Draft for review - not legal advice - review before use.
Privacy notice
This notice is for adults who use Studytutor, including parents and carers. There's a simpler version for young people aged 13 to 17, one for children under 13, and a page for parents about their child's privacy.
Last updated 2 October 2026.
Who we are
Studytutor is run by Polylabs Research, a company registered in England and Wales, number 17530882. Our registered office is 82A James Carter Road, IP287DE. We're the controller of your personal data, which means we decide how it's used. Michael runs Studytutor for the company.
Contact us at contact@studytutor.co.uk. Our registration number with the Information Commissioner's Office (ICO) is C2071817.
Studytutor in short
- Studytutor is an AI tutor for GCSE revision, for pupils in England and Wales. It's a small beta: only people we approve can use it.
- The tutor is an AI (Claude, made by Anthropic), not a person. It can get things wrong.
- No other user can see your chats. No adverts. Nothing is sold. Nobody trains AI models on what you write here.
What we collect, and why
The waiting list
Your email address, your first name, whether you're a parent or carer or a student aged 13 or over, and either your short note (parents and carers) or how you heard about us (students). We use it only to contact you about joining. We never email anyone from the list itself, and we don't use it for marketing. It's deleted when we approve or decline you, and otherwise after about 6 months. If someone says they're a student under 13, we store nothing.
Your account
Your first name, an icon you choose, your sign-in email address, your Google account's permanent ID (from Google sign-in), whether you're a parent or a student, and for students your school year and the year you sit your GCSEs. We also keep Michael's note of how he checked you before approving you, and whether your "you're in" email was delivered.
You can sign in with Google or a one-use code emailed to your approved address. Proving an address doesn't approve an account. If you sign in before being approved, we add your verified address to the waiting list and contact you when you can start. The waiting list keeps it for up to six months. Sign-in codes expire after 10 minutes; limits on sending and guessing codes last up to 24 hours. We store protected hashes of codes, session tokens and addresses used for rate limits.
Age
Students give their birth month and year when they first sign in, never the full date, so we can check Studytutor is right for them and suggest their school year. For anyone 13 or over we keep only "13 or over" and delete the month straight away. We don't yet take new students under 13. A child under 13 can use Studytutor only once a parent or carer has said yes; their birth month is kept only while that parent looks after the account, and deleted soon after they turn 13.
Your notes for the tutor
Optional notes a student writes for the tutor, such as their exam boards or how they like to learn. Only the student and the tutor see them. Please don't put health details there.
Your chats
What you type, photos you attach, the tutor's replies, the marks from revise and exam sessions, and each chat's title (the start of your first message). We keep them so the tutor can help you and you can carry on later.
Photos
Only send photos of your written work, never of yourself or anyone else. Before a photo leaves your device, your browser saves a fresh copy of it, which removes location data.
The microphone
Some accounts have a microphone button (most don't yet). When you use it, the recording goes to Google's speech service in the EU to be turned into text. Neither Google nor we keep the recording. The text becomes part of your chat if you send it. Using the microphone is your choice (your consent); for a child under 13, a parent or carer with parental responsibility has to allow it first.
How much you use it
How much each person uses the tutor each day (the cost of the replies, and how many), so we can apply daily limits and keep Studytutor affordable. We also count how many of your messages the AI refused each day, and the kind of rule involved, never the message itself, so we can spot misuse.
Our safety check, if it's switched on
Studytutor has its own safety check, which Michael can switch on. While it reads your messages, the "Before you start" screen in the app says so, and you see that screen again whenever it's switched on or off for you. It's automatic, not a person: Anthropic's AI (see "Who else gets your data") reads each message you send, with any photos and the tutor's previous message, and decides whether there are signs that someone may not be safe. It gives each message one answer: no worry, or one kind of worry (self-harm, abuse or danger, sexual content, violence or weapons, drugs or dangerous activity, hate or bullying, or another worry). If it sees one, Michael is told the kind of worry and which chat it was in, never the words, and he may then read the message it flagged, and as much before it as he needs, as a safety concern (see "Can anyone read the chats?"). We keep a count of flagged messages per person per day, by kind of worry, never the messages, for 90 days. Each alert, and anything Michael does about it, also goes in his safeguarding record, which is kept as "How long we keep things" says. The check never pauses or blocks anyone and never tells a parent or anyone else, and you aren't told when one of your messages is flagged. It can be wrong either way, and nobody watches it as it happens.
Learning records
To make the explanations better, Studytutor keeps a record of what students practise: for each marked answer, the skill it tested, the marks, and the help before it (a hint, a worked example, a diagram); and that a diagram was drawn. These records are kept under a scrambled code made from the account with a secret key, not the account or the name, with the day but not the time, and never anything the student wrote. Michael only ever looks at totals across many students: a skill appears only once at least five different students have answered it. The diagrams the tutor draws are kept too, with no link to who they were drawn for, so the best can be checked and reused. A student can untick Helping Studytutor improve in Your account: nothing more is kept, and what was kept is deleted. Parents' use isn't recorded this way. We never sell any of it.
