Privacy notice

HearthStead is provided by HearthStead Learning Limited (in formation), a company to be registered in England and Wales [company number and registered office to be confirmed]. We are the data controller for the personal data described here.

ICO registration number: [to be confirmed]. Contact for data protection matters: privacy@hearthstead.co.uk [to be confirmed].

• Parent or carer account data: email address, display name, family name, password (stored only as a secure hash), consent records and the date and version of what you agreed to.
• Child profile data: a first name or nickname, year group and accessibility settings (read-aloud, font preference, session length). We do not ask for surnames, dates of birth, addresses, photographs of faces or school details.
• Learning data: answers to lessons, whether a hint was used, time spent per question, topic progress estimates, and any learning you choose to capture.
• Sharing records: share links you create, who they are for (if you label them), when they expire and when they are viewed.
• Payment data: if you subscribe, our payment provider processes your card details. We receive only your subscription status, plan and a customer reference — never your full card number.
• Technical data: security logs (such as sign-in times and IP address) kept to protect accounts and investigate misuse.

• To provide your account and lessons — performance of a contract (UK GDPR Art. 6(1)(b)).
• To process your child's learning data — your consent as the person with parental responsibility (Art. 6(1)(a)). You can withdraw consent at any time; this stops further processing but does not affect processing already carried out.
• To keep the service secure, prevent fraud and keep audit logs — our legitimate interests (Art. 6(1)(f)), balanced against your rights.
• To meet legal duties such as tax records for payments or responding to lawful requests — legal obligation (Art. 6(1)(c)).
• To share a child's record with another parent or carer at your request or where required by law — the basis is recorded for every grant.

Some features (such as activity ideas) use an AI model. We send only non-identifying information — for example a year group and interests — and never a child's name or photographs of faces. AI suggestions are always shown to a parent to accept or reject; no decision with legal or similarly significant effect is made solely by automated means.

Lesson difficulty adapts using transparent, rule-based mastery logic, not profiling for commercial purposes.

We never sell personal data and never use it for advertising. We use carefully selected processors under written contracts (UK GDPR Art. 28):

• Cloud hosting and database provider (data held in the UK/EU).
• AI model provider, receiving only the non-identifying prompts described above.
• Payment provider, acting as merchant of record for subscriptions.
• Email delivery provider, for account and confirmation emails.

We will share information with others only when you ask us to (for example a share link) or where the law requires it.

We aim to store data in the UK or European Economic Area. Where a processor transfers data outside these areas, we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment.

• Account, child and learning data: while your account is open. When you delete your account, data is removed within 30 days, then from backups within a further 35 days.
• Share links: until they expire or you switch them off; view logs for 12 months.
• Payment and invoice records: 6 years, as required by HMRC.
• Security and audit logs: up to 12 months unless needed for an investigation.
• Waiting-list entries: until launch plus 6 months, or until you ask us to remove them.

Encryption in transit and at rest, row-level access rules so families can never see each other's data, staff access only where needed and logged, and regular security reviews. If a personal data breach is likely to put you at risk we will tell you and the ICO within the legal time limits.

You have the right to: be informed; access your data; have it corrected; have it erased; restrict or object to processing; data portability (you can download your family record as CSV or JSON at any time); and withdraw consent. You can exercise these rights on behalf of your child where you hold parental responsibility.

We respond within one month. There is normally no charge.

Please contact us first so we can put things right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We will tell you by email and in the app before any material change takes effect, and ask for fresh consent where required.