Skip to content

Privacy Policy

Last updated: May 2026

1. Who We Are

Hearthprep is an AI-powered educational platform helping children prepare for UK 7+, 11+, 13+ and 16+ entrance exams. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the ICO Children's Code.

2. Data We Collect

  • Account information (email, display nickname)
  • Practice session data (answers, scores, time spent)
  • Payment information (processed securely by Stripe)

We use nicknames instead of real names for child accounts and minimise data collection to only what is necessary for the service.

3. How We Use Your Data

  • To provide personalised practice questions and track progress
  • To generate parent dashboard reports
  • To improve our AI question generation and explanations
  • To send service-related emails and occasional product updates — every email includes a one-click unsubscribe link

4. Data Sharing

We do not sell or share personal data with third parties for marketing purposes. Data is only shared with the service providers listed below, each under a data processing agreement. All current AI and infrastructure processors operate inside the UK / EU adequacy bubble or under a UK-friendly standard DPA — we do not currently route any children's data to mainland-China processors.

  • Stripe (payment processing, Ireland / United States) — receives billing contact information.
  • Alibaba Cloud — Qwen (AI tutor and question generation, Frankfurt EU workspace) — receives the chat messages, the current question text, your child's selected answer, and whether it was correct. We do not send your child's name, email, school name, or any account identifier. Hosted in the EU under EU GDPR; transfers to us in the UK are governed by the UK adequacy decision for the EU.
  • OpenAI (AI tutor fallback and vision fallback, United States) — only used if the primary provider is unavailable. For chat: receives the same redacted payload as Qwen. For vision: if both Google Gemini and Alibaba Qwen-VL-OCR are unavailable, the question photo image bytes are sent to OpenAI's vision API (gpt-4o-mini) for text extraction. Image bytes are not stored by Hearthprep beyond the extraction call. OpenAI processes UK / EU data under its standard Data Processing Addendum and EU Standard Contractual Clauses.
  • Google — Gemini Flash Lite (vision / question photo extraction, United States) — when you upload or photograph a question for the AI tutor, the image is sent to Google's vision API for text extraction. Image bytes are not stored by Hearthprep beyond the extraction call; Google's API processes the request under its standard Cloud DPA + EU SCCs.
  • Alibaba Cloud — Qwen-VL-OCR (vision fallback, Frankfurt EU workspace) — only used if Google Gemini is unavailable. Receives the same photo image bytes as Gemini for text extraction. Image bytes are not stored by Hearthprep beyond the extraction call; Qwen is hosted in the EU under EU GDPR; transfers to us in the UK are governed by the UK adequacy decision for the EU.
  • Resend (transactional email, United States) — receives your email address and the body of any service email we send you (weekly memo, trial-ending reminder, day 1 / 3 / 7 nurture sequence) under its standard DPA + EU SCCs.
  • MongoDB Atlas (primary database, AWS eu-west-2 London) — stores your account, your children's practice data, and progress records inside the United Kingdom.
  • Vercel (web hosting and edge functions, United States) — serves the application and routes traffic to the EU / UK regions above.

The legal basis for sending exam-prep data to the AI providers above is our legitimate interest in providing the tutoring service you signed up for. We will update this section in the same release that adds, removes, or re-orders any AI provider.

4a. Voice Input

If you use the microphone in the AI tutor, your browser (Chrome, Edge, Safari) sends the audio to its own speech-to-text service — Google for Chrome and Edge, Apple for Safari — under their respective privacy policies. Hearthprep receives only the resulting text, never raw audio. You can disable voice input for your child's account at any time from the parent dashboard.

4b. Cookies

We use a single strictly-necessary cookie to keep you signed in to your account. We use no analytics, advertising, or tracking cookies — so there is no cookie-consent banner, because none is required for an essential login cookie under UK PECR. If we ever add analytics, we will introduce a consent banner in the same release and update this section.

5. Your Rights

Under UK GDPR, you have the right to access, correct, delete, or export your data. To exercise these rights, contact us at privacy@hearthprep.com.

6. Children's Privacy

We follow the ICO Age Appropriate Design Code. Children under 13 require parental consent. We do not use children's data for profiling or targeted advertising.

7. Contact

For privacy enquiries, email privacy@hearthprep.com.