Privacy Policy

Oak Tuition UK Ltd is the data controller. We are registered in England and Wales, company number 17431270, registered office 82A James Carter Road, Mildenhall, Suffolk IP28 7DE, United Kingdom. Our ICO registration number is ZC248153.

For anything about your data, email admin@oak-tuition.co.uk.

About you, the parent or guardian:

• your name and email address;
• your password, which we store only as an irreversible hash — we cannot read it;
• your subscription status, and identifiers Stripe gives us so we can match payments to your account.

About your child:

• their first name or the name you give them;
• their key stage and chosen subjects;
• a login code, and a PIN stored only as a hash — nobody at Oak Tuition can look up your child’s PIN;
• their learning record: which work they have started or completed, how long they spent, their quiz answers, whether each answer was right, and their scores.

We do not ask for your child’s date of birth, address, photograph or school, and we do not ask children for an email address.

Technical information: a small number of failed sign-in attempts and lockout times, kept to stop someone guessing a PIN.

We never see your card details. Payment is taken on Stripe’s own pages. Card numbers do not reach our servers.

• To provide the service you have paid for — creating accounts, setting and marking work, showing you your child’s progress. Lawful basis: performance of our contract with you.
• To keep accounts secure — password hashing, sign-in lockouts. Lawful basis: our legitimate interest in protecting children’s accounts from unauthorised access.
• To send service emails — welcome messages, password resets, notice of changes. Lawful basis: performance of our contract.
• To meet our legal obligations — keeping financial records. Lawful basis: legal obligation.

We do not use your or your child’s data for advertising, we do not profile children, and we do not sell data to anyone.

The contract is with you, the adult. You give us your child’s information when you register, and you can see, correct or delete it at any time from your account or by emailing us.

We follow the ICO’s Age Appropriate Design Code. In practice that means we collect the least we can, we do not use children’s data for marketing, there is no advertising or tracking in the child’s experience, and settings are private by default. A child’s work is visible only to them, to you, to their assigned tutor, and to our administrators.

We use a small number of suppliers who process data on our instructions. They cannot use it for their own purposes.

• Stripe — Takes and processes subscription payments. Your name, email address and card details. Card details are entered on Stripe's own pages and never reach our servers.
• Resend — Sends account emails — welcome messages, password resets. Your name and email address.
• Railway — Hosts the website and database. All data stored by the service, held on their infrastructure.

Some of these suppliers operate outside the UK. Where data is transferred abroad, it is protected by safeguards recognised under UK data protection law, such as the International Data Transfer Agreement or an adequacy decision.

We may also disclose data where the law requires it, or where we must act to protect a child from harm.

We use one cookie, oak_session, which keeps you signed in. It is strictly necessary for the service to work, so it does not require consent.

With your consent we also use the Meta Pixel, which tells us which of our adverts brought you here and whether a visit led to a subscription. It sets cookies in your browser and shares that activity with Meta Platforms Ireland Limited, who act as a joint controller for it.

We ask before it loads, and nothing is set if you decline. You can change your mind at any time by clearing this site's data in your browser, which makes the banner appear again. Declining has no effect on the service.

• Account and learning records — while your subscription is active, and for 12 months afterwards, so a returning child does not lose their progress. Then deleted.
• Financial records — six years from the end of the accounting period, as UK tax law requires.
• Sign-in security records — a short period, then cleared automatically.

You can ask us to delete your child’s data sooner. See below.

You can ask us to:

• give you a copy of the data we hold about you or your child;
• correct anything that is wrong;
• delete it — including your child’s learning record;
• restrict or object to how we use it;
• send it to you or another provider in a portable format.

Email admin@oak-tuition.co.uk. We will respond within one month. There is no charge.

Deleting a child’s account removes their work, quiz answers and progress permanently, and cannot be undone. If you only want to pause, ask us to suspend the account instead.

Connections to the site are encrypted. Passwords and PINs are stored only as irreversible hashes. Access to a child’s work is checked on every request, and uploaded worksheets are never publicly accessible.

No service can promise perfect security, but if a breach occurred that put you or your child at risk, we would tell you and the ICO as the law requires.

Please come to us first at admin@oak-tuition.co.uk.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

If we change this policy in a way that materially affects you, we will email you. The date at the top shows when it was last updated.