1. Who we are
Pocket Tutor (the app at chat.pocket-tutor.ai and this website, pocket-tutor.ai) is run by Teacher Tools AI Limited, a company registered in England and Wales with company number 15368217, whose registered office is at Netherton Grange, Draynes, Liskeard, Cornwall, PL14 6RX.
We are the data controller for the personal information described in this policy, which means we decide how and why it is used.
This policy is written under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the ICO's Age Appropriate Design Code (the "Children's Code").
For any privacy question or request, email feedback@pocket-tutor.ai.
2. What we collect
When an account is created
- First name, last name and date of birth. Your date of birth tells the tutor what level to teach at, and lets us wish you a happy birthday.
- Email address, used to sign in and to send account emails.
- Your password, which we store only in a scrambled (hashed) form that can't be turned back into the password.
- A record of the parental consent box being ticked: the date and time, the exact words agreed to, and the IP address it was sent from (see section 4).
When you learn
- Your subjects, level (KS3 or GCSE), exam board, chosen tutor, tutor personality settings and native language.
- Your chat messages with the tutor and the tutor's replies.
- Quiz answers and scores, video quiz results, lesson plan steps and how full each subject's knowledge tank is.
- Coins earned and spent, games played, high scores, and the made-up player name shown on leaderboards.
- When you last used the app, which we use for progress emails and "we miss you" reminders.
When you speak to your tutor
If you use the Speak button, your voice is turned into text by your web browser's own speech service, for example Google in Chrome, Apple in Safari or Microsoft in Edge. We receive only the text, never a recording. The microphone check measures sound levels on your device and sends nothing to us.
When you pay
Payments are handled by Stripe. Your card number never reaches us. We keep the Stripe customer and subscription references, your plan, its status and renewal dates, payment and refund records, and the month and year your card expires, so we can remind you before it runs out.
Emails and settings
- Your choices in My Account > Notifications, and a record of which emails we have sent, so you don't get the same one twice.
- Two-factor sign-in settings, if you turn it on.
Technical information
- Error logs, which may include your account ID, an email address or an IP address, so we can find and fix problems.
- IP addresses, held briefly in memory to limit repeated sign-in and contact attempts. They are not stored for that purpose.
- Usage information collected by Google Analytics in the app (see section 11).
When you contact us
If you use the contact form on this website or send feedback from the app, we receive your name, email address and message.
Photos of homework
In homework help, a learner can choose to send a photo of their homework sheet. The photo is made smaller on their device, sent to OpenAI so the tutor can read the questions (see section 5), and shown in the chat until the page is closed. We don't store the photo. We keep only the tutor's typed copy of the questions, saved with that chat message like the rest of the conversation. Please photograph just the sheet, without faces, names or anything personal in the picture.
Apart from homework photos a learner chooses to send, we do not collect your home address, phone number, photos, location or any special category data (such as health or religion), and we ask you not to type such things into the chat.
3. How we use it and our lawful basis
UK GDPR says we must have a lawful basis for each use of personal information. Ours are:
- Running your account and your tutor
- Creating and securing the account, the AI tutor, quizzes, videos, pictures, progress, coins and games. Basis: contract (Article 6(1)(b)), to provide the service you or your parent or carer signed up for.
- Payments and billing records
- Taking payment, renewals, refunds and the emails about them. Basis: contract, and legal obligation (Article 6(1)(c)) for the financial records we must keep for tax.
- Account and security emails
- Confirming your email, password and email changes, two-factor changes, account lockouts and account deletion. Basis: contract and legitimate interests in keeping accounts safe. These can't be turned off.
- Optional emails
- Free trial reminders, help getting started, "we miss you", weekly progress reports, exam and school year tips, subject mastered and birthday messages. Basis: legitimate interests in helping learners keep going, sent to existing customers under PECR's rules, with at most one a day. Every one has an unsubscribe link, and you can turn each type off in My Account > Notifications.
- Safety, security and fixing problems
- Lockouts after wrong passwords, rate limits, error logs and preventing misuse. Basis: legitimate interests, and our legal obligation to keep data secure (Article 32).
- Recording parental consent
- Keeping a record that permission was given at sign-up. Basis: legitimate interests in being able to show that consent was given.
- Analytics
- Understanding how the app is used so we can improve it. Basis: consent, as PECR requires for analytics cookies. The app asks the first time you visit, and nothing is collected unless you say yes.
- Answering messages
- Replying to the contact form and in-app feedback. Basis: legitimate interests in responding to you.
Where we rely on legitimate interests, we have checked that our interests are balanced against yours, taking extra care because many of our users are children. You can object at any time (see section 10).
4. Children and parental consent
Pocket Tutor is made for school learners studying KS3 and GCSE, so many of our users are children. We follow the ICO's Children's Code:
- Parental permission. Everyone signing up must confirm that they have permission from a parent or carer, or that they are the parent or carer. We record when this was confirmed, the exact words agreed to and the IP address it came from.
- No advertising and no selling. We don't show adverts, sell personal information or use it for marketing profiles.
- No contact between learners. There is no chat between users. Leaderboards show only made-up player names chosen from our own word lists.
