Privacy and Cookies Policy
The short version
- Schools stay in control. When a school uses MathsForSATs, the school is the controller of its pupils’ information and we are its processor. We only use pupil information to run the service for the school.
- We collect very little about pupils. A name or display name chosen by the school, a username, their class, and what they do in the maths activities. No pupil email addresses, dates of birth, photographs, addresses, or information about health, special needs or family circumstances.
- Stored in the European Union. Our hosting provider and servers are in the EU. Encrypted backups are held with AWS S3 in the EU. We do not transfer pupil information outside the UK or European Economic Area.
- No adverts, no selling, no AI chatbots. We never sell children’s information or use it for advertising or to train AI.
- You can ask us anything. Email info@mathsforsats.com.
- Who we are
- Who is responsible for what
- What information we collect
- What we do not collect
- How particular features use information
- Why we use information, and our lawful bases
- Who we share information with
- Where information is stored
- Keeping information secure
- How long we keep information
- Children’s information
- Your rights
- Profiling and automated processing
- Cookies and similar technologies
- Complaints and the ICO
- Changes to this policy
- Contact us
1. Who we are
MathsForSATs.com is owned and operated by Vladimir Keves, a sole trader trading as LD Pro, of 6 Coldhams North, Huntingdon, England, PE29 1UB. We are registered with the Information Commissioner’s Office (ICO), registration number ZB688986.
This policy explains what personal information we collect, how we use it, where it is stored, who we share it with and what rights people have. We have written it for teachers, school leaders, parents and carers. A pupil-friendly summary is in our Compliance Centre.
2. Who is responsible for what
Under data protection law, the “controller” decides why and how personal information is used. A “processor” acts only on the controller’s instructions.
| Situation | Controller | LD Pro’s role |
|---|---|---|
| Pupil accounts and learning information created by a school or trust | The school or trust | Processor, under our Data Processing Agreement |
| A parent or carer creating an account for their own child (for example, Solo Explorer) | LD Pro, to provide the service the parent has asked for | Controller |
| Teacher, school leader, trust director and parent account details; billing; support enquiries; our website and security | LD Pro | Controller |
Where a school or trust is the controller, requests about pupil information should normally go to the school, and we will help the school respond. The school’s own privacy notice explains how it uses pupil information. We provide a template notice for parents and carers in the Compliance Centre.
3. What information we collect
Teachers, school leaders and trust directors
- Name, email address and login details.
- School name and class name. The school name entered by a teacher is also shown on pupil leaderboards (see section 5).
- Subscription details. Payment details are handled by Stripe and we do not store full card numbers.
- Information about how the account is used, tasks and class challenges you set, and messages you send us.
Parents and carers
- Name, email address, login and subscription details, and the information in the child’s account described below.
Pupils
| Information | What it includes |
|---|---|
| Account information | A name or display name chosen by the school, a username, the class the pupil belongs to, a password and an optional avatar. The school decides how pupils are identified (see “What we do not collect”). |
| Learning and performance information | Answers, whether each answer was correct, marks and scores, the questions attempted, topics and knowledge areas, test results and question-by-question breakdowns, progress and milestones, and aggregate accuracy. |
| Workbook Evidence | Marks that a teacher records from pupils’ marked exercise-book work: pupil, class, topic, learning objective, marks and total marks, and the date and time. |
| Activity information | Active practice time (time is counted only while MathsForSATs is the open, focused tab), the last time the pupil was active, and whether they are currently active. Teachers can see a 7-day history. |
| Game and reward information | Points, credits, stars, awards, levels, streaks, avatars owned, virtual pet names and bond levels, duel records, leaderboard entries, Hall of Fame entries, and monthly “Chronicle” chapters. |
| Technical information | IP address, browser and device type, dates and times of access, pages used and error information, kept in server logs for security and to keep the service working. |
4. What we do not collect
- Pupil email addresses. Pupil accounts are created with a system-generated placeholder, not a real email address.
- Dates of birth, home addresses, telephone numbers, photographs, gender, ethnicity, religion, free school meal status, special educational needs, health or behaviour information, or any other special category data.
- Information from a school’s management information system. Teachers add pupils to MathsForSATs themselves.
- Location data. We do not use GPS or collect precise location.
- Pupil messages, uploaded files or images. The service has no chat, messaging or upload features.
Schools decide how pupils are named. They can use first names, initials, class-set codes (for example “Puffin 1”), pupil numbers or any other convention. The service works in exactly the same way.