Reports
If you press Report under a tutor reply, we keep a copy of that reply (with the text of any diagram in it), your message just before it (the words only, never a photo), what you said was wrong, and any note you add. If you report a problem from Help, we keep what you wrote. Michael reads each report to put things right, and answers it in the app. Nobody else sees your reports. We delete a report 30 days after it's answered.
The help assistant
Help in the app has an assistant that answers questions about using Studytutor. It's an AI too (see "Who else gets your data"): it's told only whether you're a student or a parent and your age group, never your name, and it can't see your account, chats or marks. We don't keep what you ask it; we count how many questions you ask each day (a number, kept 2 days), and its cost counts towards your daily use.
When we approve you, we send one email saying you're in. We keep the email service's reference for it and whether it was delivered. If an email to you bounces or is reported as spam, we block your address by keeping only a scrambled code made from it with a secret key (a "keyed hash"). This is pseudonymised: we can recognise the address if it comes up again, but we can't turn the code back into it.
Logs
Google records each request to Studytutor (your internet (IP) address, the time, the page, and your browser type) for 30 days, in London, for security and to fix faults. Our own log lines hold account numbers and counts, never your email, name or messages.
Cookies and your browser
Studytutor sets essential cookies to complete sign-in and keep you signed in. Your session ends after 30 days without activity or 90 days overall; shared-device sessions end after 12 hours. You can sign out on this device or all devices. Google also uses its own cookies if you choose Google sign-in. The tutor stores a few things in your browser, for you: which chat you had open, your voice setting, and a message you haven't sent yet. We use no analytics or advertising cookies, and these public pages set none. The tutor also sets one cookie of its own: a random code that stays a year, used only to warn us if a parent confirms a child under 13 from the same browser as the child asked from. We store only a keyed hash of it, with that request and that confirmation, and nothing else uses it.
Our lawful basis
- Legitimate interests for the tutoring, accounts, sign-in, limits, the misuse counts, the safety check (if it's on), the waiting list, email and logs, at every age: giving you the revision help you asked for, safely and affordably. We give children's interests extra weight, and for a child under 13 a parent's confirmed OK is a condition of joining. You can object (see "Your rights").
- Consent for the microphone. You can stop at any time by not using it, or ask us to switch it off.
- Safeguarding a child, if we're ever worried about a child's safety (see "Who can see what"). The safety check's kinds of worry can be information about someone's health or sex life, or about a crime, which the law treats as especially sensitive. For those, and for anything we do about a safety worry, we rely on the Data Protection Act 2018's condition for safeguarding children and people at risk, under a written policy.
- Legal obligations, for records of complaints and security incidents.
You don't have to give us anything, but without a sign-in email and a first name we can't give you an account.
Who else gets your data
Anthropic, which makes the AI
To answer, the tutor sends Anthropic your messages and photos, its instructions, and what we tell it about you: your first name, age group, school year, the year you sit your GCSEs and your notes for the tutor, and in revise and exam sessions a summary of your earlier marks in that subject. It never gets your email address or surname: each request carries an account number instead. Anthropic (Anthropic Ireland, Limited, under contract with us) is our processor. It may not train its models on this. If our safety check is switched on, it runs on Anthropic's AI too, with the same messages and photos.
The help assistant sends Anthropic your questions to it and its answers so far in that conversation, with Studytutor's guides and whether you're a student or a parent. Nothing else about you.
Anthropic's automated safety systems check messages and photos. It deletes them within 30 days. If its systems flag something as breaking its rules, it can keep it for up to 2 years, and the safety scores for up to 7 years. Anthropic reports child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), a US child-protection organisation that works with the police, and it can report someone trying to use the AI to harm children.
Where Claude runs: Claude may run in the US and other countries. Anthropic stores data in the US. These transfers are protected by standard contractual clauses with the UK's addendum, and we've assessed the risk. The clauses are part of Anthropic's data processing addendum (anthropic.com/legal/data-processing-addendum), and we'll send you a copy if you ask.
Studytutor runs on Google Cloud in London: accounts, chats, photos, marks and our logs are stored there. The exception is Google's own record of changes to how our Google Cloud account is set up, which includes changes to our sign-in list and so can include your email address: Google keeps that record for 400 days in its global systems, not only in London, and we can't change either. If you choose Google sign-in, Google knows you use Studytutor; your Google account itself is covered by Google's own privacy policy. Email-code sign-in does not require a Google account. The microphone uses Google's speech service in the EU. Google is our processor under its Cloud Data Processing Addendum; where Google moves data to the US, the UK's data bridge with the US covers it, and standard contractual clauses in that addendum cover other countries (ask us for a copy).
Scaleway
Scaleway (Scaleway SAS, France) sends requested sign-in codes and the "you're in" email for us, from the EU only. It's our processor. We've switched off open and click tracking.