- Age-appropriate content. The tutor is instructed to teach at the learner's level, and pictures are chosen to be suitable for children.
- No location tracking. We don't collect your location.
- Clear explanations. The short version at the top of this page explains things for younger learners.
A learner can use their data rights themselves. A parent or carer can also make a request on behalf of a child who is too young to do so (see section 10).
5. How the AI tutor uses your information
Your tutor's replies, lesson plans, quizzes and video and picture searches are written by an AI model from OpenAI. To do this, we send OpenAI your messages and the recent conversation (including any homework photo you choose to send), your first name, your age, and your subject, level, exam board, topic and language. We don't send your last name, email address, date of birth or payment details.
Under OpenAI's terms for business customers, information sent through its API is not used to train its models. OpenAI may keep it for up to 30 days to check for abuse, then deletes it.
If the tutor's voice is on, the text of the tutor's reply (which can include your first name) is sent to ElevenLabs to turn it into speech.
The app decides some things automatically, such as quiz scores, coins and how full a knowledge tank is. None of these decisions have legal or similarly significant effects on you, so the UK GDPR rules on automated decision-making (Article 22) don't apply. AI can make mistakes, so please check important facts with your teacher.
7. Transfers outside the UK
Some of these providers process data in the USA or the European Economic Area. When that happens, the transfer is protected by UK adequacy regulations (including the UK-US "data bridge" for companies certified to it) or by the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard used for a particular provider.
8. How long we keep it
- Your account and learning: for as long as the account exists. When you delete your account, we delete everything we hold about you straight away: your account details, chats, progress, quiz results, coins, games, player name, email choices and history, consent record, and any error log entries that name you.
- Parental consent record: for as long as the account exists, then deleted with it.
- Payment records: invoices and payments stay in our Stripe account for six years after the end of the financial year they relate to, as UK tax law requires, even if the account is deleted. Our own copies of the Stripe references are deleted with the account.
- Contact form messages and feedback: only for the minimum time necessary to answer them and deliver the service.
- Error logs: only for the minimum time necessary to find and fix problems.
- Backups: deleted information can stay in backups only for the minimum time necessary to keep the service running, until they are replaced.
9. How we keep it safe
- All connections use HTTPS encryption.
- Names and dates of birth are encrypted in our database, and passwords are stored only as secure hashes.
- Optional two-factor sign-in with an authenticator app, and accounts lock for a while after repeated wrong passwords.
- We email you when your password, email address or two-factor settings change, or your account is locked, so you know if someone else tries.
- Signing in somewhere new signs the account out elsewhere.
- Card payments are taken by Stripe, which is certified to the PCI DSS card security standard.
- Links in emails, such as unsubscribe and payment links, are signed so they can't be changed to reach someone else's account.
- Only people who need access to run the service can reach personal data.
If a personal data breach puts your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay where the law requires.
10. Your rights
Under UK GDPR you have the right to:
- Access your information. Use Download my data in My Account > My Data, or ask us for a full copy.
- Correct it. Change your name and details in My Account, or ask us.
- Delete it. Use Delete my account in My Account > My Data. If you have a paid plan, you'll be offered the chance to cancel it first.
- Restrict how we use it while a concern is looked into.
- Object to uses based on legitimate interests, including all optional emails.
- Data portability: the download is a JSON file you can take elsewhere.
- Withdraw consent at any time where we rely on it, for example for analytics (My Account > Notifications), without affecting what happened before.
To make a request, email feedback@pocket-tutor.ai. It's free, and we will reply within one month (we may extend this by two more months for complex requests, and will tell you if so). We may need to check your identity first.
12. How we meet UK GDPR
UK GDPR is built on seven principles (Article 5). This is how Pocket Tutor follows each one:
- Lawfulness, fairness and transparency
- We have a lawful basis for every use (section 3), and this policy explains it in plain English, with a short version for learners.
- Purpose limitation
- We use information only to run Pocket Tutor and for the purposes listed here, never for advertising and never sold.
- Data minimisation
- We ask for little: no address, phone number, photo or location. Homework photos are optional and not stored. The AI receives only your first name and age, not your full name, email or date of birth. Leaderboards use made-up names. We never see card numbers.
- Accuracy
- You can correct your details at any time in My Account.
- Storage limitation
- We keep information only as long as set out in section 8, and you can delete your account yourself at any time.
- Integrity and confidentiality
- Encryption, hashed passwords, two-factor sign-in, lockouts, security alerts and signed links (section 9).
- Accountability
- We keep a record of our processing, have contracts with our processors, have assessed the risks of processing children's data in a data protection impact assessment (DPIA), and review this policy whenever the app changes.
Your rights (section 10) are built into the app: download your data, change your details, choose your emails and delete your account, all from My Account without needing to ask.
13. Changes to this policy
We update this policy when the app or the law changes, and change the date at the top. If a change affects how we use your information in a significant way, we will tell you by email or in the app before it takes effect.
14. Contact us and complaints
Questions, requests or worries: email feedback@pocket-tutor.ai, or write to Teacher Tools AI Limited, Netherton Grange, Draynes, Liskeard, Cornwall, PL14 6RX.
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.