Skip to content

Privacy Policy

Last updated: May 2026

1. Who We Are

Hearthprep is an AI-powered educational platform helping children prepare for UK 7+, 11+, 13+ and 16+ entrance exams. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the ICO Children's Code.

2. Data We Collect

  • Account information (email, display nickname)
  • Child profile you choose to provide (nickname, target exams and schools, exam date, and optional age — used only to match practice questions to the right level)
  • Practice session data (answers, scores, time spent)
  • Payment information (processed securely by Stripe)

We use nicknames instead of real names for child accounts and minimise data collection to only what is necessary for the service.

3. How We Use Your Data

  • To provide personalised practice questions and track progress
  • To generate parent dashboard reports
  • To improve our AI question generation and explanations
  • To send service-related emails and occasional product updates — every email includes a one-click unsubscribe link

4. Data Sharing

We do not sell or share personal data with third parties for marketing purposes. Data is only shared with the service providers listed below, each under a data processing agreement. All current AI and infrastructure processors operate inside the UK / EU adequacy bubble or under a UK-friendly standard DPA — we do not currently route any children's data to mainland-China processors.

  • Stripe (payment processing, Ireland / United States) — receives billing contact information.
  • Google Analytics (website usage measurement, United States) — receives the pages you visit and an anonymised IP address, and onlyif you allow analytics cookies. It never receives your child's name, answers or results. Advertising features and Google Signals are disabled. See section 4b.
  • Google — Gemini Flash Lite (AI tutor primary, and question photo extraction, United States) — receives the chat messages, the current question text, your child's selected answer, and whether it was correct. We do notsend your child's name, email, school name, or any account identifier. When you upload or photograph a question, the image is also sent to Google for text extraction; image bytes are not stored by Hearthprep beyond the extraction call. Google's API processes both under its standard Cloud DPA + EU SCCs. Since 29 July 2026 it handles tutor chat first, rather than as a fallback. We use Google's free API tier, whose terms allow Google to use submitted content to improve its services, including review by human reviewers. This is why the payload is limited to the question, the answer and the chat message, with no name, email, school or account identifier attached.
  • OpenAI (AI tutor final fallback, and vision fallback, United States) — only used if Google is unavailable. For chat: receives the same redacted payload as Google. For vision: if Google Gemini is unavailable, the question photo image bytes are sent to OpenAI's vision API (gpt-4o-mini) for text extraction. Image bytes are not stored by Hearthprep beyond the extraction call. OpenAI processes UK / EU data under its standard Data Processing Addendum and EU Standard Contractual Clauses.
  • Resend (transactional email, United States) — receives your email address and the body of any service email we send you (weekly memo, trial-ending reminder, day 1 / 3 / 7 nurture sequence) under its standard DPA + EU SCCs.
  • MongoDB Atlas (primary database, AWS eu-west-2 London) — stores your account, your children's practice data, and progress records inside the United Kingdom.
  • Vercel (web hosting and edge functions, United States) — serves the application and routes traffic to the EU / UK regions above.

The legal basis for sending exam-prep data to the AI providers above is our legitimate interest in providing the tutoring service you signed up for. We will update this section in the same release that adds, removes, or re-orders any AI provider.

4a. Voice Input

If you use the microphone in the AI tutor, your browser (Chrome, Edge, Safari) sends the audio to its own speech-to-text service — Google for Chrome and Edge, Apple for Safari — under their respective privacy policies. Hearthprep receives only the resulting text, never raw audio. You can disable voice input for your child's account at any time from the parent dashboard.

4b. Cookies

We use a strictly-necessary cookie to keep you signed in to your account. That one needs no consent under UK PECR.

We also use Google Analyticsto count page visits, so we can see which papers and pages are actually useful. It sets cookies, so we ask first: until you choose “Allow” on the banner, no analytics script loads and no analytics cookie is written. Choosing “No thanks” keeps it that way, and deletes any analytics cookies already present. Your choice is remembered for six months in a cookie named hp_analytics_consent; clearing your cookies clears the choice and we will ask again.

We deliberately switch off the parts of Google Analytics that build advertising profiles: ad storage, ad personalisation and Google Signals are all disabled, and IP addresses are anonymised. We never send Google your child's name, answers or results — only which pages were viewed. This is consistent with section 6 below: we do not use children's data for profiling or targeted advertising.

5. Your Rights

Under UK GDPR, you have the right to access, correct, delete, or export your data. To exercise these rights, contact us at hello@hearthprep.com.

6. Children's Privacy

We follow the ICO Age Appropriate Design Code. Children under 13 require parental consent. We do not use children's data for profiling or targeted advertising.

7. Contact

For privacy enquiries, email hello@hearthprep.com.