Privacy Policy, WAJD Academy

Who we are

WAJD Academy (wajd.co.uk) is a free online learning library for 11 Plus, GCSE and A Level. The service is operated by WAJD AI Ltd, trading as WAJD Academy, a company registered in England and Wales (company number [company number]) whose registered office is at [registered office address] ("WAJD Academy", "we", "us"). We are the data controller for the personal data described in this policy and we comply with the UK GDPR and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].

Children's privacy first. WAJD Academy is used by children. A child's account must be created with a parent, guardian or school, who confirms consent at sign-up. We use the parent or guardian's email address to send a verification code and to oversee the account. We collect as little information as possible, never sell personal data, never show advertising, and never use personal data for behavioural advertising or marketing profiles. A parent or guardian can ask us to show, correct or delete the account's data at any time. We also publish a short, child-friendly version of this policy written for learners.

What we collect

Account details. Name, email address (the parent or guardian's email for a child's account), role (student, tutor, admin), year group or level, chosen subjects and exam board. Passwords are stored only as a secure hash, never in plain text.
Learning activity. Progress, lesson and quiz scores, placement results, time on task, stars, streaks, badges and assignments, so learners, parents and tutors can see how learning is going.
AI tutor messages. The questions a learner types to the AI tutor are processed to generate an answer. We ask learners not to include personal or contact details in these messages, and they are not kept as a long-term personal record.
Voice recordings. If you use a microphone feature (for example asking a question by voice in the Quran section), the recording is sent to our own servers, converted to text, and deleted straight away. Voice recordings are processed entirely on infrastructure we run ourselves and are never stored or shared.
Photos you choose to upload. The "Check a page" tool reads a photo of a textbook or workbook page to find matching learning content. The photo is processed in memory and never stored.
Challenge display names. If you join a public challenge leaderboard, the display name you choose is shown to other visitors. Display names are checked by an automatic moderation filter, and anything unsuitable is shown as "Anonymous". Please do not use a full real name.
Payment information. If you buy an optional paid plan, payment is handled by Stripe. We never see or store card numbers; we keep only the subscription status and a Stripe customer reference.
Tutor information. Tutors provide their name, email, subscription status and vetting (DBS) details as part of our safeguarding checks before they can work with learners.
Newsletter and updates. If you sign up to our newsletter we keep your email address and your consent record. Sign-up uses double opt-in and every email carries a one-click unsubscribe link.
Usage statistics. We run our own first-party, cookieless analytics to count page visits and see which features help learners most. It sets no cookies, stores no IP addresses, builds no profile of any individual, and honours your browser's Do Not Track and Global Privacy Control signals.
Technical data. A secure session cookie to keep you signed in, one-time sign-in codes sent by email, and short-lived server logs needed to run and protect the service.

How we use your information, and our lawful basis

Purpose	Lawful basis (UK GDPR Article 6)
Providing the learning library, lessons, practice, mock tests, games and the AI tutor; saving progress; letting parents and tutors follow a learner's progress	Performance of a contract (our terms of use), with parental consent recorded for a child's account
Service emails: account verification, one-time sign-in codes, password and study reminders, weekly progress reports to the parent or guardian	Performance of a contract and our legitimate interest in keeping accounts secure and parents informed. You can turn weekly reports off in your profile
Safeguarding: approving and vetting tutors before they can work with learners	Legitimate interest in child safety, and legal obligations where they apply
Taking payment for optional paid plans	Performance of a contract; keeping payment records is a legal obligation (tax and accounting law)
Newsletter and marketing emails	Consent, which you can withdraw at any time with one click
Prize draws we run with sponsors	Consent to enter; draws are free to enter and involve a parent or guardian for child winners
Security, abuse prevention and rate limiting; first-party usage statistics	Legitimate interest in running a safe, reliable service, always balanced against the rights of children

We never use personal data for behavioural advertising, we never sell personal data, and any adaptivity in the platform exists only to choose the right learning content for the learner.

Who we share data with

We share personal data only with the small number of service providers (processors) we need to run WAJD Academy, each under a data-processing agreement:

Hosting. Our servers are provided by Hetzner and located in Germany (EU). Our own analytics runs on the same servers; usage statistics never leave our infrastructure.
AI processing. To power the AI tutor and question generation, learner questions and topic prompts are sent to a trusted third-party AI provider solely to generate a response. They are processed under contract, are not used to build advertising profiles, and are not used to train the provider's models.
Email delivery. Service and newsletter emails are sent through Brevo (EU). Messages you send to our support address are received through our mailbox provider.
Payments. Stripe processes card payments. Card details go directly to Stripe and never touch our servers.

We may also disclose data where the law requires it, for example to protect a child or to comply with a court order. We never sell personal data to anyone.

International transfers

Most processing happens in the UK and the EU. Where a provider processes data in the United States (our AI provider and Stripe), the transfer is protected by UK-approved safeguards such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement, together with each provider's data-processing agreement.

Cookies

We use a single essential session cookie to keep you signed in. We do not use advertising cookies, third-party tracking cookies or tracking pixels, and our usage statistics are cookieless, so no cookie consent banner is needed.

How long we keep it

Data	Kept for
Account and learning progress	While the account is active, then deleted after a period of inactivity set out in our retention schedule
AI tutor questions	Processed to answer you; not kept as a long-term personal record
Voice recordings and uploaded photos	Deleted immediately after processing; never stored
One-time sign-in codes	Minutes; they expire automatically
Payment records	Six years, as required by UK tax and accounting law
Newsletter address	Until you unsubscribe; we keep a minimal record to honour your opt-out
Server and security logs	A short rolling window, then deleted

Deleting your account removes your personal data from the live database; copies in our encrypted backups age out automatically within the backup cycle. You can delete your account yourself at any time from your profile page.

Your rights

You, or a child's parent or guardian on their behalf, have the right to:

ask for a copy of the personal data we hold (access);
have inaccurate data corrected (rectification);
have data deleted (erasure), including by deleting the account from the profile page;
restrict or object to certain processing, including anything based on legitimate interests;
receive your data in a portable format;
withdraw consent at any time, where consent is the basis we rely on.

To exercise any right, email hello@wajd.co.uk or use our contact page. We respond within one month. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we would welcome the chance to help first.

Security

We protect data with measures including transport encryption (HTTPS everywhere), hashed passwords, one-time email sign-in codes, opaque server-side sessions, role-based access controls, rate limiting, security headers and encrypted backups. No system is perfectly secure, but we design for children's safety first. If a breach ever put your rights at risk, we would tell you and the ICO as the law requires.

Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date, and for significant changes we will tell account holders by email.

Contact us

For any privacy question or request, email hello@wajd.co.uk or use our contact page.