5. How particular features use information
Learning insight and automatic grouping
Every answer is marked automatically and added to a continuously updated picture of what each pupil knows. Teachers see strengths, gaps, topic-level results and class overviews. The service can also place pupils into practice groups based on their recorded results. See section 13.
Workbook Evidence, student cards and QR codes
Teachers can add results from marked exercise books. Printed student cards carry a QR code containing a signed technical token that identifies the pupil, class and activity. It does not contain the pupil’s name. Scanning uses the device camera, with the browser’s permission. The camera image, the QR code and the written score are read inside the browser on the device. No camera image or video is uploaded, transmitted or stored by MathsForSATs. Only the decoded token and the earned and total scores are sent to us. We design Workbook Evidence for scanning by a teacher or other authorised adult, and we recommend that schools do not let pupils operate the scanner. The scanning page loads open-source software libraries from a content delivery network (CDN). That request does not include pupil information.
Login cards
Teachers can print login cards for pupils. Each card shows the pupil’s name, username and password, and a QR code that fills in the login form. The login details in the QR code are placed after a “#” in the web address, which browsers never send to servers, so they stay out of our logs and analytics. Cards should be treated like any other school login credentials.
Leaderboards, Hall of Fame, duels and the Popcorn Panic lobby
These features are what make practice motivating, and they involve limited sharing between pupils. Other logged-in pupils, including pupils at other schools, can see a pupil’s display name, avatar, school name, scores and levels, and the names of their virtual pets. Maths Duels let a pupil challenge a pupil from another class. The Popcorn Panic lobby shows who is online. These features have no messaging. Teachers and other staff accounts are left off leaderboards. The school name shown is the text a teacher has entered, so a school that prefers less visibility can use a generic class description.
Virtual pets, rewards and Chronicles
Pupils can adopt virtual pets using credits earned through learning. Pets are happy when a pupil practises regularly and become sad or unwell if the pupil stays away, which the pupil can fix with in-game credits. Nothing can be bought with real money. Each month, “Chronicles” compiles a summary chapter for pupils who practised: accuracy, knowledge areas, honours, companions and leaderboard position. Chapters are kept until the pupil account is deleted, and can be viewed by the pupil and by their class teacher.
Trust dashboards
Trust directors, once verified by us, see class-level information only: class and school names, the teacher’s name, the number of pupils, and aggregated accuracy by knowledge area and topic. They do not see individual pupils’ names or results.
6. Why we use information, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing pupil accounts, activities, feedback, progress reports and insight for a school or trust | The school is the controller and relies on its own lawful basis (usually public task). We process on the school’s instructions as its processor. |
| Providing a child’s account to a parent or carer who subscribed | Contract (providing the service requested); legitimate interests in running and improving it |
| Creating and managing adult accounts, billing and support | Contract |
| Keeping the service secure, preventing misuse and unfair play, fixing faults, and improving the service | Legitimate interests |
| Tax and accounting records | Legal obligation |
| Non-essential cookies and marketing emails to adults | Consent, which you can withdraw at any time |
We do not use consent where another lawful basis is more appropriate.
7. Who we share information with
We share personal information only where needed to run the service:
- the school or trust whose pupils the information relates to, and its authorised staff;
- service providers (“sub-processors”) that host, back up, secure and support the service. The current list is in the Compliance Centre;
- Stripe, for payments by adult account holders;
- an email provider (currently Mailchimp, where used) to send service emails and, with consent, news to adult account holders. Pupil information is never sent to it;
- Google Analytics, for basic website statistics, which contain no pupil information;
- professional advisers, and the police, courts or regulators where the law requires.
We do not sell children’s personal information. We do not use pupil learning information for advertising, behavioural profiling for marketing, or training AI.
8. Where information is stored
Information is stored in the European Union. Our hosting provider is based in the European Union, and all of our servers are located within the European Union. Encrypted backups are held with AWS S3 in the European Union. We do not transfer pupil information outside the UK or the European Economic Area, and the UK treats the EEA as providing adequate protection for personal information.
Our basic website statistics (Google Analytics) contain no pupil information. Google may process that visit data in other countries under its own international transfer safeguards. Payment data is handled by Stripe under its own arrangements.
If we ever need to transfer information to a country that is not covered by UK adequacy regulations, we will first put in place the safeguards required by law (such as the ICO’s International Data Transfer Agreement or Addendum) and tell schools in advance.
