Privacy notice

Who we are

“We” means ApexMaths, the operator of this service. We are the data controller for the personal data described in this notice. ApexMaths provides timed 11+ maths practice for UK families; accounts are created and managed by a parent or guardian on behalf of their children.

For data-protection enquiries, contact us through the email associated with your account. You can also raise complaints with the UK Information Commissioner's Office at ico.org.uk.

What data we collect

For each parent account:

• Email address.
• Password — stored and verified by Amazon Cognito; we never see or store it ourselves.
• Email verification status.
• The date you accepted the parent / guardian and age attestations.
• A Stripe customer reference linking your account to your subscription.

For each child profile you create:

• A display name you choose (which can be a nickname).
• An optional year group (Year 4, 5 or 6).
• The dates and results of practice sessions.
• Topic-level progress (questions attempted, answers correct, mastery score).

We do not collect any other personal data about children — no email, no date of birth, no school, no contact details, and no photos.

Why we collect it (lawful basis)

• Parent account: contract performance — we cannot provide the service without it.
• Child profile and practice data: consent from the parent or legal guardian (the attestation you accepted at sign-up). You can withdraw consent at any time by deleting a child, or your whole account, from your account settings.
• Subscription data: contract performance and legal obligation (financial record-keeping).
• Audit log of significant actions: legitimate interest — security, fraud prevention, and (as this service was originally built for a hackathon) competition submission evidence.

How long we keep it

• Account data (parent, children, practice sessions, progress): until you delete your account. Deleting your account removes this data immediately, and in any case within 30 days.
• Audit log: retained for security and accountability, typically for at least 12 months.
• Subscription and invoice records: held by Stripe under their own retention policy (typically 6–10 years for tax and accounting compliance). When you delete your account, we de-attribute your customer record on our side, but Stripe may retain invoice records as required by law.
• Aggregated revenue counts: retained indefinitely as non-personal, aggregate data only.

Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you — download a complete export from My account → Export my data.
• Erasure — delete your account from My account → Danger zone. This permanently deletes your account, your children's profiles, and all practice data.
• Rectification— edit your children's profiles directly in the dashboard.
• Object to or restrict processing, and data portability — the export feature delivers your data in a machine-readable format you can re-use.
• Lodge a complaint with the ICO at ico.org.uk.

Third parties we share data with

We are a small operation. The only third parties involved are:

• Amazon Web Services(database, authentication, file storage and AI infrastructure). Your data is stored and processed in AWS's London (eu-west-2) region. AWS acts as a data processor under our agreement.
• Vercel(application hosting). Our application runs on Vercel's serverless platform in the London (lhr1) region, alongside our AWS data.
• Stripe(payments). When you start a subscription you enter your card details directly on Stripe's hosted pages. We never see or store your card details. Stripe is the data controller for payment data.
• Anthropic Claude, via Amazon Bedrock(the AI that powers “Show me how” hints, post-session reviews, and the parent progress report). We send only the question text, options, any figure description, and your child's year group. We never send your child's display name, your email, or any other identifying information to the model, and the request is processed within AWS in the EU/UK.

We do not share data with advertisers or marketing networks, and we do not sell your data.

Cookies and analytics

We use only strictly necessary cookies, which are exempt from consent under PECR:

• Authentication / session cookies — set by us as secure, HTTP-only cookies to keep you signed in. They are not readable by client-side scripts.
• Stripe cookies— set by Stripe on its own hosted pages when you go through checkout or the Customer Portal. These belong to Stripe; see Stripe's cookie notice.

For product analytics we use Vercel Analytics, which collects privacy-friendly, aggregated usage statistics (such as page views and performance) without using tracking cookies and without identifying you. We do not use advertising cookies, social-media tracking pixels, or any other tracking technology.

Children's privacy

ApexMaths is operated by adults on behalf of children. A parent or guardian creates and controls the account and all child profiles, and we deliberately minimise the data held about a child to a display name and an optional year group.

International transfers

Your data is processed in the United Kingdom and the European Economic Area. Where AWS, Vercel, or Stripe transfer data outside the UK/EEA, they do so under their own UK/EU adequacy decisions and standard contractual clauses.

Changes to this notice

If we update this notice we will change the date at the top. Material changes (for example, adding a new third party or a new category of personal data) will be notified to you by email before they take effect.