DRAFT, version draft-1. This text describes what the software actually does. It has not been reviewed by a lawyer or data-protection adviser and must not be treated as legal advice or as a statement of legal compliance. Items in [square brackets] must be completed by the owner before launch.

Privacy notice

This notice explains what The Brilliant Brains ([company name and address, to be completed]) collects through its free mock-exam website, why, and what you can do about it. It is written to be readable by young people; a parent or guardian is welcome to read it with you.

What we collect

• Your account: first and last name, email address, a password (stored only as a one-way scrambled value), your age group (under 13, 13 to 15, 16 to 17, 18 or over) and, if you choose, your school year. We do not ask for your date of birth, address or school name.
• If you are under 13: your parent or guardian's name and email address, and a record that they agreed.
• Your exams: your answers, the times you started and finished, the marks you were given, any feedback from a tutor, and the report we create from them.
• If you ask us to get in touch: the name, email address and (optionally) phone number and message you give us, what you asked about, and, only if you tick the box, a short summary of your report (overall percentage and topics to revise). We never send your answers.
• Technical records: when you signed in, and a scrambled (hashed) form of your internet address and browser type, used for security and to limit repeated attempts. We keep a log of important actions (for example sign-ins and marking) without passwords or answers.

Why we use it

• To run your account and let you sit mock exams, and to mark them and produce your report. [Legal basis to be confirmed by the owner's adviser.]
• To email you links to confirm your address, to reset your password and, for under-13s, to ask a parent or guardian to agree. We do not email results and we do not send marketing.
• To respond if you ask for a conversation, a trial lesson or tutoring. Asking is always optional and never needed to see your report.
• To keep the service secure and fair.

Who can see it

• You. Your report is private to you.
• A parent or guardian whose link to you has been checked: always if you are under 13; if you are 13 or over, only when you switch sharing on in Privacy (you can switch it off at any time).
• Tutors who mark your written answers see your answers without your name, and only for their own subjects. Administrators can see account details and reports so they can run the service.
• Our service providers: the company that hosts the website and database (Hostinger) and the email service [to be completed]. [International transfers and processor terms to be confirmed.]

How long we keep it

These are proposals awaiting the owner's approval: accounts that never confirm their email, or never get a parent's agreement, are deleted after 30 days; delivered email copies are deleted after 7 days; [retention for exam records, reports and enquiries to be decided]. You can delete your account yourself at any time.

Your choices and rights

• See your data: sign in, open Account and choose Download my data.
• Delete your data: Account then Erase my account deletes your account, answers, marks and reports and makes any request you sent us anonymous.
• Change your email in Account. Withdraw a request to the team from your report page.
• You may have other rights, including to complain to the Information Commissioner's Office (ico.org.uk). [Owner to complete: contact details for data questions.]

Cookies

We use one essential sign-in cookie. We do not use advertising or analytics cookies. We keep unsent exam answers in your browser's local storage during an exam so they are not lost; signing out removes them.

Contact: [email address for privacy questions, to be completed]. Last updated: draft-1.