Privacy Policy

At EB-maths, we are deeply committed to protecting the privacy of our users, particularly the children who use our educational platform. This Privacy Policy is designed to comply with the General Data Protection Regulation (EU GDPR), the UK GDPR, and principles of the UK Age Appropriate Design Code (Children's Code).

We collect and process different data depending on your role on the platform. We only process data when we have a valid legal basis to do so.

A. Students (Children)

• Data Collected: Name, email address (or username), hashed password, curriculum / package access, learning data (see section 2E), active session IDs, token balances and rewards, streak / engagement signals, certificates, and support chat logs.
• Purpose: To provide the core educational service, track academic progress, secure the account against unauthorized sharing, and provide immediate customer support.
• Legal Basis:Performance of a Contract & Legitimate Interest (ensuring platform security).

B. Parents

• Data Collected:Name, email address, hashed password, linkage to the child's account, Stripe Customer IDs, subscription status, and AI-generated progress reports.
• Purpose:To manage subscriptions, process payments, send report emails, and provide parental oversight over the child's learning.
• Legal Basis: Performance of a Contract.

C. Affiliates

• Data Collected: Name, email, payout information, affiliate codes, and conversion tracking (including hashed IPs and truncated user-agents).
• Purpose: To attribute referrals accurately and issue commission payouts.
• Legal Basis: Performance of a Contract.

D. Website Visitors

• Data Collected: Analytics (visitor ID, session ID, pageviews, referrer URLs), cookie data, and pre-login support chat interactions.
• Purpose: To analyze website performance, track checkout funnels, and (subject to consent) display and measure relevant advertising.
• Legal Basis: Consent (for non-essential cookies and Ads) and Legitimate Interest (for basic technical platform analytics).

E. Learning & progress tracking (created accounts)

When a student or parent account is created, we record and update learning-related data so the platform can work. This is not optional marketing analytics and does not wait for cookie-banner consent. Declining analytics or marketing cookies does not turn off progress, quizzes, tokens, streaks, or parent reports.

• Data we track:Worksheet and section completion; answers and attempt counts; mistake-book items; section / module / topic / Practice Book quiz scores (including first vs latest accuracy); study-time and last-active signals; streaks and related engagement; practice-token balances, spends, and rewards; homework assignments and completion; confidence / self-ratings where offered; certificate eligibility; and Parent Hub summaries derived from the linked child's learning record.
• Where it is stored: Primarily in our database against the account, plus short-lived or device-local storage (e.g. workbook progress sync) needed to keep the learning experience reliable.
• Purpose: Deliver teaching materials in the right order; show Progress and Parent Hub accuracy; award tokens and certificates; power Mistake Book and re-measure quizzes; support homework and study habits; and keep the service secure and consistent across devices.
• Legal basis: Performance of a Contract (providing the educational product you signed up for). These processing activities are treated as strictly necessary / essential for the service — separate from optional analytics and advertising cookies described below.

Because our product is primarily used by children (ages 9–16), we enforce strict privacy boundaries:

• No Data Sales:We explicitly do not and will never sell children's personal data to third parties.
• No Targeted Ads for Kids: We do not use student data or student portals for targeted advertising or remarketing. Any advertising (Google Ads / Meta Pixel) tracking is restricted to the parent-facing marketing pages and checkout flows.
• Parental Involvement: The creation of accounts and payment processing is handled via the Parent Hub.

To operate our platform, we share necessary data with trusted third-party sub-processors. All processors are bound by strict data processing agreements:

• Stripe: Payment processing. (EB-maths does not store your credit card information.)
• Resend: Transactional emails, report mailing, and inbox management.
• MongoDB Atlas: Secure cloud database hosting.
• Vercel: Platform web hosting.
• Discord: Internal system alerts (alerts may contain limited signup/subscription information).
• NVIDIA (AI Services): Processing learning data to generate AI summaries for parents.
• Google (Google Ads): Used exclusively on parent-facing marketing pages for attribution and advertising, strictly subject to your prior cookie consent.
• Meta (Meta Pixel): Used exclusively on parent-facing marketing pages to measure and improve advertising campaigns, strictly subject to your prior cookie consent.

We use cookies and local storage to run our platform. Essential technologies include sign-in and all learning / progress storage needed for created accounts (section 2E). Non-essentialcookies (site analytics and advertising) are only set if you provide explicit consent via our Cookie Banner. Choosing "Essential only" does not disable Progress, worksheets, tokens, streaks, or parent learning reports.

We retain account data for as long as your account is active. If an account is deleted, we will safely erase or fully anonymize the associated learning data within 30 days. Affiliate logs and support chat histories are periodically cleared. Certain financial and payment records must be kept for up to 7 years to comply with statutory tax and accounting obligations.

We implement robust technical and organizational security measures. Passwords are securely hashed (using bcrypt), password resets use time-limited OTPs, all data is transmitted over HTTPS, and we utilize strict session management protocols.

Under the GDPR and UK GDPR, users (and parents acting on behalf of their children) have the right to:

• Access: Request a copy of the personal data we hold.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure:Request the deletion of personal data (the "Right to be Forgotten").
• Restriction/Objection: Limit or object to how we process your data.
• Data Portability: Receive your data in a structured, machine-readable format.
• Withdraw Consent: Withdraw your consent for cookies or marketing at any time via Manage cookie preferences.

To exercise these rights, please contact us at info@eb-maths.com. You also have the right to lodge a complaint with your national data protection authority (e.g., the Information Commissioner's Office (ICO) in the UK, or the Autoriteit Persoonsgegevens (AP) in the Netherlands).