Privacy & Child Safety | WizMarks — the online 11+ AI tutor

Our promises

Six things you should expect from any children's product

These aren't aspirations — each one describes how WizMarks is actually built.

Secure by design

Passwords are stored only as salted one-way hashes, all traffic is encrypted (HTTPS), account data is locked away from public access, and every AI request must carry a signed login token.

Parents see everything

Every conversation your child has with the AI tutor is visible to you in the parent dashboard — word for word. There are no private channels and no child-to-child chat of any kind.

No ads, no selling data

There is no advertising anywhere in WizMarks, no ad trackers, no analytics cookies, and we never sell or share personal data for marketing. Ever.

Minimal data

We don't ask children for an email address, phone number, photo, school name, date of birth or location. A child account is a username, a password and their learning progress — that's it.

Separate, protected memory

Each child's progress and AI chat history belongs to their account alone. Access is checked on our servers on every request — one family's data is never visible to another.

Your data, your call

Ask us and we'll send you a full copy of your family's data, or delete the lot. Deletion requests are honoured completely — accounts, progress and chat history.

For children: what this means

We only know the username your grown-up chose for you — not your email, your school or where you live.
Your grown-ups can see your practice and your chats with the AI tutor. That's on purpose — it helps them help you.
Nobody else on WizMarks can see your stuff, and there are no adverts and no strangers to talk to.
If you or your grown-ups ever want your things removed, we delete them — all of them.

The full policy

Privacy policy

This policy explains what personal data WizMarks collects, why, and what rights you have. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ICO's Age-Appropriate Design Code (the "Children's Code"), which sets extra standards for services used by children.

1. Who we are

WizMarks ("we", "us") operates wizmarks.co.uk, an online 11+ practice and AI-tutoring service for children aged roughly 8–11 and their parents, run from the United Kingdom. We are the data controller for the personal data described here.

For anything in this policy, contact us at hello@wizmarks.co.uk or through the contact form. We aim to reply within one working day.

2. What we collect — and what we deliberately don't

Accounts are created by a parent or guardian, who then adds child profiles. This is how we obtain parental consent for a child's use of the service.

Data	What it includes	Why we need it
Account details	Username, display name, password (stored only as a salted one-way hash — we cannot read it), account type (parent/child), and optionally the exam date, exam board and school year you choose to add.	To sign you in and tailor practice to the right exam and timeline.
Learning progress	Which questions were attempted, right or wrong answers, hints used, time taken, and skill-level scores derived from these.	This is the product: it powers the adaptive practice, misconception feedback and the parent dashboard.
AI tutor conversations	The messages your child exchanges with the AI tutor.	To provide the tutoring, keep context within a session, and show you the full history in the parent dashboard.
Payment details (parents only)	Handled by Stripe. We never see or store card numbers — we keep only a Stripe customer reference and your subscription status.	To manage your subscription.
Contact messages	Name, email address and message if you write to us, plus your IP address (used only to prevent spam).	To reply to you.
Email tips list (adults only)	Your email address and, if you give it, your first name — collected only if you sign up for our free 11+ tips. We also record the date and the IP address you signed up from, as our record that you asked to join.	To send you the free cheat-sheet and the 11+ tips you asked for. Every one of those emails has a one-click unsubscribe link, and we act on it immediately. This list is never used for children's accounts and is never shared or sold.

What we deliberately don't collect

No email address, phone number, date of birth, photo, school name or address for children.
No location data or device tracking.
No advertising or analytics trackers — we use no Google Analytics, no ad pixels, no fingerprinting.
No social features: children cannot message, follow or be contacted by anyone on WizMarks.

3. The AI tutor, and who processes data for us

When your child talks to the AI tutor, the conversation is sent through our own server to Anthropic's Claude API, which generates the tutor's replies. Under Anthropic's commercial API terms, these conversations are not used to train AI models. The AI tutor is instructed to teach — it works within the question your child is practising and does not ask for personal information.

