Privacy Policy

Last updated: 14 October 2026

This policy explains what information we hold about your family, why, who we share it with, how long we keep it, and your rights. Our service is used by children, so we follow the Information Commissioner's Office (ICO) Age Appropriate Design Code (the "Children's Code") and keep what we collect to what we need.

1. Who is responsible for your information

This website is run by Bright Sparks Education, a company registered in England and Wales, which is the "data controller" for your information. Our company details, including our registered office address, are on the public register at Companies House. Contact us at [email protected].

2. What we collect

About you, the parent or guardian

• Your name and email address. The email is your login, and we check it is yours by sending a 6-digit code when you sign up.
• Your password (stored scrambled, so nobody, including us, can read it).
• Your mobile number, if you give it, and whether you agreed to WhatsApp messages and when.
• Your email choices (weekly report, tips and offers) and when you agreed.
• Records of what you bought and paid (taken by our payment providers; we never see full card details).
• Messages you send us, including replies to our emails. A reply is kept with your child's record so we can answer it, and Gmail keeps its own copy.

About your child

• Name, username and password (scrambled), year group and what they are preparing for.
• Learning activity: lessons, quizzes and mock exams taken, answers and scores (including answer sheets you upload), topic results, Spark Points and badges.
• Weekly Vocab Booster use: the weeks and words worked through, practice quizzes, parent check scores, and when the booster pages were opened.

For Flourish Club and some events

• If your child attends Flourish Club sessions, we ask for details we need to look after them safely: date of birth, school, year and class, allergies, medical conditions, additional needs, emergency contacts, who may collect them, and your first-aid and photo consent choices.
• If you register for TED-Ed Student Talks or a Maths Olympiad workshop, we collect the details asked for on that form, including filming and photo consent where relevant.

When you use the site

• Sign-in records: when an account signs in or fails to sign in, the internet address and network it came from, and the type of device and browser.
• Which papers an account opens and when (with a shortened internet address), so we can spot our materials being copied.

3. Why we use it, and our lawful reasons

• To run your account and the courses you chose, take payment, and send receipts, sign-up codes, password help and booking emails (to perform our contract with you).
• To send progress reports and weekly vocabulary checks to you (our legitimate interest in helping your child learn; you can turn the weekly report off).
• To keep accounts and our materials safe: checking email addresses, one device at a time, locking an account after repeated wrong passwords, spotting shared logins and copying, and keeping a record of changes our staff make (our legitimate interest in security and preventing misuse).
• To understand how our free resources are used, such as how many children use the Weekly Vocab Booster each week, so we can improve them and plan (our legitimate interest).
• To send tips, offers and news by email or WhatsApp, only to parents who have agreed (consent). You can withdraw this at any time.
• Flourish Club health and safety details (such as allergies and medical conditions) are used only to keep your child safe at sessions, with your explicit consent, and in an emergency to protect your child.

We never send marketing to children, never sell your information, and do not use it for advertising. On the leaderboard, other students see a made-up nickname, not your child's name.

4. Who we share it with

We only share what each service needs to do its job for us:

• Hosting: our database is kept on our own secure server.
• Email: Google (Gmail) sends our emails.
• Help drafting replies: when you email us, a member of staff may ask Anthropic's Claude AI to draft an answer. Your email, our earlier emails to you and your child's name and courses are sent to Anthropic for that. A member of staff always reads and edits the draft before anything is sent, and Anthropic does not use it to train its AI.
• Payments: PayPal, Stripe and GoCardless (Direct Debit), and our bank for bank transfers.
• WhatsApp (Meta): if you agreed to WhatsApp messages, your number is saved in the academy's WhatsApp phone so we can message you. We use broadcast lists, so other families do not see your number.
• Google reCAPTCHA on sign-up forms, to stop automated spam (Google may see your internet address).
• Video: lesson videos play from YouTube (privacy-enhanced mode) and Vimeo (do-not-track mode).

Some of these companies may handle information outside the UK. When they do, it is protected by recognised safeguards, such as the UK's adequacy decisions (including the UK-US Data Bridge) or the ICO's International Data Transfer Agreement. We share information with others only if the law requires it or to protect a child.

5. How long we keep it

• Account and learning information: while the account is in use. We review accounts with no sign-in for 24 months and delete or anonymise them.
• Sign-in records, booster visit records, the papers-opened log and our staff change log: 24 months, then deleted automatically.
• Replies to our emails (and anything attached to them), and the emails we send you: 24 months, then deleted automatically.
• Sign-up codes: deleted after 7 days.
• Payment records: 6 years, as UK tax law requires.

6. Your rights

You can ask us to:

• see the information we hold (we can send it to you in one file);
• correct anything that is wrong;
• delete your family's information (we remove names, emails, phone numbers, logins and sign-in records; payment records are kept for tax, without your names);
• restrict or object to how we use it, or move it to another service.

You can withdraw consent at any time: for emails and WhatsApp in My account (Preferences), with the unsubscribe link in any marketing email, or by telling us. Parents use these rights on their child's behalf. Email [email protected] and we will reply within one month. If you are unhappy with how we handle your information, you can complain to the ICO at ico.org.uk.

7. Cookies

We use one essential cookie that keeps you signed in. If our sign-up form shows Google reCAPTCHA, Google sets its own cookie to stop spam. The app also remembers small settings in your browser, such as whether the menu is open. Videos play in YouTube's privacy-enhanced mode and Vimeo's do-not-track mode. We do not use advertising or analytics cookies, so you do not need to accept a cookie banner.

8. How we keep it safe

The site uses encrypted connections (HTTPS). Passwords and sign-up codes are stored scrambled. An account signs in on one device at a time, and repeated wrong passwords lock it for a while. Only our staff can see family details, and every change they make is recorded.

9. Changes to this policy

We will update the date at the top when this policy changes, and email the parent address on the account about any important change.

See also our Terms of Use and Sale and Safeguarding Statement.