Skip to main content
BrightEleven

Privacy Policy

Last updated 2026-10-12. If you are looking for a shorter, child-focused explanation, see our child privacy notice.

1. Who we are

BrightEleven is operated by TechRock Ltd, a company registered in England & Wales (company no. 15719754), registered office 1 Dale Avenue, London HA8 6AD. TechRock Ltd is the data controller for the personal data described in this policy, in line with UK GDPR, and is registered with the ICO under registration number ZC233806.

2. What we collect

From the parent account holder:

  • Name and email address
  • Billing information, if you subscribe to a paid plan (processed by our payment provider - we do not store full card details)
  • Marketing preference (opt-in only)
  • Email progress digest preference, if opted in: how often and what time of day to send it - the digest itself is a summary of the learning data listed below, not new data on its own
  • Practice reminder settings, if you turn reminders on: which days, roughly what time, and whether to remind you by email, by a notification on your device, or both - and, for device notifications, the notification address your browser issues for that device, kept until you turn notifications off for it
  • If you offer a quote for our website: the sentence you wrote and the first name and region you asked us to show it under - kept until you withdraw it from your profile page, we decide not to show it, or you delete your account, and deleted at that point. We also keep a record of your consent - which version of the consent wording you agreed to, the date you agreed and, if you withdraw, the date you did - until you delete your account

From a child profile (for a child aged 8 to 11), created and consented to by the parent:

  • A display name - by default a nickname the app suggests, or their first name if you prefer to use it - no surname, no date of birth
  • An avatar made of shapes and colours (never a photo) and a 4-digit PIN, which we store only as a one-way hash, with a security log of the time of each wrong PIN typed on the profile and of any lockout that follows
  • Learning and performance data: questions answered, accuracy, time spent, mastery levels, the questions waiting in Fix-It, mock papers and their results, points/streak/badge history, gems history, and the buddy your child sets up (species, a name picked from our list, outfits, care, trips, mini-missions, a saving goal and decoration choices in its HQ)
  • The app settings chosen for your child (such as font, text size, read-aloud and sounds), the daily screen-time limit you set, the reward targets and spin-wheel goodies you set up, the buddy and spin-wheel switches, and a record of your consent to the profile (when you gave it and which wording)
  • A question your child reports as wrong or confusing: which question, the reason picked from a short list, and their display name
  • Optional, and only if you add them from your child's page: a target exam date and the GL region or area your child is preparing for, used to show a plain day count to that date. No year group is collected - it is not asked for on any screen.

Technical data we process to run the service safely:

  • Your IP address, kept for about 24 hours in a rate-limit log so that public forms and the sign-in, sign-up and help-assistant endpoints cannot be flooded. At sign-up we also keep a one-way hash of the IP address with your account, to spot repeated sign-ups from one place.
  • For our own "how many people visit" count: the page visited, the page you came from, your country (from the hosting provider's country header - no location service), how quickly the page loaded and responded, and a visitor code made by hashing your IP address and browser type together with the day's date. The code changes every day, so it cannot follow you from one day to the next. When you are signed in, a page you view yourself is also linked to your account, so we can see how parents use the site; pages viewed in a child's session are never tied to your account. This runs in our Android and iPhone apps too, because they show this website. If you opened a page by following a link in one of our emails, we also keep the short label naming that email with that page view (see Resend in Section 8); a page in a child's session never keeps one.
  • A record of each successful sign-in to your parent account (the email used and the country), which we keep as a security log.
  • A random device identifier in a cookie (see Section 9) and a rough label such as "Chrome on desktop", so we can enforce the three-device limit and you can recognise your own devices in your profile.
  • Error reports from our servers and from the parent and public pages, with personal details removed before they are sent - never from any screen a child uses (see Sentry in Section 8).