Nobody else
We don't sell data, show adverts, or share anything with schools or other families. We'd share something only where the law requires it, or to keep a child safe (see below).
Who can see what inside Studytutor
- You see your own chats, marks and progress.
- Other users never see your chats. There's no way to share them.
- Parents and carers see nothing of a child's account unless they're linked to it in the app. Young people aged 13 or over choose whether to share their marks and progress with a parent, from Your account or when a parent invites them (they're asked when they first sign in, with an equal choice either way), and can stop at any time. A parent of a child under 13 adds them from their Family page, Michael checks with the parent, the child types the parent's email when they sign in, and the parent confirms the child's details before anything starts; the parent then sees their marks, the topics they've practised and how much they've used each day, until the child turns 13. Where a parent could already see a young person's marks before Studytutor opened to other families, that carries on until the young person is asked once whether it should. Never their chats, and never what time they chat. The child is told, and their screen shows it. See our page for parents.
- Michael, who runs Studytutor, sees your name, icon, school year, email address, role, whether you've signed in (or that your address has no Google account yet), his note of how he checked you, how much you use Studytutor, how many chats you have, and today's counts of your messages the AI refused, of replies that were cut off and, if the safety check is on, of your messages it flagged. He looks at one person's spending only when he's changing their daily limit, and at a student's birth month only if he opens it; both are logged. He never sees your notes for the tutor or your chats in Studytutor's admin screens.
Can anyone read the chats?
Technically, yes: as the person who runs Studytutor's Google Cloud account, Michael can read anything stored. He doesn't. He would look at stored chats only for a safety concern (an alert from the safety check is one), a problem the person reports, or the person's own request, never because a parent asked. Direct reads of stored data are recorded automatically in Google's audit logs, and he keeps a written record of each time he looks and why.
If he's ever worried about a child's safety, he may share what's needed with someone who can help keep the child safe, such as the police or children's services. That may not be the parent. Nobody reads chats as they happen, and the tutor can't get help for anyone: see staying safe.
Decisions made by computer
Nothing about you is decided automatically in a way that has a legal or similarly significant effect. When you reach your daily limit the tutor stops until midnight. If the AI refuses a lot of someone's messages, Michael is told, and he decides whether to pause the account while he checks. That's never automatic. If the safety check is on, it decides only that Michael is told; anything after that is a person's decision.
How long we keep things
- Waiting list: until we approve or decline you, otherwise about 6 months.
- Accounts, chats, photos and marks: for students, until 12 months after the summer of their exam year, or after 12 months without using Studytutor, whichever comes first, with a month's warning. For adults, 12 months without using it. You can delete any chat at any time, and ask us to delete your account at any time.
- Birth month: only while a child under 13 is supervised by a parent, and deleted soon after they turn 13; never kept past the age check for anyone 13 or over.
- Daily usage: 13 months. Refused-message and safety-check counts: 90 days. Logs: 30 days (safety-check alerts included).
- Blocked-address codes: while Studytutor runs.
- Learning records: 13 months. Diagrams kept for the library: deleted 90 days after they were last drawn, unless chosen for the library.
- Reports (a reported reply, or a problem you reported): until Michael answers, then 30 days. Questions to the help assistant: not kept by us; the day's count, 2 days.
- Safeguarding records (each safety-check alert or other safety concern, what was looked at and why, and what was done; never an image or a copy of the chat): until the child is 25, or 6 years after the case closes if that's later.
- Copies elsewhere: Google's backups can hold deleted data for up to 14 weeks, its recovery copies for 7 days, and earlier versions of a chat for 30 days. A monthly copy of the database, kept apart from the live service in case of disaster, holds data for up to 12 months; nobody reads a backup, and if one is ever restored, deletions made since are repeated. Google keeps a record of changes to our sign-in list, which may include your address, for 400 days, and we can't shorten that. Anthropic's copies are described above. Scaleway keeps records of the emails it sent for a limited period under its own terms.
Your rights
You can ask for a copy of your data, ask us to correct it or delete it, ask us to limit how we use it, object to how we use it, and stop using the microphone at any time. Email contact@studytutor.co.uk. It's free, and we reply within a month (or tell you within that month if a complex request needs up to two more). We may ask you to confirm it's you, usually by writing from the address you sign in with, and we send a copy of your data only to that address. You can already delete any chat yourself in the app.
Children have these rights too, and can use them themselves. A parent can act for a child only if the child agrees, can't yet understand their rights, or it's clearly in the child's best interests. If a parent asks for a child's chats, we ask the child first.
Complaints
If you're unhappy with how we've handled your information, tell us at contact@studytutor.co.uk. We'll acknowledge it within 30 days, look into it, and tell you what we found. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Children's privacy
We follow the ICO's Children's Code (the Age Appropriate Design Code) for everyone who uses Studytutor: high privacy by default, first names only, no nudges or streaks, and clear information for each age.
Changes to this notice
If we change how we use your data in a way that matters, we'll update this notice, and everyone it affects sees the "Before you start" screen again in the app.