Last updated: 18/06/2026

‍

1. Introduction

This Privacy Policy explains how Exam Papers Plus Ltd, Company number: 09089974 ("we", "us", "our") collects, uses, shares, and protects personal information when you or your child use Exam Beacon (the "Service"), our AI-assisted tutoring platform for 11+ exam preparation.

We are the data controller for the personal information described in this policy. Our registered office is at 40 Bowling Green Lane, Clerkenwell, London, England, EC1R 0NE and we are registered with the Information Commissioner's Office (ICO) under registration number ZB576998.

Exam Beacon is designed primarily for children aged 8 to 11. Because of this, we take particular care over how we handle children's personal data, and we have written this policy to be as clear as possible. We encourage parents and carers to read it with their child where appropriate.

‍

2. Who uses Exam Beacon

Exam Beacon is used by:

• Children (typically aged 8 to 11) who complete exam preparation activities and interact with the AI study companion.
• Parents and carers who set up and manage accounts, monitor progress, and make decisions about their child's use of the Service.
• Schools or tutoring organisations (where applicable) that provide access to the Service.

An account is created and managed by a parent, carer, or authorised adult. Children do not create their own accounts.

‍

3. The information we collect

We collect the following categories of personal information.

‍

Account and contact information

• Parent or carer name, email address, and (where provided) telephone number.
• Billing and payment information, which is processed by our payment provider Stripe. We do not store full card details on our own systems.
• The child's first name or display name, year group, and (where provided) age or date of birth, device/session data used to tailor the learning experience.
  ‍

Learning and performance information

• Answers, responses, and work submitted by the child.
• Progress, scores, time spent, and patterns of activity within the Service.
• Interactions with the AI study companion, including questions asked and feedback given.
• Special educational needs accommodation. Where a parent or carer enables the SEND conditions setting, we record that the child qualifies for extra time or learning support. This is health-related information and is treated as special category data under UK GDPR Art. 9. It is used solely to adjust exam timers and is not shared with third parties or used for any other purpose.

‍

Technical and usage information

• Device type, browser, operating system, and IP address.
• Log data such as access times, pages or features used, and error reports.
• Cookies and similar technologies (see Section 12).

We collect one item of special category data: the SEND accommodation flag described in Section 3. We do not intentionally collect any other special category data (such as information about health, ethnicity, or beliefs), and we ask that users do not submit such information through the Service.

‍

4. How we use information and our lawful bases

Under UK GDPR we must have a lawful basis for using personal information. We rely on the following.

Where we rely on legitimate interests, we have considered the impact on children and have given their interests and rights particular weight, in line with the ICO Children's Code.

‍

• STo provide and personalise the Service (lawful basis: performance of a contract, and our legitimate interests in operating an effective learning product). This includes setting up accounts, delivering tutoring activities, adapting difficulty and feedback to the child, and tracking progress.To support and communicate with account holders
• To support and communicate with account holders (lawful basis: performance of a contract and legitimate interests). This includes responding to enquiries, sending service-related messages, and providing customer support. Where you opt in, we may contact you on WhatsApp to reply to support queries and to send a weekly notification with a link to your child's progress report in your account. The report itself stays within your account, and we do not send your child's results through WhatsApp. We only use WhatsApp to contact parents and carers, never children, and you can opt out at any time.To keep the Service safe, secure, and working
• To keep the Service safe, secure, and working (lawful basis: legitimate interests and legal obligation). This includes preventing misuse, diagnosing problems, and protecting children using the Service.To improve the Service
• To improve the Service (lawful basis: legitimate interests). Where we analyse usage to improve Exam Beacon, we use aggregated or de-identified information wherever possible.For marketing
• For marketing (lawful basis: consent). We only send marketing communications to parents or carers, never to children, and only where they have agreed. You can withdraw consent at any time.To apply SEND accommodations
• To apply SEND accommodations (lawful basis: explicit consent under Art. 9(2)(a)). Where you enable the SEND conditions setting for your child, we process that information to adjust timers accordingly. This setting is off by default. You can change it at any time from the learner settings page, and withdrawing consent will immediately remove the accommodation from your child's sessions.

‍

5. Children's privacy

Protecting children is central to how we have built Exam Beacon. In particular:

• We design the Service so that the best interests of the child are a primary consideration.
• We collect the minimum amount of personal information needed to provide the learning experience.
• We apply high privacy settings by default and do not use children's data in ways that are likely to be detrimental to their wellbeing.
• We do not use children's personal data for behavioural advertising or to build marketing profiles of children.
• We do not sell children's personal data.
• We do not use techniques designed to encourage children to provide unnecessary personal data or to stay engaged beyond what supports their learning.

‍

Parents and carers can review the information held about their child, ask us to correct or delete it, and control how the Service is used. See Section 11 for how to exercise these rights.

If you believe a child has provided us with personal information without appropriate parental involvement, please contact us at policy@exambeacon.com and we will take appropriate steps to address it.

6. The AI study companion and automated processing

Exam Beacon uses artificial intelligence to provide tutoring, marking, and feedback. This means:

• A child's responses are processed automatically to generate feedback, adapt difficulty, and suggest next steps.
• This processing supports the child's learning and does not produce legal effects or similarly significant effects on the child.
• A human reviews the design and behaviour of the AI study companion, and parents and carers can see the feedback and progress information the Service generates.

