open yet. If they open, we will also store the Paddle subscription and customer reference, and will update this notice first.] | Give access to the content; manage the plan; later, handle refunds | Contract; legal obligation |
| Weekly progress email (optional, off unless you turn it on) | If you switch it on in the parent area we store that choice and the date you made it, then email a verified address once a week, only for a week in which a child practised. The email contains the child's first name and a short summary of that week's practice (for example how many questions, how many right, topics to revisit), a link to the app and a one-click unsubscribe link. We also keep one record per week showing whether it was sent | Give you a weekly picture of progress | Consent (withdraw any time in the parent area or with the link in every email) |
| Progress details for the parent area | For every answer we also keep: which question and skill, whether it was right, how many seconds it took, whether a hint was used, how many times the answer was changed, how long the app was in the background, the position in the sitting, the hour of the day, and a rough device type (phone, tablet or computer). We do not keep the device model, browser details or any location. From this the parent area shows charts, a skill map, goals and a printable report | Show you how your child is getting on and what to do next; keep the exam-practice plan sensible | Contract (it is the progress reporting you signed up for) |
| Anonymous group figures | Totals across many children (for example the middle range of scores on a skill), with no names or ids, only shown when at least 20 children contribute, and rounded to the nearest 5%. Used for the optional “compare with other children” view and to spot questions that are unfair or too hard. You can leave your children out at any time in Parent area, Reports. We record that choice | Fair comparison and quality checks on questions | Legitimate interests (we have weighed these against your child's interests; you can object by leaving out) |
| Read-only share link (optional) | If you create one, we store a hashed code, the child it covers and an expiry (30 days). The page it opens shows the child's first name only, skill levels and a few charts, and no contact details. You can switch it off at any time; creating a new link switches off the old one | Let you show a tutor or teacher | Consent (you create it; you can end it) |
| Parent-area usage | Which parent-area pages you open (a fixed list such as “Skill map”) and which locked previews you see. No text you type is recorded | Improve the parent area | Legitimate interests |
| Sign-up record | Date and time you ticked "I am the parent or guardian" and accepted this notice and the Terms. The app stores the date and time only, not a version number of the notice or Terms [OWNER: decide whether to add version numbers before launch] | Show that you agreed, and when | Legal obligation (accountability); legitimate interests |
| Activity log | Date, type of event and account number: sign-up, sign-in, email verified, password reset, each practice round saved (topic, number of questions, number right), emails sent or failed, weekly email switched on or off, plan or code changes, and errors. Failed sign-ins and rate-limit hits are logged too (these can have no account number) | Keep the service secure and fix faults | Legitimate interests (security, reliability) |
| Staff action log | If our staff change something on your account (for example resend a verification email, extend access) it is recorded with the staff member's email, the date, the action and the account number. When an account is deleted, the staff log keeps no email address for the deleted account | Accountability and abuse prevention | Legitimate interests |
| Technical data | Your IP address is used briefly in memory to slow repeated sign-in attempts and may be kept in web-server logs for [N] days [CONFIRM per hosting] | Stop password guessing and abuse | Legitimate interests (security) |
| Support emails | What you send us, our replies | Answer you | Contract; legitimate interests |
| Optional "tell me when subscriptions open" box | A yes or no flag (no date is stored) | One email when paid plans open | Consent (withdraw any time in the parent area) |
| Website invite list (only if you ask for an invite on our public website) | Your email address, your child's school year and how you heard about us if you chose to give them, and the date and time you confirmed you are the parent or guardian. It is not linked to any account. | Send your invite and updates about it | Consent (ask us to delete you at any time; entries are also deleted after 12 months) |
We do not collect: your child's surname, date of birth, school, photo, location, voice, contacts, device identifiers, or any free text typed by a child (a child's one-word answer to a story riddle is checked on the device and is not saved). We use no analytics, advertising, social-media or tracking tools. We make no automated decisions with legal or similarly significant effects, and we do not profile your child for marketing. Weak-spot rankings are shown only to you as a study aid.
4. Who receives data (our processors and other controllers)
We never sell or rent data. The only outside service that handles anything about a child is our email provider (Resend), and only in the optional weekly email described above, which names the child by first name and summarises practice. Nothing else about a child leaves our servers. Our app does not use AI, and no child data is sent to any AI service.
| Recipient | Role | What they get | Where | Safeguard |
|---|
| [HOSTING: provider name] (virtual private server) | Processor | All account data | [UK / EEA: COUNTRY, CONFIRM] | [Provider's data processing terms: CONFIRM] |
| Resend (email delivery) | Processor | Your email address and the text of every email we send: verification, password reset, deletion warning and, if you opt in, the weekly progress email (which includes a child's first name and a practice summary). They keep email logs for about 30 days [per Resend's GDPR page, 5 Oct 2026: VERIFY] | United States | Resend DPA with UK Addendum and EU-US Data Privacy Framework with UK Extension [VERIFY current status] |
| Paddle (payments; "merchant of record"). [NOT IN USE YET: paid plans are not open. Keep this row only for the paid launch.] | Independent controller of your payment, billing and tax data. Paddle is the seller of the subscription to you | Your payment details and billing address, collected by Paddle directly. We pass an internal account number and plan; Paddle sends us subscription status, a reference number and customer ID | [Paddle.com Market Limited, London; Paddle's own transfers: see Paddle's notice] | Paddle's own privacy notice: [LINK] |
| Support and privacy mailbox provider [NAME]; accountant, adviser, insurer [DELETE ANY NOT USED] | Processors or independent | Only what the task needs (for the mailbox, the emails you send us) | [LOCATION] | [Contract or confidentiality: CONFIRM] |
| Authorities, courts | Independent | Only if the law requires | UK | n/a |
5. Where data is stored and international transfers
Our servers are in [UK / EEA: COUNTRY, HOSTING DETAIL]. Data is stored there, not on the owner's own computer.
