Privacy Policy

1. Introduction

Welcome to BrainBuzz ("we," "our," or "us"). We operate www.brainbuzz.co.uk and are committed to protecting the privacy of all our users, especially children. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

Data Controller: BrainBuzz is the data controller responsible for your personal data.

Contact: For privacy questions or concerns, email us at [email protected]

2. Information We Collect

BrainBuzz is designed with privacy in mind. We collect minimal information to provide our educational services.

2.1 Information Stored Locally on Your Device

Game Progress & Scores: When pupils play free activities, their progress and scores are saved directly to their device's local storage (browser storage). This data:

• Never leaves the device
• Is not sent to our servers
• Can be deleted at any time by clearing browser data
• Contains no personally identifiable information

2.2 Cookies and Analytics

We use cookies and similar technologies to improve your experience:

Essential Cookies: Required for the website to function properly, including:

• Cookie consent preferences
• Session management for logged-in users
• Security features

Analytics Cookies: With your consent, we use Google Analytics to understand how visitors use our site:

• Pages visited and time spent
• Device type and browser information
• General geographic location (country/region only)
• Referral sources

Analytics data is anonymised and helps us improve BrainBuzz. You can manage cookie preferences at any time through our cookie settings.

2.3 School Mental Maths — Registration & Subscription Data

Access to BrainBuzz School Mental Maths requires schools to register for a paid annual subscription. When you register and subscribe, we collect:

Data	Required?	Why we collect it
First name & surname (admin)	Yes	To identify the account administrator and personalise communications
Admin email address	Yes	Login credential for the admin dashboard; used for account and subscription communications
School name	Yes	Identifies the subscribing organisation; used on invoices
School email domain	Yes	Used to prevent duplicate school registrations
Billing email address	Yes	The email address Stripe invoices are sent to (may be a bursar or finance contact)
Teacher seat names & email addresses	No	Added voluntarily by the school admin; used to send login notifications to individual teachers
Number of seats purchased	Yes	Determines the invoice amount and access limit
Subscription status & dates	Automatic	Used to control access and send renewal invoices
Terms acceptance date & version	Automatic	Records that the account holder agreed to these Terms and Conditions
Test usage logs	Automatic	Records which tests were run and when, to support usage reporting and service improvement
Registration date & last login	Automatic	Account management and security

Lawful basis: Processing is necessary to perform the subscription contract (Article 6(1)(b) UK GDPR). Usage logging is based on our legitimate interests in improving the platform (Article 6(1)(f)).

Payment processing: Payments are handled by Stripe, Inc. BrainBuzz does not store card details or bank account information. Stripe's privacy policy is available at stripe.com/gb/privacy.

What we do not do: We will never sell, share, or rent your registration data to any third party. It is used solely to provide and improve the Mental Maths service.

Data retention: Subscription and account data is retained for as long as the account is active, and for up to 24 months after expiry or cancellation for legal and accounting purposes. Billing and invoice records are retained for 7 years in accordance with HMRC requirements. You may request earlier deletion by emailing [email protected] with the subject line "Delete My Account".

2.4 School Spelling — Registration & Subscription Data

Access to BrainBuzz School Spelling requires schools to register and be approved for a paid annual subscription. When you register, we collect:

Data	Required?	Why we collect it
First name & surname (admin)	Yes	To identify the account administrator
Admin email address	Yes	Login credential and primary contact for account communications
School name	Yes	Identifies the subscribing organisation; used on invoices
School type	Yes	Used to determine applicable pricing
Billing email address	Yes	The email address Stripe invoices are sent to
Custom word list content	Yes (when creating lists)	Words and sentences entered by teachers to generate audio spelling lists
Credit usage	Automatic	Tracks how many word list credits have been used
Subscription status & dates	Automatic	Used to control access and send renewal invoices

Audio generation: When a teacher creates a custom word list, the words and sentences are sent to ElevenLabs (a third-party text-to-speech service) to generate audio files. These audio files are stored on Cloudflare R2 and served via our CDN. The word list content itself is stored in our database. Schools should not include any personal data of pupils or staff within word list content.

Lawful basis: Processing is necessary to perform the subscription contract (Article 6(1)(b) UK GDPR).

Data retention: Subscription and word list data is retained for as long as the account is active, and for up to 24 months after expiry or cancellation. Billing records are retained for 7 years in accordance with HMRC requirements.

