Privacy Policy

At EB-maths, we are deeply committed to protecting the privacy of our users, particularly the children who use our educational platform. This Privacy Policy is designed to comply with the General Data Protection Regulation (EU GDPR), the UK GDPR, and principles of the UK Age Appropriate Design Code (Children's Code).

We collect and process different data depending on your role on the platform. We only process data when we have a valid legal basis to do so.

A. Students (Children)

• Data Collected: Name, email address, hashed password, learning data (progress, wrong attempts, self-rating, study-time, worksheet interactions), active session IDs, and support chat logs.
• Purpose: To provide the core educational service, track academic progress, secure the account against unauthorized sharing, and provide immediate customer support.
• Legal Basis:Performance of a Contract & Legitimate Interest (ensuring platform security).

B. Parents

• Data Collected:Name, email address, hashed password, linkage to the child's account, Stripe Customer IDs, subscription status, and AI-generated progress reports.
• Purpose:To manage subscriptions, process payments, send report emails, and provide parental oversight over the child's learning.
• Legal Basis: Performance of a Contract.

C. Affiliates

• Data Collected: Name, email, payout information, affiliate codes, and conversion tracking (including hashed IPs and truncated user-agents).
• Purpose: To attribute referrals accurately and issue commission payouts.
• Legal Basis: Performance of a Contract.

D. Website Visitors

• Data Collected: Analytics (visitor ID, session ID, pageviews, referrer URLs), cookie data, and pre-login support chat interactions.
• Purpose: To analyze website performance, track checkout funnels, and (subject to consent) display and measure relevant advertising.
• Legal Basis: Consent (for non-essential cookies and Ads) and Legitimate Interest (for basic technical platform analytics).

Because our product is primarily used by children (ages 9–16), we enforce strict privacy boundaries:

• No Data Sales:We explicitly do not and will never sell children's personal data to third parties.
• No Targeted Ads for Kids: We do not use student data or student portals for targeted advertising or remarketing. Any advertising/Google Ads tracking is restricted to the parent-facing marketing pages and checkout flows.
• Parental Involvement: The creation of accounts and payment processing is handled via the Parent Hub.

To operate our platform, we share necessary data with trusted third-party sub-processors. All processors are bound by strict data processing agreements:

• Stripe: Payment processing. (EB-maths does not store your credit card information.)
• Resend: Transactional emails, report mailing, and inbox management.
• MongoDB Atlas: Secure cloud database hosting.
• Vercel: Platform web hosting.
• Discord: Internal system alerts (alerts may contain limited signup/subscription information).
• NVIDIA (AI Services): Processing learning data to generate AI summaries for parents.
• Google (Google Ads / Analytics): Used exclusively on parent-facing marketing pages for attribution and advertising, strictly subject to your prior cookie consent.

We use cookies and local storage to run our platform. Non-essential cookies (such as those used for analytics and advertising) are only set if you provide explicit consent via our Cookie Banner.

We retain account data for as long as your account is active. If an account is deleted, we will safely erase or fully anonymize the associated learning data within 30 days. Affiliate logs and support chat histories are periodically cleared. Certain financial and payment records must be kept for up to 7 years to comply with statutory tax and accounting obligations.

We implement robust technical and organizational security measures. Passwords are securely hashed (using bcrypt), password resets use time-limited OTPs, all data is transmitted over HTTPS, and we utilize strict session management protocols.

Under the GDPR and UK GDPR, users (and parents acting on behalf of their children) have the right to:

• Access: Request a copy of the personal data we hold.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure:Request the deletion of personal data (the "Right to be Forgotten").
• Restriction/Objection: Limit or object to how we process your data.
• Data Portability: Receive your data in a structured, machine-readable format.
• Withdraw Consent: Withdraw your consent for cookies or marketing at any time.

To exercise these rights, please contact us at info@eb-maths.com. You also have the right to lodge a complaint with your national data protection authority (e.g., the Information Commissioner's Office (ICO) in the UK, or the Autoriteit Persoonsgegevens (AP) in the Netherlands).