Access from India. The service is run by one person who is based in India. They administer the server, and can see account data, from India. Remote access to data held in the UK is a transfer of personal data outside the UK. [ADVISER TO CONFIRM how this is covered, for example the ICO's International Data Transfer Agreement or the UK Addendum with a transfer risk assessment, or another route, and whether a written agreement is needed when the owner is both the controller and the person in India. We state no legal conclusion here.] We limit access to what running the service needs, and sign-in to the back office is restricted to named staff.
Email provider. Resend sends our emails and processes them in the United States under the safeguards in section 4 [VERIFY the current status of Resend's UK Addendum and any Data Privacy Framework certification at the date of publication].
[If any other provider is outside the UK, list it. EEA countries are covered by UK adequacy regulations: REVIEWER TO VERIFY at ico.org.uk.]
6. How long we keep data
These are the automatic rules the app applies once a day (tools/retention.mjs). The daily job must be switched on in the live service [OWNER: confirm before launch]. [OWNER: confirm you want to publish these periods.]
| Data | Kept for |
|---|
| Account, child profiles, practice results, settings | Until you delete the account, or until 12 months with no sign-in and no practice. We email you a warning 30 days before deletion (at about 11 months). Signing in or practising after the warning cancels the deletion |
| Account with a live paid subscription | Never deleted automatically. If the subscription ends, the 12-month inactivity rule applies from then |
| Account whose email is never confirmed | 7 days, then deleted |
| Activity log | 12 months, then deleted. Failed-sign-in and rate-limit entries: 30 days. Entries carrying your account number are also deleted at once when you delete your account. We keep one entry saying that an account was deleted, with no name, email or account number |
| Weekly-email send records (one per week) | Until you delete the account (they are deleted with it). Turning the weekly email off stops further emails; the old records stay until the account is deleted |
| Per-answer progress details and sitting records | 24 months, then deleted by the daily job (the practice results above are kept until the account is deleted). Deleted with the account at any time |
| Parent-area usage records | 12 months, then deleted |
| Share links | Until they expire (30 days) or you switch them off; then deleted by the daily job |
| Sign-in sessions | 30 days (deleted earlier when you sign out) |
| Email verification link | 24 hours. Password-reset link: 1 hour. Used or expired links are deleted |
| Staff action log | 24 months, then deleted by the same daily job. [OWNER: confirm this period] |
| Rate-limit counters (IP address) | In memory only, discarded within about an hour or on restart |
| Web-server logs (IP address) | [N] days [CONFIRM] |
| Backups | Encrypted copies are kept for [14] days, so deleted data leaves backups within that time [CONFIRM against the real backup set-up] |
| Payment and tax records | None while the service is free. [If paid plans open: held by Paddle and our accountant, normally [6] years for tax; card numbers are never stored by us.] |
| Support emails | [12 months after the last message] |
7. Your rights (and your child's)
You can ask us to: see your data, correct it, delete it, restrict or object to its use, and receive it in a portable form. Where the data is about your child you can do this for them; an older child who understands what is involved may also ask. In the parent area you can download your data (your email, each child's name and settings, and practice results) and delete the account yourself. Deleting the account removes, at once and together, the account, child profiles, practice results, sign-in sessions, email links, access-code records, weekly-email records and every activity-log entry carrying your account number (backups: section 6). If a paid subscription ever exists, deletion cancels it first. Copies kept in your own browser are covered in section 9. For anything else email [PRIVACY EMAIL]. We reply within one month, and we will say if we need longer.
8. Complaints
Please tell us first at [PRIVACY EMAIL] or by post to [ADDRESS]. We will acknowledge a data protection complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113. [Complaints duty under the Data (Use and Access) Act 2025 in force from 19 June 2026: REVIEWER TO CONFIRM wording.]
9. Cookies and similar storage
We use one sign-in cookie (__Host-da_sid; HttpOnly, Secure, lasts up to 30 days) that keeps you signed in. We also keep a few items in your browser storage to make the game work: which child was last chosen, a save queue so progress is not lost if you go offline, an unfinished round, and the study plan if you save one. These are needed to provide the service you asked for. We use no advertising, analytics or tracking cookies and load no third-party scripts, fonts or images. The full list, with what each item holds and how long it lasts, is on the cookies page. [ADVISER TO CONFIRM that these items need no consent banner.]
10. Children's privacy by design
We built 11Prep Detectives to follow the ICO's Children's Code (Age Appropriate Design Code): only the data needed, the most private settings by default, no adverts, no tracking, no sharing, no location, no chat, and a PIN on the parent area. Wrong answers are never punished and practice has no countdown. [If a timed exam mode is released it will be off until a parent turns it on.] Our assessment is summarised at [LINK].
11. Security
Passwords and PINs are hashed; sign-in tokens are stored only as hashes; connections use HTTPS; access to our server is restricted; we keep tested backups. If a breach is likely to put people at risk we will tell the ICO within 72 hours of becoming aware, and tell affected parents without undue delay where there is a high risk.
12. Marketing emails
We send service emails (verification, password reset, deletion warning, billing) to the parent address. We send marketing only if you ticked the optional box. The weekly progress email is separate and optional (off unless you switch it on), and every one carries a one-click unsubscribe link. You can withdraw either in the parent area or by email.
13. Changes
We will update this notice when what we do changes, show the date and version, and email you if the change matters.
Back to 11Prep Detectives