If you contact us:

  • Contact form and feedback: your message, the page it was sent from, the category you chose and - if you give one - your email address so we can reply. You do not need an account to use the contact form.
  • A child's feedback note (up to 400 characters, category and message only): held for you to read and approve before it becomes a support ticket, and never sent anywhere outside your family until you approve it.
  • Messages to Eva, our parent-facing help assistant: sent to the AI provider to generate a reply (Section 4) and not stored by us.

3. Why we collect it

To provide the service (adaptive practice, progress dashboards, the rewards your child earns), to communicate with you about your account and billing, and - only with explicit opt-in - to send marketing communications. Asking you for a review, or for a quote to show on our website, counts as marketing: we email that kind of request only if you have opted in, and every one tells you how to stop them. A notice about your account or your family's access never carries one.

We also use our own records of how the site is used to understand what helps families and to improve BrightEleven: the visit counts and page views in Section 2, including which of our emails a visit came from and what was opened next, and, for parents who receive the progress digest, how many families came back or had a child practise in the week after it, and how many children's practice sessions start on each day of the week and at each hour, counted across all families together so that no individual child or family is shown. We rely on our legitimate interests for this. It uses no third-party analytics service and no cookie, and you can object to it (Section 5).

We do not use child data for advertising, do not sell personal data, and do not build behavioural advertising profiles from any child-facing activity.

4. Automated processing and AI

Which practice question a child sees next is chosen automatically, based on their own past answers - there is no profiling for advertising or any purpose beyond adjusting difficulty within BrightEleven itself, and a parent can always see their child's full activity on the dashboard.

Eva, our parent-facing help assistant, is powered by a third-party AI language model (see Cloudflare in Section 8). Eva is not available on any child-facing screen, and messages you send it are processed only to generate a response - they are not used to train the underlying model.

Questions come from BrightEleven's own rule-based generators and from authors working to a written brief, and some drafts are AI-assisted. A new question can only be published by a step that refuses to run unless a verifier has independently re-derived that batch's answers and filed a report - the check does not trust the author or the generator, and the record is written against the rows as they go live. Across the bank, automated verifier rules and bias audits run in our build pipeline, and any question a family reports is checked against its source and corrected or removed. We do not claim that a person has individually reviewed each of the questions already live. See our terms of service for more detail.

5. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you and your children
  • Correct inaccurate data
  • Export your data (data portability)
  • Request deletion of your account and all associated child data
  • Ask us to restrict how we use your data while a question about it is resolved
  • Object to processing we carry out on the basis of our legitimate interests (for example the security and visitor-count logs in Section 2)
  • Withdraw any consent you have given - including the marketing preference, the progress digest, and your consent to a child profile, which you withdraw by deleting that profile - at any time, without affecting what was done before you withdrew it
  • Complain to the Information Commissioner's Office (Section 10)

Self-serve data export and account deletion are available from your account settings, with no need to contact support first. Deletion is immediate and permanent - there is no waiting period and nothing is kept "just in case": your account, every child profile under it, and all associated learning data, page-view records and device records are removed as soon as you confirm your password. A handful of records are kept in anonymised form because they are still needed after you leave - a question report you or your child sent (so the question still gets fixed), the reference number of a support ticket, and our sign-in security log - and in each case every identifying detail (names, email address, message text) is overwritten before the account is deleted, so nothing left can be linked back to you or your child.

6. Data retention

We retain account and learning data for as long as your account is active. If you delete your account, everything is removed immediately as described in Section 5, with two exceptions: (1) if you have paid for a subscription, we keep the records of those payments (not your child's data) for as long as accounting and tax law requires us to, and our payment provider keeps its own copy under its own terms; and (2) the short-lived technical logs in Section 2 have their own clocks: the rate-limit log is cleared after about 24 hours, the visitor code changes daily, and our visitor-count and sign-in logs have no automatic expiry today - the entries linked to your account are deleted or anonymised when you delete it. A message sent through the contact form without an account is not covered by account deletion; email us at hello@techrock.co.uk if you would like it removed.

