Privacy Policy

1. Who we are

ElevenPlusEdge is operated by Star Learning Hub Ltd (company number 17237374), registered office: 6 Pimpernel Mead, Bradley Stoke, Bristol BS32 8ET, United Kingdom. We are the data controller for the personal data described here. Contact: support@elevenplusedge.co.uk.

2. What we collect

• Parent account data — your name, email address and password (stored as a secure hash, never in plain text), your consent choices, and your purchase history.
• Child profile data — the first name (or nickname) you choose, school year, exam year and exam board, a login PIN, and your child’s mock exam activity: answers, scores, timings and the reports generated from them.
• Payment data — payments are processed by Stripe. We never see or store card numbers; we keep the transaction reference, the pack purchased and the amount paid.
• Support messages — if you email us or use the contact or notify forms, we receive what you send (name, email, message).
• Free mini mock data — you can sit our free mini mock without an account. While you do, we store your answers, scores and timings against an anonymous session held in a cookie on your device, along with the year group and optional first name you enter. We also record technical details (IP address, browser type, referring page and any advertising campaign parameters) to prevent abuse and to understand which adverts bring people to us. If you then create a free account to unlock the full report, we link that session to your account and store your email address, the consent choices you made, and those technical details as evidence of consent. Anonymous sessions that are never linked to an account are deleted automatically.

3. Children’s data

The service is designed with the ICO Age Appropriate Design Code (Children’s Code) in mind. Child profiles are created and controlled by a parent; we collect the minimum needed to run mocks and produce reports. We never ask children for contact details, never show them advertising, and never use their data for marketing. Reports about a child are available to the managing parent only.

4. How we use personal data

• To provide the service (legal basis: contract) — running mocks, scoring, generating reports, managing your account and purchases, transactional emails such as receipts.
• To support you (contract / legitimate interests) — answering messages sent to support.
• Marketing to parents (consent) — only if you opted in, and you can withdraw at any time; we never market to children.
• To improve the service (legitimate interests) — understanding aggregate performance of questions and mocks.
• Legal obligations — keeping purchase records for tax and accounting.

5. Who processes data for us

We use a small number of service providers, each processing data only on our instructions: Supabase (database and authentication), Vercel (website hosting), Stripe (payments), Google (our support mailbox) and FormSubmit (delivery of the contact and notify forms). Our database is hosted in the UK/EEA region; some providers (for example Stripe and Vercel) may process data in other countries under appropriate safeguards such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses. We do not sell personal data, ever.

6. How long we keep it

• Account and child data — for as long as your account is active. You can delete a child profile yourself, or ask us to delete your whole account.
• Purchase records — up to 6 years, as required for tax and accounting.
• Support emails — kept as long as needed to handle the matter, then routinely cleared.

7. Cookies and analytics

Essential cookies are always on — they keep you logged in and remember your cookie choice. These do not require consent because the site cannot work without them.

Analytics and advertising cookies are only set after you accept them on our cookie banner. If you accept, we use Google Analytics 4 (to understand how the site is used) and the Meta (Facebook) Pixel and Google Ads tags (to measure how our ads perform). These set cookies and share limited browsing and checkout activity — such as which pages you view, when you start checkout, and completed purchases and their value — with Google and Meta, who act as independent controllers for their advertising platforms. We may also use this to show you our ads on Facebook, Instagram and across Google, and to build audiences of site visitors for our advertising (remarketing). We never share your child’s data with them, and we never advertise on the child-facing parts of the service.

If you reject, none of these are loaded and no advertising or analytics cookie is set. You can change your mind at any time by clearing the epe_consent cookie in your browser, which brings the banner back. We do not use analytics or advertising on the child-facing parts of the service.

8. Security

Data is encrypted in transit; database access is restricted by row-level security so parents can only read their own family’s data; passwords are hashed; payments never touch our servers. No system is perfectly secure, but if a breach affecting your data ever occurred we would notify you and the ICO as the law requires.

9. Your rights

Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, take your data elsewhere, and withdraw any consent — for yourself and on behalf of your child. Email support@elevenplusedge.co.uk and we will respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk), though we would welcome the chance to resolve any concern directly first.

10. Reviews and testimonials

If you submit a review, we may publish it on our website to help other parents — showing your first name and your child’s school year only (never your surname, email, or your child’s name). By submitting a review you agree to this. We check reviews before they appear, and you can ask us to remove yours at any time by emailing support@elevenplusedge.co.uk.

11. Changes

If we change this policy we will post the new version here with a new date, and tell you by email if the change is significant.