9. Keeping information secure
- Information is sent between devices and our servers over encrypted (HTTPS) connections.
- Backups are encrypted and held in the European Union.
- Access is limited by role. Pupils see their own information and the limited leaderboard information described above. Teachers see only their own class. Trust directors are verified by hand and see class-level information only.
- Pupil accounts hold no email address, contact details or payment information, which limits what could be exposed.
- Passwords are protected using standard one-way hashing for log-in. So that teachers can reprint login cards, the current pupil password can also be shown to that pupil’s class teacher.
- If there is a personal data breach affecting a school’s pupils, we tell the school without undue delay so it can meet its own obligations.
More detail, including a printable security information sheet, is in the Compliance Centre.
10. How long we keep information
| Information | How long |
|---|---|
| Pupil accounts, learning records, game progress and Chronicles | While the pupil remains in the school’s class. Deleted when a teacher removes the pupil or deletes the class, or when the subscription has lapsed for the period in our Retention and Deletion Schedule. |
| Teacher, director and parent account details | While the account is active, then for the period in our Retention and Deletion Schedule. |
| Billing and tax records | As long as tax and accounting law requires (currently six years). |
| Backups | For a limited rolling period, after which they are overwritten. Deleted information can remain in a backup until that backup expires; it is not restored to the live service except to recover from a failure, and deletions are re-applied if it is. |
| Server and security logs | For a short period, as set out in the Retention and Deletion Schedule. |
The full schedule is in the Compliance Centre. We keep information no longer than reasonably necessary unless the law requires otherwise.
11. Children’s information
Children need particular protection. We follow the ICO’s Age Appropriate Design Code (the “Children’s Code”) and publish a statement explaining how, in the Compliance Centre. In summary:
- We collect only what is needed to provide the service, and pupils do not enter personal details.
- No adverts, no in-game purchases, no chat and no uploads.
- We carry out and publish a Data Protection Impact Assessment for schools.
- Pupils see a plain-language summary of how their information is used.
- Games and rewards are designed to encourage learning. Everything is earned through learning activities.
12. Your rights
Under UK data protection law, individuals may have the right to be informed; to access their information; to have inaccurate information corrected; to have information deleted; to restrict or object to processing; to data portability; and rights relating to automated decisions and profiling. Where processing is based on consent, you can withdraw it at any time.
How to use them. If your child’s school uses MathsForSATs, ask the school first. It can access and delete pupil information from the class dashboard, and we will help it respond within the legal time limit (normally one month). If you are a parent or carer who subscribed directly, or an adult account holder, email info@mathsforsats.com. We may need to check your identity. Some rights are subject to conditions and exemptions.
13. Profiling and automated processing
MathsForSATs automatically calculates percentages, identifies topic-level strengths and gaps, adjusts the difficulty of some activities (for example, Space Maths “velocity” levels), and can group pupils for extra practice according to their recorded results. This is profiling under data protection law. It uses simple, transparent rules based on marks, not hidden scoring or artificial intelligence. It does not produce decisions with legal or similarly significant effects. Teachers see the underlying results and decide what support is appropriate. Groups update as new results arrive.
14. Cookies and similar technologies
| Type | Purpose | Consent needed? |
|---|---|---|
| Strictly necessary cookies | Keep you logged in, protect the service against misuse, remember your membership and security checks | No |
| Local storage in your browser | Stores small preferences on the device, such as a pupil’s personal best score in a game. It stays on the device and is not sent to us. | No (strictly necessary or user-requested) |
| Analytics cookies | Google Analytics, to understand how the public website is used. No pupil names, usernames or learning data are sent. | Yes. Choose in the cookie controls on the website. |
| Payment cookies | Set by Stripe on payment pages to process and secure payments | Where required |
Some pages load fonts and script libraries from third-party servers (for example Google Fonts and a content delivery network). Those servers receive your device’s IP address and browser details, as any website request does. They are not sent pupil information. You can control cookies in your browser settings.
15. Complaints and the ICO
If you have a concern about how we use personal information, please tell us first at info@mathsforsats.com and we will acknowledge it, investigate it and reply. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
16. Changes to this policy
We may update this policy as the service or the law changes. The date at the top shows when it was last updated. We will tell schools in advance of material changes that affect pupil information.
17. Contact us
6 Coldhams North, Huntingdon, England, PE29 1UB
ICO registration number ZB688986
Data protection contact: info@mathsforsats.com (please put “Data protection” in the subject line)