Privacy Policy

Ascent is operated by Ember Learning Ltd ("we", "us", "our"), a company registered in England and Wales. We are the data controller for personal information collected through our platform.

Data Protection Officer: privacy@ascent11plus.co.uk

ICO Registration: We are registered with the UK Information Commissioner's Office.

Parent Account Information:

• Full name
• Email address
• Password (encrypted)
• Payment information (processed securely by Stripe, not stored by us)

Child Profile Information (minimal by design):

• First name only (no surnames)
• Year group (e.g., Year 5)
• Target exam type (e.g., 11+)
• Selected avatar

✓ We do NOT collect: Children's surnames, dates of birth, school names, photos, or any other identifying information beyond first name.

Learning Data:

• Questions answered and responses
• Session duration and timestamps
• Progress and performance metrics
• Topic strengths and areas for improvement

Technical Data:

• Device type and browser
• IP address (for security purposes)
• Usage patterns (to improve the service)

We never: Sell your data, use children's data for marketing, or share personal information with advertisers.

We only share data with essential service providers:

• Supabase: Database hosting and authentication (EU/UK data centres)
• Stripe: Payment processing (PCI DSS compliant)
• Resend: Transactional emails only
• Anthropic (Claude): AI-powered explanations (no personal data shared, only question content)

All providers are bound by data processing agreements and must meet GDPR standards. We do not sell or rent personal information to any third party.

• Encryption: All data is encrypted in transit (TLS) and at rest
• Access Controls: Row-Level Security ensures users can only access their own data
• Regular Audits: We conduct security reviews and address vulnerabilities promptly
• Secure Authentication: Industry-standard password hashing and optional OAuth
• UK/EU Hosting: Data is stored in secure, GDPR-compliant data centres

Some of our service providers process data outside the UK. Where this happens, we ensure appropriate safeguards are in place as required by UK GDPR:

• Supabase: EU data centres — covered by UK adequacy decision for the EU
• Stripe: US-based payment processor — transfers under Standard Contractual Clauses (SCCs) and PCI DSS compliance
• Anthropic (Claude AI): US-based — no personal data shared; only anonymised question content is sent for explanation generation
• Vercel: Hosting provider — edge network with UK/EU points of presence; governed by Data Processing Addendum

We regularly review these arrangements and will update this policy if transfer mechanisms change. You may request details of the safeguards in place by contacting our Data Protection Officer.

• Active Accounts: Data retained while your account is active
• Account Deletion: Personal data deleted within 30 days of account closure
• Anonymized Analytics: We may retain anonymized, aggregated data for service improvement
• Legal Requirements: Some data may be retained longer if required by law (e.g., financial records for 7 years)

We use minimal, essential cookies:

• Authentication: To keep you logged in securely
• Preferences: To remember your settings

We do not use tracking cookies, advertising cookies, or third-party analytics that profile users. No cookie consent banner is needed for essential-only cookies under UK regulations.

We may update this policy to reflect changes in our practices or legal requirements. We will notify you of significant changes by email and update the "last updated" date above.