Privacy Policy

We are committed to protecting the privacy of our users, especially children. This policy explains what personal data we collect, why we collect it, and how we handle it — in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ICO's Age Appropriate Design Code (Children's Code).

1. Who Uses Eleventrance?

Eleventrance is designed for children preparing for the 11+ entrance exam (typically aged 9–11), with accounts created and managed by their parent or legal guardian. Throughout this policy, we refer to the parent or guardian as the "Account Holder" and the child as the "Learner."

2. What Data We Collect

Data about the Account Holder (parent/guardian)

• Full name
• Email address
• Payment information (processed securely by Stripe — we never see or store full card details)
• Account preferences

Data about the Learner (child)

We deliberately minimise the data we collect about children:

• Nickname (chosen by the parent — not the child's real name)
• Year group (e.g. Year 4, Year 5)
• Companion preference (Finn or Flora)
• Learning progress (modules completed, quiz scores, XP earned)

What we do NOT collect about children

• Full name
• Date of birth
• School name
• Photographs or images
• Location data
• Social media identifiers

3. Why We Collect This Data (Legal Basis)

4. Children's Privacy (ICO Children's Code)

We have designed Eleventrance with the ICO's Age Appropriate Design Code at its core:

Best interests of the child. Every design decision prioritises the child's wellbeing and educational benefit. The platform is designed to reduce exam pressure, not increase it.

Data minimisation. We collect only what is necessary for the service to function. We use a nickname rather than a real name, and we do not collect date of birth.

No profiling for marketing. We do not use children's data for marketing purposes, behavioural advertising, or profiling beyond what is necessary to provide adaptive learning features.

No detrimental use. Children's data is never sold, shared for advertising, or used in any way that could cause harm.

High privacy by default. The Learner profile is private. There are no social features, public profiles, leaderboards with other users, or any mechanism for children to share personal information.

Parental controls. The Account Holder (parent/guardian) has full visibility and control over the Learner's account, including the ability to view, modify, and delete all data.

No nudge techniques against the child's interest. The platform does not use dark patterns, pressure tactics, or manipulative design to keep children using the service against their best interests.

5. How We Share Data

We do not sell personal data to any third party. We do not share children's data with advertisers.

6. Where Data Is Stored

Data is stored on servers operated by our service providers. Some of these providers are based outside the UK. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) in compliance with UK GDPR.

7. How Long We Keep Data

• Active accounts: Data is retained for as long as the account is active.
• Cancelled accounts: Account data is deleted within 90 days of cancellation, unless we are required by law to retain it (e.g. financial records for HMRC, which are retained for 6 years).
• Waitlist data: Email addresses collected via the waitlist are retained until launch, then either converted to accounts or deleted within 30 days.

8. Your Rights

Under UK GDPR, you have the following rights:

• Access — Request a copy of the personal data we hold about you or your child.
• Rectification — Ask us to correct inaccurate data.
• Erasure — Ask us to delete your data ("right to be forgotten").
• Restriction — Ask us to limit how we use your data.
• Portability — Request your data in a structured, machine-readable format.
• Objection — Object to processing based on legitimate interest.

To exercise any of these rights, email us at hello@eleventrance.co.uk. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use a small number of cookies to operate the platform. See our separate Cookie Policy for full details.

10. Security

We take the security of your data seriously. Measures include:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Row-level security on the database (users can only access their own data)
• Secure authentication via Supabase Auth
• Payment data handled entirely by Stripe (PCI DSS compliant) — we never see or store card numbers
• Regular review of access controls

11. Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will notify Account Holders by email. The "last updated" date at the top of this page will always reflect the most recent version.

12. Contact Us

Email: hello@eleventrance.co.uk
Post: Eleventrance Ltd, 20 Norman Road, Sale, M33 3DF
ICO registration number: ZC125108