We use a small number of specialist providers ("processors") to run WizMarks. They may only use the data to provide their service to us:

Supabase — our account and progress database.
Cloudflare — runs our application server and stores AI chat history and rate-limiting data.
Anthropic — provides the AI model behind the tutor (no training on your data).
Amazon Web Services — hosts the website.
Stripe — processes payments (parents only).
Resend — delivers our emails: account emails such as address confirmation and password resets, and the free 11+ tips list if you have joined it.
Google Fonts — serves the two typefaces on our public pages, which means Google receives the standard technical request data (such as IP address) when a page loads.

Some of these providers process data outside the UK. Where they do, transfers are protected by UK GDPR-approved safeguards such as the UK International Data Transfer Agreement or Addendum and standard contractual clauses.

We never sell personal data, and we never share it for advertising or marketing.

4. Our legal bases

Contract — providing the service you signed up for: accounts, practice, the AI tutor, the dashboard, billing.
Legitimate interests — keeping the service secure (for example rate limits and spam prevention) and improving question quality using aggregated, non-identifying patterns.
Consent — a parent or guardian creates every account and adds their own children, which is how consent is given for a child's data. You can withdraw it at any time by asking us to delete the account.
Consent (marketing emails) — we send the free 11+ tips only to adults who asked for them by signing up. You can withdraw that consent at any time using the unsubscribe link in any of those emails, and it takes effect straight away. Joining the tips list is entirely separate from having a WizMarks account: neither one signs you up for the other.

5. How children's data is treated (the Children's Code)

The ICO's Age-Appropriate Design Code asks children's services to put the best interests of the child first. Here is how WizMarks meets its key standards:

Data minimisation: child accounts carry no contact details or real-world identifiers beyond the name a parent chooses to use.
High privacy by default: there are no public profiles, no discoverability, and nothing a child does is visible to anyone outside their own family account.
No nudging for data: we never prompt children to share more information, and the AI tutor doesn't ask for personal details.
No profiling for marketing: the only "profiling" we do is educational — working out which skills need practice — and it is shown transparently to parents on the dashboard.
Parental oversight, transparently: children are told in the product that grown-ups can see their progress and chats. Oversight is visible, not covert.
Age-appropriate transparency: the child-friendly summary above explains this policy in words children can understand.

6. How long we keep data

We keep account, progress and chat data while the account is active, so your child's learning history keeps working for them. If you close your account or ask us to delete it, we delete personal data from our systems; payment records that we are legally required to keep (for tax and accounting) are retained by Stripe and in our billing records for the statutory period.

If you unsubscribe from the tips list we stop emailing you immediately, but we keep a minimal record that your address opted out. That record is what stops the address being added again by mistake — it is used for nothing else, and you can ask us to erase it completely at any time.

7. Security

All traffic is encrypted in transit (HTTPS/TLS).
Passwords are stored only as salted PBKDF2 hashes — one-way, so even we can't read them.
The accounts database is not reachable with public credentials; only our own servers can read it.
Every request for profile, progress or chat data is checked on the server against a signed login token, and families can only ever access their own data.
AI endpoints are rate-limited to prevent abuse.

8. Cookies and local storage

WizMarks uses one first-party cookie: a session cookie that keeps you signed in for up to 30 days. We also use your browser's local storage to cache learning progress on your device so practice stays fast. There are no advertising, analytics or third-party tracking cookies, which is why you won't see a cookie-consent banner — there's nothing to consent to.

9. Your rights

Under UK GDPR you (and your child) can ask us to:

Access / export — receive a full copy of the personal data we hold on your family.
Correct — fix anything that's wrong.
Delete — erase an account and everything attached to it ("right to be forgotten").
Restrict or object — limit what we do with your data.
Withdraw consent — at any time, for anything based on consent.

Email hello@wizmarks.co.uk from the parent's contact address and we'll act on it — usually well within the one-month legal limit. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO), though we'd appreciate the chance to put things right first.

10. Changes to this policy

If we change this policy in any meaningful way — especially anything affecting children's data — we'll update this page, change the date at the top, and tell parents by email or a notice in the parent dashboard before the change takes effect.

Questions about anything here — or want the technical detail behind any claim? Ask us at hello@wizmarks.co.uk. We'd rather over-explain than leave a parent wondering.

Built for children.Designed to protect them.