2.5 Data Processing Agreement — Schools (Mental Maths & Spelling)

Where a school subscribes to BrainBuzz Mental Maths or School Spelling and provides personal data about teachers (names and email addresses) for allocation to the service, BrainBuzz acts as a data processor on behalf of the school, which is the data controller. This section constitutes the Data Processing Agreement (DPA) required under Article 28 of the UK GDPR.

Subject matter: Processing of teacher personal data (names, email addresses, login activity) to provide the relevant subscription service.

Duration: For the duration of the subscription and up to 24 months thereafter for legal and accounting purposes.

Nature and purpose of processing: Storing teacher names and email addresses against subscription accounts; sending login and access notification emails; recording usage activity; enabling teacher login via the platform's authentication system.

Types of personal data: First name, surname, email address, last login date, usage records.

Categories of data subjects: Employed teaching staff at the subscribing school.

BrainBuzz's obligations as data processor:

• Process personal data only on documented instructions from the school (i.e. data entered into the admin dashboard by the school admin)
• Ensure that all staff with access to personal data are subject to confidentiality obligations
• Implement appropriate technical and organisational security measures
• Not engage sub-processors without informing the school. Current sub-processors: Brevo SAS (transactional email delivery), Stripe, Inc. (payment processing), and ElevenLabs, Inc. (text-to-speech audio generation for Spelling subscribers). All are bound by GDPR-compliant data processing agreements
• Assist the school in responding to data subject rights requests
• Delete or return all personal data on termination of the subscription (subject to legal retention requirements)
• Make available all information necessary to demonstrate compliance with Article 28

School's obligations as data controller:

• Ensure there is a lawful basis for sharing teacher personal data with BrainBuzz
• Inform teachers that their name and email address will be used for BrainBuzz platform access
• Only enter accurate, current data for teachers who are employed by the school
• Remove teacher data promptly when a teacher leaves the school

To exercise data subject rights, raise a DPA query, or request deletion of data, email [email protected] with the subject line "DPA Request".

2.6 Home Access Mental Maths — Registration & Subscription Data

Access to BrainBuzz Home Access Mental Maths requires home users to register for a paid subscription. When you register, we collect:

Data	Required?	Why we collect it
First name & surname	Yes	To identify the account holder and personalise communications
Email address	Yes	Login credential and contact for account and billing communications
Subscription tier	Yes	Determines access level and billing amount
Subscription status & dates	Automatic	Used to control access and manage billing periods
Test usage history	Automatic	Records which tests have been taken within each billing period to manage usage and prevent repetition
Registration date & last login	Automatic	Account management and security

Children's data: Home Access does not collect any personal information about the children using the platform. No child names, ages, or identifying details are stored. Usage history is recorded against the parent/guardian account only.

Lawful basis: Processing is necessary to perform the subscription contract (Article 6(1)(b) UK GDPR).

Payment processing: Payments are handled by Stripe, Inc. BrainBuzz does not store card details. Stripe's privacy policy is available at stripe.com/gb/privacy.

Data retention: Account and usage data is retained for as long as the account is active, and for up to 24 months after cancellation. Billing records are retained for 7 years in accordance with HMRC requirements.

3. What We Don't Collect

To protect children's privacy, we explicitly do not collect:

• Names of pupils using the activities
• Ages or dates of birth
• School or home addresses
• Phone numbers
• Photographs or videos
• Precise geolocation data
• Social media profiles
• Any other personally identifiable information from children

Note: Parents and school administrators who register for subscription services do provide personal details (see sections 2.3–2.6). Pupils using any BrainBuzz activity are never asked to provide personal information.

4. How We Use Information

We use the limited information we collect to:

• Provide Services: Enable pupils to use activities and track their personal progress locally
• Manage Subscriptions: Administer school and home access subscription accounts, issue invoices, and manage access
• Generate Audio: Send word list content to ElevenLabs to produce spelling audio for School Spelling subscribers
• Improve BrainBuzz: Understand usage patterns via anonymised analytics to enhance activities and features
• Ensure Security: Protect against misuse and maintain website security
• Legal Compliance: Meet our legal obligations including UK GDPR and the Data Protection Act 2018

5. Data Sharing and Disclosure

We do not sell, rent, or trade any user information. We may share data only in these limited circumstances:

5.1 Third-Party Service Providers

We work with trusted third-party services that help us operate BrainBuzz:

• Stripe, Inc. — Payment processing for all subscriptions. Stripe handles all card and bank payment data. BrainBuzz does not receive or store payment card details. See Stripe's Privacy Policy.
• Brevo SAS (formerly Sendinblue) — Transactional email delivery (subscription invoices, login notifications, renewal reminders). See Brevo's Privacy Policy.
• ElevenLabs, Inc. — Text-to-speech audio generation for School Spelling word lists. Word and sentence content is transmitted to ElevenLabs solely for the purpose of generating audio files. See ElevenLabs' Privacy Policy.
• Google Analytics — Anonymised website usage analytics. No personally identifiable information is shared. See Google's Privacy Policy.
• Cloudflare — CDN and infrastructure services for audio file delivery and security.
• Fasthosts — Web hosting provider for our website infrastructure.