‍

We use Google Cloud Vertex AI to power our AI features. We do not use children's submitted content to train AI models, and our AI provider (Google) does not use prompts or responses to train its models. Content may be processed transiently to generate a response but is not used for model training.

‍

7. Sharing information and our sub-processors

We share personal information only where necessary, and with appropriate safeguards in place. We may share information with:

• Service providers and sub-processors who help us run the Service, such as hosting, payment processing, customer support, analytics, and AI providers.
• Payment processors: billing and payment information is handled by our payment provider (Stripe), who is PCI-DSS certified. We do not store full card details.
• AI service providers: the AI study companion processes your child's responses using Google Cloud infrastructure, hosted in the UK (London region). We have confirmed that customer data is not used to train Google's AI models.
• Cloud hosting and database providers: our platform and database are hosted with a UK/EEA-based cloud provider.
• Email delivery providers: we use a third-party email service to send service notifications and, where consent is given, marketing communications to account holders.
• Product analytics providers: we use an analytics platform (hosted in the EU) to understand how the Service is used. See Section 12 for detail on what is tracked.
• Schools or tutoring organisations, where they provide access to the Service for a child, limited to what is necessary for that purpose.
• Professional advisers, auditors, and authorities, where required by law or to protect our rights, the Service, or the safety of users.
• A successor organisation, in the event of a sale, merger, or reorganisation, subject to this policy continuing to apply.
• Customer-relationship management: we use Attio to store parent/carer contact details and a record of our communications with you.
• Workflow automation: we use n8n to move information securely between our systems.
• Messaging: where you opt in, we use WhatsApp (provided by Meta) to send support replies and notifications.

We require all sub-processors to protect personal information and to use it only for the purposes we specify.

‍

8. International transfers

We store and process personal information within the UK or the European Economic Area (EEA) wherever possible, and we choose providers that offer UK or EU data centres where we can. Some of the providers we rely on (for example, certain payment and messaging providers) may process personal information outside the UK or EEA. Where information is transferred outside the UK, we put in place appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses). You can ask us for more detail using the contact details below.

‍

9. How long we keep information

We keep personal information only for as long as necessary for the purposes set out in this policy, after which we delete it or anonymise it. We keep children's personal information for no longer than we need it. Our general retention periods are:

• Account information: for the duration of the account and for 6 years after closure, reflecting the period in which a legal claim could be brought.
• Children's learning and performance information: this includes answers, scores, activity, and interactions with the AI study companion. We delete or anonymise this information within 90 days of account closure, unless we are required to keep specific items for a legal reason. We may keep aggregated or anonymised insights that do not identify your child to help us improve the Service.
• Billing records: retained as required by law (6 years from transaction date).
• Support correspondence: retained for 6 years from the date the matter was resolved.
• Marketing preferences: processed until you withdraw consent and for 30 days after this, after which your opt-out is retained indefinitely to ensure we do not contact you again.

‍

When an account is closed, we delete or anonymise your child's learning and performance information within the period set out above, and we keep only the limited account and billing records that we are required to retain for legal reasons.

‍

10. How we keep information secure

We use appropriate technical and organisational measures to protect personal information, including TLS encryption in transit, encryption at rest, hashed credential storage, role-based access controls, and regular review of our security practices. Guardian and learner accounts use separate authentication flows with automatic session expiry. No system can be guaranteed to be completely secure, but we work to protect personal information and to respond promptly to any security incident.

‍

11. Your rights

Under UK data protection law, you (and, for a child, their parent or carer acting on their behalf) have the right to:

• access the personal information we hold;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information in certain circumstances;
• ask us to restrict or object to certain processing;
• ask us to provide information in a portable format; and
• withdraw consent where we rely on it (for example, for marketing).

Because Exam Beacon is used by children, parents and carers can exercise these rights on behalf of their child. We may need to verify your identity and your relationship to the child before acting on a request.

‍

To exercise any of these rights, contact us at policy@exambeacon.com. We will respond within one month, although we may extend this for complex requests and will tell you if we do.

‍

12. Cookies and similar technologies

We use cookies and similar technologies to operate the Service, remember preferences, and keep accounts secure. We also use PostHog, an analytics platform hosted in the EU, to understand how the Service is used, for example which features are visited and how learners navigate the platform. We do not use cookies for behavioural advertising to children. Where the law requires consent for non-essential cookies, we ask for it. You can manage your preferences at any time through your browser settings or our cookie policy page.

‍

13. Changes to this policy

We may update this policy from time to time. Where changes are significant, we will tell account holders directly (for example, by email or through the Service) before the changes take effect. The date at the top shows when the policy was last updated.

‍

14. How to contact us and how to complain

If you have any questions about this policy or about how we handle personal information, please contact:

• Exam Papers Plus Ltd (Company number: 09089974)
• 40 Bowling Green Lane, Clerkenwell, London, England, EC1R 0NE
• complaint@exambeacon.com

‍

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk

‍

We would, however, appreciate the chance to address your concerns before you approach the ICO, so please do contact us first.