7. Data storage and security

Data is stored with infrastructure providers offering industry-standard encryption at rest and in transit. Access is restricted to what's needed to operate the service.

8. Third parties and international transfers

We use a small number of third-party processors strictly to operate the service:

  • Supabase - database, authentication, and file storage
  • Stripe - payment processing for subscriptions (we never see or store full card details)
  • Vercel - application hosting
  • Resend - delivering our emails to you: account emails (sign-up confirmation, password reset, notices about your family's access), the optional progress digest and practice reminders if you have turned them on, and occasional product emails if you have opted in to them. Our emails carry no tracking image, and we never record whether you open an email. Links in our emails that lead to our own website include a short label naming the email they are in (for example "utm_campaign=progress-digest"), so when you follow one we can see which email brought you to our site; the label is kept with that page view, which is linked to your account if you are signed in, like any other page you view (Section 2). There is no label on links that sign you in, reset a password, confirm your email address or accept a tutor invitation, on the progress digest's one-click unsubscribe link, or on links to other websites. The links in a practice reminder or product email that take you to your profile page to change your email preferences are ordinary page links and carry the label.
  • Cloudflare - runs the AI language model behind Eva, our parent-facing help assistant; only processes the messages you choose to send it
  • Sentry - error monitoring, hosted in the EU. Receives error reports from our servers and from the parent and public pages (never from any screen a child uses), with personal details such as email addresses, identifiers and PIN-like numbers removed before anything is sent; no session recording
  • Hugging Face - a content-delivery network that serves the voice files for the optional read-aloud voice; a child's browser contacts it only if read-aloud has been switched on in that child's settings (it is off by default), and the download carries no name, account detail or learning data

Tutors you invite. If you choose to invite a tutor from your Tutors page, that person becomes a recipient of a limited summary of the child profile you link them to: the display name and exam date, the level for each topic and when the child last practised it, each recent practice session (when it started and finished, its type, minutes, questions answered and answered correctly), each mock paper (subject, date, right out of total) and the number of questions waiting and due in Fix-It per topic - never the individual questions or answers, settings, the PIN, the avatar, the buddy and rewards, screen-time limits, the GL region, or your own account details. You control this: the tutor sees nothing until they accept your invitation, and nothing from the moment you revoke it. Our child privacy notice describes exactly what a tutor can and cannot see. The tutor is a data subject too: we hold the email address you typed, the state of the invitation and any focus note they write, and we delete a revoked or unaccepted invitation, with that address, 30 days after it ends. What we hold about a tutor and why is set out for them in the tutor privacy notice, which the invitation email links to.

We do not share data with third parties for their own marketing purposes. Some of these providers may process or store data outside the UK, including in the United States. Where that happens, it's covered by that provider's standard contractual clauses or another UK GDPR-recognised safeguard for international transfers.

9. Cookies

We only use cookies that are strictly necessary to run the service - we do not use advertising or marketing cookies, and we do not use tracking or analytics cookies of any kind. Because every cookie we set is strictly necessary, UK law doesn't require us to ask for your consent to use them, so we don't show a cookie banner.

  • Signing you in and keeping you signed in
  • Remembering which child profile is active in a shared family session
  • Confirming a parent PIN was entered before a parent-only action
  • Recognising a device you've already signed in from, to enforce our per-account device limit
  • Carrying the "you're already signed in on 3 devices" message back to the sign-in page, for two minutes
  • Drawing the site as an app when you open BrightEleven inside our Android or iPhone app (no marketing pages, no plan or checkout screens). That cookie, be_app, holds the word "ios" or "android", nothing about you, and lasts a year

Our internal "how many people visit the site" count (used only by us, to understand overall usage) works without setting any cookie at all.

10. Contact and complaints

Questions about this policy, or requests relating to your data, can be sent to hello@techrock.co.uk or via our contact page. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).