These providers are bound by confidentiality obligations and data processing agreements, and may only use data to provide services to us.

5.2 Legal Requirements

We may disclose information if required by law or to:

• Comply with legal obligations or court orders
• Protect our legal rights
• Prevent fraud or security issues
• Protect the safety of children or others

6. Data Security

We take security seriously and implement appropriate measures to protect your information:

• Secure HTTPS encryption for all website traffic
• Regular security updates and monitoring
• Access controls limiting who can view data
• Secure data storage and transmission
• Regular security assessments

While we strive to protect your data, no internet transmission is 100% secure. We cannot guarantee absolute security but maintain industry-standard protections.

7. Children's Privacy

BrainBuzz is designed to be safe for children aged 5 and above. We take extra care to protect young users:

• No Personal Information from Pupils: We never ask children for names, addresses, phone numbers, or other personal details
• No Pupil Accounts: Pupils can use all free features without creating accounts or profiles
• Local Storage Only: Free game progress is saved on the device, never on our servers
• No Social Features: No commenting, messaging, or interaction between users
• Educational Focus: Purely educational content with no commercial solicitation directed at children
• Parental Control: Parents can delete all local data by clearing browser storage

8. Your Rights Under UK GDPR

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right to Information: This privacy policy explains how we handle data
• Right of Access: Request a copy of the data we hold about you
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal retention obligations)
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Change cookie preferences at any time
• Right to Portability: Receive your data in a portable format
• Right to Restrict Processing: Request that we limit how we use your data

How to Exercise Your Rights:

• Email: [email protected]
• Use the subject line "Privacy Rights Request"
• Include your name, the email address associated with your account, and your specific request
• We aim to respond within 30 days

9. Data Retention

We retain different types of data for different periods:

• Local Storage (free activities): Remains on device until user clears browser data
• School & Home Subscription Account Data: Retained for as long as the account is active, and for up to 24 months after expiry or cancellation
• Billing & Invoice Records: Retained for 7 years in accordance with HMRC requirements
• Usage Logs (school subscriptions): Retained for 24 months, then deleted
• Home Access Usage History: Retained for the duration of the active subscription, then deleted
• Spelling Word Lists & Audio: Retained for the duration of the subscription and up to 24 months thereafter
• Analytics Data: Anonymised; retained according to Google Analytics policies (typically 26 months)
• Cookie Preferences: Retained for 12 months

We delete or anonymise data when it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.

10. Third-Party Links

BrainBuzz may contain links to external websites (e.g. curriculum resources). We are not responsible for the privacy practices of these sites. We recommend parents review the privacy policies of any external sites their children visit.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in how we operate BrainBuzz, updates to data protection laws, or new features and services. When we make significant changes:

• We'll update the "Last updated" date at the top of this policy
• We'll notify users through a prominent notice on our website
• Existing subscribers will be notified by email of any material changes

12. Contact Information

13. Data Protection Authorities

If you're not satisfied with how we handle your data, you have the right to lodge a complaint with the relevant authority:

UK Data Protection:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113

14. Summary

Key Points:

• BrainBuzz collects minimal personal information from general visitors
• Free game progress is saved locally on your device, not on our servers
• We never ask pupils for personal information
• We use Google Analytics (anonymised) to improve the platform
• Three paid subscription services are available: School Mental Maths, School Spelling, and Home Access Mental Maths
• Payments are processed securely by Stripe — we never see your card details
• School Spelling uses ElevenLabs for audio generation; word list content is transmitted solely to produce audio
• Schools acting as data controllers are covered by the Data Processing Agreement in section 2.5
• You have full rights to access, correct, or delete your data under UK GDPR
• We are fully compliant with UK GDPR and the Data Protection Act 2018
• Parents and schools can contact us anytime with privacy concerns

Thank you for trusting BrainBuzz with your child's educational journey.