Privacy Policy

1. Introduction

Welcome to BrainBuzz ("we," "our," or "us"). We operate www.brainbuzz.co.uk and are committed to protecting the privacy of all our users, especially children. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

Data Controller: BrainBuzz, operated by The Data Controller, is responsible for your personal data.

Data Protection Contact: The Data Controller — contact via our contact form

ICO Registration Number: ZC253055

Data Storage: BrainBuzz website and subscription data is hosted in the United Kingdom by Fasthosts Internet Ltd. Audio files are stored on Cloudflare R2 and served via Cloudflare's CDN infrastructure.

2. Information We Collect

BrainBuzz is designed with privacy in mind. We collect minimal information to provide our educational services.

2.1 Information Stored Locally on Your Device

Game Progress & Scores: When pupils play free activities, their progress and scores are saved directly to their device's local storage (browser storage). This data:

• Never leaves the device
• Is not sent to our servers
• Can be deleted at any time by clearing browser data
• Contains no personally identifiable information

2.2 Cookies and Analytics

We use cookies and similar technologies to improve your experience:

Essential Cookies: Required for the website to function properly, including:

• Cookie consent preferences
• Session management for logged-in users
• Security features

Analytics Cookies: With your consent, we use Google Analytics to understand how visitors use our site:

• Pages visited and time spent
• Device type and browser information
• General geographic location (country/region only)
• Referral sources

Analytics data is anonymised and helps us improve BrainBuzz. You can manage cookie preferences at any time through our cookie settings.

2.3 School Mental Maths — Registration & Subscription Data

Access to BrainBuzz School Mental Maths requires schools to register for a paid annual subscription. When you register and subscribe, we collect:

Lawful basis: Processing is necessary to perform the subscription contract (Article 6(1)(b) UK GDPR). Usage logging is based on our legitimate interests in improving the platform (Article 6(1)(f)).

Payment processing: Payments are handled by Stripe, Inc. BrainBuzz does not store card details or bank account information. Stripe's privacy policy is available at stripe.com/gb/privacy.

What we do not do: We will never sell, share, or rent your registration data to any third party. It is used solely to provide and improve the Mental Maths service.

Data retention: Subscription and account data is retained for as long as the account is active, and for up to 24 months after expiry or cancellation for legal and accounting purposes. Billing and invoice records are retained for 7 years in accordance with HMRC requirements. You may request earlier deletion by emailing our contact form with the subject line "Delete My Account".

2.4 School Spelling — Registration & Subscription Data

Access to BrainBuzz School Spelling requires schools to register and be approved for a paid annual subscription. When you register, we collect:

Audio generation: When a teacher creates a custom word list, the words and sentences are sent to ElevenLabs (a third-party text-to-speech service) to generate audio files. These audio files are stored on Cloudflare R2 and served via our CDN. The word list content itself is stored in our database. Schools should not include any personal data of pupils or staff within word list content.

Lawful basis: Processing is necessary to perform the subscription contract (Article 6(1)(b) UK GDPR).

Data retention: Subscription and word list data is retained for as long as the account is active, and for up to 24 months after expiry or cancellation. Billing records are retained for 7 years in accordance with HMRC requirements.

2.5 Data Processing Agreement — Schools (Mental Maths & Spelling)

Where a school subscribes to BrainBuzz Mental Maths or School Spelling and provides personal data about teachers (names and email addresses) for allocation to the service, BrainBuzz acts as a data processor on behalf of the school, which is the data controller. This section constitutes the Data Processing Agreement (DPA) required under Article 28 of the UK GDPR.

Subject matter: Processing of teacher personal data (names, email addresses, login activity) to provide the relevant subscription service.

Duration: For the duration of the subscription and up to 24 months thereafter for legal and accounting purposes.

Nature and purpose of processing: Storing teacher names and email addresses against subscription accounts; sending login and access notification emails; recording usage activity; enabling teacher login via the platform's authentication system.

Types of personal data: First name, surname, email address, last login date, usage records.

Categories of data subjects: Employed teaching staff at the subscribing school.

