Privacy Policy
Last updated: 27 September 2026
1. Who we are
Studoo is operated by Frsh Labs Ltd, a company registered in England and Wales under company number 16882724, whose registered office is at 128, City Road, London, EC1V 2NX, United Kingdom ("Studoo", "we", "us"). We are registered with the Information Commissioner's Office (ICO) under registration number ZC182957.
This policy explains how we collect, use, share and protect personal data when you use Studoo. We have written it for parents, tutors and older students. We also provide a short, child-friendly summary in section 7.
For questions about this policy or your data, email support@studoo.co.uk.
2. Whose data this policy covers, and our role
- Families (parents, guardians and their children) with their own Studoo account: we are the data controller.
- Tutors and tuition centres: we are the controller for tutors' own account and billing data.
- Students enrolled by a tutor: the tutor or tuition centre is the controller for student data in their account, and we process it on their behalf as a processor. If your child uses Studoo through a tutor, please contact the tutor first about that data. We will help them respond.
- Website visitors: we are the controller.
3. Data we collect
Account information
- Parent and tutor name, email address and login details (including via Google Sign-In, if used).
- Child's display name and year group.
- For tutors: business name, tutor logins, cohorts and class lists.
Learning and behavioural data
- Questions answered, answers given, accuracy, time spent and progress over time.
- Behavioural signals that show how a child approaches questions, including answer speed, "not sure" selections, confidence, answer changes and patterns of common trap-style errors.
- XP, streaks and other gamification data.
- For tutor accounts: attendance, feedback, assignments, marks and paper-test results entered by the tutor.
Payment information
- Stripe processes payments. We receive limited information such as your plan, payment status and the last four digits of your card. We do not store full card details.
Communications
- Emails and support messages you send us.
Technical data
- Device type, browser, IP address and logs needed to run and secure the service. See our Cookie Policy.
We do not ask for, and ask users not to enter, special category data such as health or medical information.
4. How we use data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating and running accounts and providing the Service | Contract with the parent or tutor |
| Personalising practice and generating progress reports, behavioural insights and action plans | Contract with the parent or tutor |
| Taking payments and managing subscriptions | Contract; legal obligation (tax and accounting records) |
| Sending service emails (e.g. trial and renewal reminders, account notices) | Contract; legal obligation |
| Keeping the Service secure and preventing misuse | Legitimate interests |
| Improving the Service, questions and analytics using de-identified or aggregated data | Legitimate interests |
| Optional website analytics | Consent (you can withdraw at any time) |
| Marketing emails to parents and tutors | Consent, or legitimate interests for existing customers (you can opt out at any time) |
| Responding to legal claims or requests from authorities | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have considered the balance with your rights, taking extra care because our users include children. You can ask us for more information about this.
5. Behavioural insights, profiling and AI
5.1 Studoo analyses how a child answers questions to identify patterns, such as rushing, hesitation or particular types of mistakes. This is a form of profiling. We use it only to give parents and tutors educational guidance.
5.2 We do not make any decisions based solely on automated processing that have legal or similarly significant effects on anyone. Insights and action plans are suggestions for a parent or tutor to consider, not diagnoses or assessments.
5.3 Where a tutor turns on Ask Studoo, written replies are generated by the AI provider that tutor chooses (Anthropic, OpenAI or Google) using the tutor's own API key. That key is stored encrypted. The request sent to the provider is limited to what is needed to answer, and use of the provider is governed by the tutor's agreement with them. We do not use student data to train Studoo's own models.
6. Who we share data with
We do not sell personal data and we do not show advertising to children.
We share data only with:
- Service providers (sub-processors) that help us run Studoo:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and storage | The region configured for our Supabase project |
| Vercel | Website hosting and optional analytics | USA / global edge network |
| Optional website analytics (Google Analytics), only if you accept cookies | USA / Ireland | |
| Stripe | Payments | UK / EU / USA |
| Resend | Service emails | USA |
| Anthropic, OpenAI or Google | Tutor-enabled Ask Studoo replies, using the tutor's own API key | USA, or as set by that provider |
- Parents and guardians: who can see their child's learning data.
- Tutors: where a child is enrolled by a tutor, the tutor can see the child's learning data in their account. If a parent links a family account to a tutor, we will make clear what the tutor can see.
- Authorities: where we are required by law, or need to protect a child's safety.
- A buyer of our business: if Studoo is sold or restructured, subject to this policy.
7. Children's privacy
Studoo is used by school-age children, from primary school through sixth form. Family practice is often used by children aged about 8 to 11. Tutor accounts may include older students. Where the service is likely to be accessed by children, we follow the ICO's Age Appropriate Design Code (Children's Code). In practice this means:
- a parent, guardian or tutor sets up children's access, and parents or guardians must agree to children under 13 using Studoo;
- we collect only the data we need to provide the learning service;
- children's settings are private by default, and there are no public profiles or chat between students;
- we do not use children's data for advertising or sell it; and
- we explain things in simple language.
Summary for children: Studoo keeps track of the questions you answer and how you answer them, so we can help you practise the right things. Your parent, and your tutor if you have one, can see how you are doing. We keep your information safe and we never sell it. If you have a question, ask your parent or tutor to talk to us.
8. International transfers
Some of our providers process data outside the UK, including in the USA. Where this happens, we use appropriate safeguards, such as UK adequacy regulations (including the UK-US Data Bridge where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
9. How long we keep data
| Data | How long we keep it |
|---|---|
| Account and learning data | While the account is active. Deleted within 30 days of account closure. |
| Tutor account data (including student data held for a tutor) | While the tutor account is active, plus a 30-day export period after closure, then deleted. |
| Billing and payment records | 6 years, as required for tax and accounting. |
| Support emails | Up to 2 years after the enquiry is resolved. |
| Backups | Deleted data is removed from backups within 90 days of deletion from the live service. |
| De-identified or aggregated data | May be kept indefinitely, as it does not identify anyone. |
10. How we protect data
We use encryption in transit and at rest, secure authentication, access controls and the principle of least privilege. We regularly review our security and our providers. If a personal data breach occurs that is likely to put you at risk, we will tell you and the ICO as required by law.
11. Your rights
Under UK data protection law, you have the right to:
- access your personal data;
- correct inaccurate data;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data based on legitimate interests, and to direct marketing at any time;
- receive your data in a portable format; and
- withdraw consent at any time, where we rely on consent.
Parents and guardians can exercise these rights on behalf of their children. To make a request, email support@studoo.co.uk. We will respond within one month. If your child's data is held through a tutor's account, we will pass your request to the tutor and help them respond.
12. Complaints
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.
13. Cookies
We use essential cookies for sign-in, security and site delivery. Optional analytics (Google Analytics and Vercel Web Analytics) is only loaded if you accept it. See our Cookie Policy for details and to change your choice.
14. Changes to this policy
We may update this policy. We will change the "Last updated" date and, for significant changes, tell account holders by email or in the Service.
15. Contact us
- Email: support@studoo.co.uk
- Post: Frsh Labs Ltd, 128, City Road, London, EC1V 2NX, United Kingdom
© 2026 Studoo. All rights reserved.