Privacy Notice

1. Controller and scope

WeCraftLDN LTD is the data controller for the 11+ Quest web service. Contact [email protected] about privacy questions or rights. This notice covers parents, authorised adults, and children whose profiles they create.

The native iOS app can be used offline, in which case its learning file stays in protected document storage on that device. If a grown-up signs in, the selected child profile is connected to the web service so account ownership and WBear permission can be enforced. Answers, activity, XP, and mistakes remain in the local learning file unless a future notice says otherwise. WBear sends the minimised context described below only after a grown-up enables it. Apple may process App Store and diagnostic information under its own notices.

2. Information we use

Adult account information

Name, email address, authentication identifiers, account dates, legal acknowledgements, privacy choices, support messages, and—when paid plans launch—subscription and transaction records. We do not store full payment-card numbers.

Child profile and learning information

First name or nickname, age, year group, avatar, exam style, target exam date, answers, timings, accuracy, mistakes, practice history, XP, streaks, badges, and inferred topic or skill confidence.

Technical information

Strictly necessary session and security information used to authenticate the adult and protect the service. Our current product does not use advertising or behavioural analytics trackers.

Optional WBear information

When a parent enables WBear Tutor, OpenAI receives the child's age, question, options, selected and correct answers, subject, skill, and difficulty, plus instructions to produce an age-appropriate explanation. Voice sends only the generated explanation text for speech synthesis. We do not intentionally send the child's name, parent email, free-form chat, microphone recordings, or voice samples.

3. Why we use it and our lawful bases

• Contract: create and secure the adult account, provide requested practice, maintain progress, and administer subscriptions.
• Legitimate interests: protect the service, prevent misuse, support parents, and provide limited learning personalisation. We balance these interests against children's rights and use the information only inside the learning service.
• Consent: optional disclosure to OpenAI for WBear Tutor and Voice, and any future optional marketing or non-essential cookies. Consent may be withdrawn without losing core practice features.
• Legal obligation: tax, accounting, consumer, safeguarding, regulatory, and lawful-request obligations where applicable.

4. Educational personalisation and parent visibility

11+ Quest calculates topic confidence, suggestions, and progress from practice activity. This is limited educational profiling intended to help the child practise relevant material. It is not used for advertising, does not determine school admission, and does not produce decisions with legal or similarly significant effects. The child experience explains that their grown-up can see their learning activity.

5. Who receives information

• Supabase: authentication, database, and account infrastructure.
• OpenAI: optional WBear explanations and speech, only after a parent enables the feature.
• Stripe: future web subscription checkout and billing.
• Apple: app distribution and future App Store subscriptions.
• Hosting and professional providers: limited access where needed to operate, secure, support, or legally advise the service.

We do not sell personal information. We do not share child information for behavioural advertising. Providers may process information outside the UK; where UK law requires it, we use adequacy arrangements or contractual safeguards and risk assessments. Contact us for further information about relevant safeguards.

6. OpenAI retention

OpenAI states that API data is not used to train its models by default unless the API customer opts in. Under default API controls, content may appear in abuse-monitoring logs retained for up to 30 days, unless legal retention is required. See OpenAI's API data controls.

7. Retention and deletion

• Active account and learning data: while the account or child profile remains active.
• Child-linked operational data: deleted when the child profile is deleted, subject to short-lived provider backups.
• Account data: deleted when account deletion completes, except records we must retain.
• Minimal billing and pseudonymous legal-audit evidence: up to six years where needed for tax, contract, or legal claims.
• Shared question/explanation caches: may remain only where they are no longer linked to a child or adult.

8. Security

We use access controls, server-side ownership checks, row-level database restrictions, encrypted transport, protected credentials, and deletion/export controls. No online system is risk-free; contact us promptly if you suspect misuse.

9. Your and your child's rights

Depending on the circumstances, you or the child may ask to access, correct, erase, restrict, object to, or receive a portable copy of personal information, and may withdraw consent. The parent privacy area provides common controls. We may need to verify the requester's identity and authority, and normally respond within one month.

Contact [email protected]. If unresolved, you may complain to the Information Commissioner's Office.

10. Children and changes

Adults should read our child-friendly privacy summarywith the child. We assess changes against children's best interests, use high-privacy defaults, and will update the version and notify account holders when material practices change.