BrainBuzz's obligations as data processor:

• Process personal data only on documented instructions from the school (i.e. data entered into the admin dashboard by the school admin)
• Ensure that all staff with access to personal data are subject to confidentiality obligations
• Implement appropriate technical and organisational security measures
• Not engage sub-processors without informing the school. Current sub-processors: Brevo SAS (transactional email delivery), Stripe, Inc. (payment processing), and ElevenLabs, Inc. (text-to-speech audio generation for Spelling subscribers). All are bound by GDPR-compliant data processing agreements
• Assist the school in responding to data subject rights requests
• Delete or return all personal data on termination of the subscription (subject to legal retention requirements)
• Make available all information necessary to demonstrate compliance with Article 28

School's obligations as data controller:

• Ensure there is a lawful basis for sharing teacher personal data with BrainBuzz
• Inform teachers that their name and email address will be used for BrainBuzz platform access
• Only enter accurate, current data for teachers who are employed by the school
• Remove teacher data promptly when a teacher leaves the school

To exercise data subject rights, raise a DPA query, or request deletion of data, use our contact form with the subject line "DPA Request".

2.6 Home Access Mental Maths — Registration & Subscription Data

Access to BrainBuzz Home Access Mental Maths requires home users to register for a paid subscription. When you register, we collect:

Children's data: Home Access does not collect any personal information about the children using the platform. No child names, ages, or identifying details are stored. Usage history is recorded against the parent/guardian account only.

Lawful basis: Processing is necessary to perform the subscription contract (Article 6(1)(b) UK GDPR).

Payment processing: Payments are handled by Stripe, Inc. BrainBuzz does not store card details. Stripe's privacy policy is available at stripe.com/gb/privacy.

Data retention: Account and usage data is retained for as long as the account is active, and for up to 24 months after cancellation. Billing records are retained for 7 years in accordance with HMRC requirements.

2.7 Mental Maths Cover Sessions — Cover Teacher Data

A teacher at a subscribing school can leave a single Mental Maths test for a cover teacher by sharing a link. The cover teacher does not need a BrainBuzz account. The first time they open the link they give us a few details so that the link can be tied to them. In this case BrainBuzz is the data controller for the details the cover teacher enters. We collect:

Who can see it: The school that set the link (its administrators) can see the cover teacher's name and email, and when the link was used. BrainBuzz's own administrators can also see this to support the service.

Lawful basis: Our legitimate interests (Article 6(1)(f) UK GDPR) in making sure a cover link is used only by the person it was shared with, in providing the test the school has left, and in keeping an accurate record of use. Any marketing is based on consent (Article 6(1)(a)), which can be withdrawn at any time.

Pupils: No pupil information is collected during a cover session.

Retention: Cover teacher details are kept while they continue to use cover links, and deleted after 24 months without use. A cover teacher can ask us to delete their details sooner through our contact form using the subject line "Privacy Rights Request".

3. What We Don't Collect

To protect children's privacy, we explicitly do not collect:

• Names of pupils using the activities
• Ages or dates of birth
• School or home addresses
• Phone numbers
• Photographs or videos
• Precise geolocation data
• Social media profiles
• Any other personally identifiable information from children

Note: Parents and school administrators who register for subscription services do provide personal details (see sections 2.3–2.7). Pupils using any BrainBuzz activity are never asked to provide personal information.

4. How We Use Information

We use the limited information we collect to:

• Provide Services: Enable pupils to use activities and track their personal progress locally
• Manage Subscriptions: Administer school and home access subscription accounts, issue invoices, and manage access
• Generate Audio: Send word list content to ElevenLabs to produce spelling audio for School Spelling subscribers
• Improve BrainBuzz: Understand usage patterns via anonymised analytics to enhance activities and features
• Ensure Security: Protect against misuse and maintain website security
• Legal Compliance: Meet our legal obligations including UK GDPR and the Data Protection Act 2018

5. Data Sharing and Disclosure

We do not sell, rent, or trade any user information. We may share data only in these limited circumstances:

5.1 Third-Party Service Providers

We work with trusted third-party services that help us operate BrainBuzz:

• Stripe, Inc. — Payment processing for all subscriptions. Stripe handles all card and bank payment data. BrainBuzz does not receive or store payment card details. See Stripe's Privacy Policy.
• Brevo SAS (formerly Sendinblue) — Transactional email delivery (subscription invoices, login notifications, renewal reminders). See Brevo's Privacy Policy.
• ElevenLabs, Inc. — Text-to-speech audio generation for School Spelling word lists. Word and sentence content is transmitted to ElevenLabs solely for the purpose of generating audio files. See ElevenLabs' Privacy Policy.
• Google Analytics — Anonymised website usage analytics. No personally identifiable information is shared. See Google's Privacy Policy.
• Cloudflare — CDN and infrastructure services for audio file delivery and security.
• Fasthosts — Web hosting provider for our website infrastructure.

These providers are bound by confidentiality obligations and data processing agreements, and may only use data to provide services to us.

