💬 Feedback
← Back to home

Privacy Policy

Last updated: March 2026

This policy explains how Jagannath Software Services Limited collects, uses, and protects personal data when you use YearWise. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and children's online privacy standards. We take children's data extremely seriously.

1. Data Controller

The data controller responsible for your personal data is:

Jagannath Software Services Limited
Company Registration Number: 07819137
Registered in England and Wales
The Long Lodge, 265–269 Kingston Road, Wimbledon, London, SW19 3NW

Contact: [email protected]

2. Information We Collect

Account data (parents/guardians): email address, name, subscription status, and billing information. Payments are processed securely by Stripe — we do not store card details on our servers.

Child profile data: first name or nickname, school year group, and practice history (topics, scores, XP, badges, streaks). We do not collect a child's date of birth, school name, or any sensitive personal data.

Usage data: pages visited, features used, session durations, device type, and browser. This is collected in anonymised or pseudonymised form for service improvement only.

Technical data (all visitors including guests): year group selected and session count. This is collected each time a practice session is started or a login occurs. No IP addresses or location data are stored.

Cookies: see our Cookie Policy for details.

3. Children's Privacy

YearWise is designed for children aged approximately 5–11 years studying the UK primary curriculum.

Accounts must be created and managed by a parent or guardian. We do not allow children to create accounts independently, and we do not knowingly collect data directly from children without verifiable parental consent.

Child profile data is minimal by design and is linked only to the parent or guardian account. We do not use children's data for advertising or profiling.

Children cannot create accounts or submit data independently — all child data is entered by the parent or guardian managing the account. If you wish to remove a child's data, you can delete their profile instantly from the dashboard, which permanently removes all associated practice history, XP, and badges. If you have any concerns, please contact us at [email protected].

4. How We Use Your Data

We use personal data to:
  • Create and manage user accounts.
  • Provide learning activities, quizzes, and progress tracking.
  • Personalise practice content using AI (Plus and Family plans).
  • Send transactional emails (account confirmation, password reset, subscription receipts).
  • Generate parent progress reports and alerts.
  • Improve the platform and user experience.
  • Comply with legal obligations.
We do not sell your data. We do not use children's data for advertising.

5. Legal Basis for Processing

Under UK GDPR we rely on the following legal bases:
  • Contractual necessity — to provide the service you have signed up for.
  • Legitimate interests — to improve the service, prevent fraud, and ensure security.
  • Legal obligation — to comply with applicable laws.
  • Consent — for non-essential cookies (you can withdraw consent at any time via our Cookie Policy).

6. Payments

Payments for paid plans are processed by Stripe, a PCI-DSS compliant payment processor. We do not store full payment card details on our servers. Stripe may process billing data in accordance with their own privacy policy.

7. Cookies and Analytics

We use cookies to operate and improve the platform. These include:
  • Essential cookies — required for secure authentication and session management.
  • Analytics cookies — anonymous pageview data via Vercel Analytics. No personal data is collected; data is aggregated and not linked to individual users.
For full details please see our Cookie Policy.

8. Data Sharing

We share data only with trusted service providers who process it solely to deliver the platform:
  • Supabase — database and authentication provider (EU/UK data centres, GDPR compliant).
  • Google — optional sign-in via Google OAuth. If you choose to sign in with Google, your Google account email and profile name are shared with us solely to create and identify your account. Google's privacy policy applies to data held by Google.
  • Anthropic — AI question generation. Prompts contain no personal data — only year group, subject, and topic.
  • Stripe — secure billing and payment processing (PCI-DSS compliant).
  • Resend — transactional email delivery (account confirmation, password reset, receipts). Only your email address is shared for the purpose of delivering that email.
  • Vercel Analytics — anonymous pageview analytics. No personal data is shared; data is aggregated and not linked to individual users.
  • Sentry — error monitoring. All text content and user identifiers are masked before transmission. No child data is readable in error reports.
  • Legal authorities — if required by applicable law.
We do not sell or rent personal data to third parties. We do not transfer personal data outside the UK/EEA without appropriate safeguards (e.g., Standard Contractual Clauses).

9. Data Retention

We retain data only for as long as necessary:
  • Account data — retained while the account is active, plus up to 2 years, or as required by law. Inactive accounts may be deleted after 24 months of inactivity.
  • Child practice history — deleted immediately when a child profile is deleted.
  • Application error and event logs — automatically deleted after 90 days.
  • Anonymous usage counts (guest session counts, login counts) — automatically deleted after 12 months.
You may request or action deletion at any time — see Your Rights below.

10. Your Rights (UK GDPR)

As a data subject you have the right to:
  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate data.
  • Erasure — request deletion of your data ("right to be forgotten").
  • Restriction — restrict processing in certain circumstances.
  • Portability — receive your data in a structured, machine-readable format.
  • Object — object to processing based on legitimate interests.
  • Withdraw consent — at any time, for consent-based processing.

Self-serve data export: logged-in users can download a full copy of their data at any time via the Download my data button in the dashboard. The export includes your account details, all child profiles, practice sessions, subject stats, custom topics, and login history in JSON format.

Self-serve deletion: logged-in users can delete their account and all associated data instantly via the Delete account button in the dashboard. This permanently removes your account, all child profiles, sessions, XP, and badges with no delay.

For all other rights, email [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Data Security

We implement appropriate technical and organisational measures including:
  • Secure encrypted connections (HTTPS) across all services.
  • Controlled access to systems and data using role-based permissions.
  • Secure authentication via Supabase Auth.
  • Error monitoring with all personal data masked before transmission.
  • Automated data deletion to minimise retention of unnecessary data.
No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining industry-standard protections.

12. Changes to This Policy

We may update this policy periodically. Material changes will be communicated by email or in-app notice. The date at the top of this page indicates when the policy was last revised. Continued use of YearWise after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or how we handle personal data, please contact:

Jagannath Software Services Limited
Email: [email protected]