Privacy Policy

1. Data we collect

• Account data: Email address, password hash, and login credentials (processed by our authentication provider).
• Teacher profile data: Display name, class code, and teacher ID.
• Student data: Avatar selection and a 4-digit PIN (not stored in plain text). We do not collect real names, addresses, or dates of birth from students.
• Usage data: Game selections, play timestamps, and activity logs.
• Device/technical data: IP address, browser type, and device identifiers (via standard server logs and analytics).

2. Purposes and legal basis

• Contract performance: Providing the service, managing your account, and enabling classroom features.
• Legitimate interests: Service security, fraud prevention, product improvement, and customer support.
• Consent: Where required for specific communications or optional analytics.
• Legal obligation: Compliance with applicable laws and regulations.

3. Data sharing

We share data with the following categories of recipients:

• Service providers: Hosting, database, and analytics providers necessary to operate the service.
• Merchant of Record (Paddle): For sale of the product, subscription management, payments, tax compliance, and invoicing. Paddle processes payment data independently as the Merchant of Record.
• Professional advisers: Legal and accounting professionals where required.
• Authorities: Where required by law or to protect our rights.

4. Data retention

We retain your personal data for as long as your account is active or as needed to provide the service. If you delete your account, we will delete or anonymise your data within 90 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, financial records).

5. Your rights

Depending on your location, you may have the right to access, rectify, erase, restrict processing of, or port your personal data. You may also object to processing and withdraw consent where applicable. To exercise these rights, contact us using the information below.

If you are in the UK or EEA, you have the additional rights under the GDPR, including the right to lodge a complaint with a supervisory authority.

6. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls, and regular security reviews. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

7. Cookies

We use essential cookies necessary for the operation of the service (e.g., session management, authentication). We may use analytics cookies to understand how the service is used. You can manage cookie preferences through your browser settings.

8. International transfers

Your data may be transferred to and processed in countries outside the UK and EEA. When this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.

9. Children

Our service is designed for use by teachers and parents with children aged 4–9. We do not knowingly collect personal data directly from children. Student accounts are created and managed by teachers, and we only collect minimal data (avatar and PIN) for classroom use.

10. Contact

For privacy-related questions or to exercise your rights, contact DeSmedt Games at the support channel listed on our website.