5.2 Legal Requirements

We may disclose information if required by law or to:

• Comply with legal obligations or court orders
• Protect our legal rights
• Prevent fraud or security issues
• Protect the safety of children or others

6. Data Security

We take security seriously and implement appropriate measures to protect your information:

• Secure HTTPS encryption for all website traffic
• Regular security updates and monitoring
• Access controls limiting who can view data
• Secure data storage and transmission
• Regular security assessments

While we strive to protect your data, no internet transmission is 100% secure. We cannot guarantee absolute security but maintain industry-standard protections.

7. Data Breach Notification

In the event of a personal data breach, BrainBuzz will:

• Assess the breach and its likely impact on affected individuals as quickly as possible
• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach where it is likely to result in a risk to individuals' rights and freedoms
• Notify affected school subscribers (as data controllers) without undue delay where the breach is likely to result in a high risk to the rights and freedoms of their staff or pupils
• Notify affected home subscribers directly where the breach is likely to result in a high risk to their rights and freedoms
• Keep a record of all breaches, including those that do not require notification

If you suspect a data breach involving your BrainBuzz account, please contact us immediately via our contact form using the subject line "Data Breach".

8. Children's Privacy

BrainBuzz is designed to be safe for children aged 5 and above. We take extra care to protect young users:

• No Personal Information from Pupils: We never ask children for names, addresses, phone numbers, or other personal details
• No Pupil Accounts: Pupils can use all free features without creating accounts or profiles
• Local Storage Only: Free game progress is saved on the device, never on our servers
• No Social Features: No commenting, messaging, or interaction between users
• Educational Focus: Purely educational content with no commercial solicitation directed at children
• Parental Control: Parents can delete all local data by clearing browser storage

9. Your Rights Under UK GDPR

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right to Information: This privacy policy explains how we handle data
• Right of Access: Request a copy of the data we hold about you
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (subject to legal retention obligations)
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Change cookie preferences at any time
• Right to Portability: Receive your data in a portable format
• Right to Restrict Processing: Request that we limit how we use your data

How to Exercise Your Rights:

• Email: brainbuzz.co.uk/contact
• Use the subject line "Privacy Rights Request"
• Include your name, the email address associated with your account, and your specific request
• We aim to respond within 30 days

10. Data Retention

We retain different types of data for different periods:

• Local Storage (free activities): Remains on device until user clears browser data
• Cover Teacher Details: Retained while the cover teacher continues to use cover links, and deleted after 24 months without use
• School & Home Subscription Account Data: Retained for as long as the account is active, and for up to 24 months after expiry or cancellation
• Billing & Invoice Records: Retained for 7 years in accordance with HMRC requirements
• Usage Logs (school subscriptions): Retained for 24 months, then deleted
• Home Access Usage History: Retained for the duration of the active subscription, then deleted
• Spelling Word Lists & Audio: Retained for the duration of the subscription and up to 24 months thereafter
• Analytics Data: Anonymised; retained according to Google Analytics policies (typically 26 months)
• Cookie Preferences: Retained for 12 months

We delete or anonymise data when it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.

11. Third-Party Links

BrainBuzz may contain links to external websites (e.g. curriculum resources). We are not responsible for the privacy practices of these sites. We recommend parents review the privacy policies of any external sites their children visit.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in how we operate BrainBuzz, updates to data protection laws, or new features and services. When we make significant changes:

• We'll update the "Last updated" date at the top of this policy
• We'll notify users through a prominent notice on our website
• Existing subscribers will be notified by email of any material changes

13. Contact Information

14. Data Protection Authorities

If you're not satisfied with how we handle your data, you have the right to lodge a complaint with the relevant authority:

UK Data Protection:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113

15. Summary

Key Points:

• BrainBuzz collects minimal personal information from general visitors
• Free game progress is saved locally on your device, not on our servers
• We never ask pupils for personal information
• We use Google Analytics (anonymised) to improve the platform
• Cover teachers using a shared Mental Maths link give only their name and email address, and are never asked for pupil information
• Three paid subscription services are available: School Mental Maths, School Spelling, and Home Access Mental Maths
• Payments are processed securely by Stripe — we never see your card details
• School Spelling uses ElevenLabs for audio generation; word list content is transmitted solely to produce audio
• Schools acting as data controllers are covered by the Data Processing Agreement in section 2.5
• You have full rights to access, correct, or delete your data under UK GDPR
• We are fully compliant with UK GDPR and the Data Protection Act 2018
• Parents and schools can contact us anytime with privacy concerns

Thank you for trusting BrainBuzz with your child's educational journey.