Privacy policy

GradeSmart Tuition (“we”, “us”) is the data controller for the personal information described below. We are registered with the UK Information Commissioner’s Office (ICO).

What we collect

• Contact details (parent name, email, phone)
• Student details (name, year group, attendance, progress notes)
• Billing and payment metadata (never card numbers — Stripe holds those)
• Safeguarding logs where required by our duty of care
• Cookies that are strictly necessary for signing you in

How we use it

To deliver tuition, invoice for it, communicate with parents and tutors, and meet our safeguarding obligations.

Referral partners

If you were referred to us by one of our community referral partners and used their referral code, that partner can see that a referral they made enquired and whether it went on to enrol. They see your initials and the dates only — never your name, your contact details, your child's name or their year group. Partners are paid a fixed fee per student who enrols, which does not affect what you pay.

School revision material

Separately from tuition, we host revision booklets and question sets for students at schools we teach at. If you are one of those students, the only things we hold are the email address your teacher added to a class list, your name if your teacher supplied it, which class list you are on, and a record of which files you have downloaded and when.

We use it for one purpose: letting you sign in and download the material your teacher has shared with your class. It is never used for marketing, never shared with anyone outside GradeSmart, and is kept entirely separate from our tuition records — being on a class list does not make you a tuition customer and does not sign you up to anything.

We delete the class list, the download record and the sign-in account at the end of the academic year. You can ask your teacher to remove you at any point, or email us directly using the address below.

How long we keep it

Academic records for 7 years after a student leaves. Financial records for 6 years (HMRC requirement). Safeguarding logs are kept under our safeguarding policy. School revision class lists, download records and sign-in accounts are deleted at the end of each academic year.

Your rights

You may request a copy of your data, ask us to correct it, or ask us to delete it where we are not required to keep it. Email privacy@gradesmart.uk. You can also download your data yourself from the account menu once signed in.

Processors we use

• Supabase (EU-West) — database & auth
• Vercel (EU) — hosting
• Stripe UK — card payments
• Zoho Mail — transactional email

Complaints

You have the right to complain to the ICO at ico.org.uk. We would always prefer to fix the issue first — please contact us.