Last updated: 2 July 2026 · Controller: StudYear (England & Wales) · Contact: contact@studyear.com
1. What we collect
- Account data — name, email, role (student/parent/teacher/school/tutor), school or family links you create.
- Learning data — subjects, levels, exam boards, diagnostic results, quiz scores, topic mastery, plans and their completion, resources you create, questions you ask the tutor.
- Billing data — subscription tier, credit balance and transactions. Card details are handled by our payment processor; we never store full card numbers.
- Technical data — device and usage information needed to run and secure the Service.
2. Why we use it (lawful bases)
- Running the Service (contract) — building your plans, tracking mastery, powering dashboards.
- Sharing across consoles (contract + consent) — a child's progress is visible to their linked parent, teacher or tutor only through explicit, revocable consent links.
- Safety, security and billing integrity (legitimate interests / legal obligation).
- Product improvement (legitimate interests) — using aggregated, de-identified analytics.
3. AI processing
Tutor answers, generated resources and assignment feedback are produced by third-party AI models under contracts that prohibit training on your data. Prompts are sent with the minimum context needed and are not used to build advertising profiles. Any AI assessment that matters (e.g. assignment marks) can be escalated to human review.
4. Children
StudYear is designed to conform to the UK Age Appropriate Design Code: high-privacy defaults, no behavioural advertising, no selling of personal data, and plain-language explanations. Child accounts are provisioned and overseen by a parent, guardian or school.
5. Retention and security
Learning records are kept while the account is active and deleted or anonymised within 12 months of closure (billing records are kept as required by law, typically 6 years). Data is encrypted in transit and at rest, with role-based access controls on every record.
6. Your rights
Under UK GDPR you can request access, correction, deletion, restriction, portability, and object to processing — email contact@studyear.com and we will respond within one month. You can complain to the ICO (ico.org.uk) at any time.
7. Sharing
We share data only with: processors who run the platform (hosting, payments, AI inference — each under a data-processing agreement), the people you have linked via consent, and authorities where the law requires it. We never sell personal data.