Privacy Policy

This Privacy Policy explains how Revizona collects, uses, shares and protects personal data when you use revizona.com and the Revizona learning service. It is written to meet the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”) and the Data (Use and Access) Act 2025.

If you are a parent or guardian, please also read our Children & Parents guide. It explains the same rules in a shorter, practical form.

1. Who we are

Revizona is operated by Revizona Ltd, a private limited company registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS] (“Revizona”, “we”, “us”). Revizona Ltd is the controller of your personal data: we decide why and how it is processed, and we are responsible for it.

Users in the EU/EEA. [CONFIRM: whether we accept users in the EU/EEA and, if so, appoint an EU representative under EU GDPR Art 27]

2. Scope

This policy applies to:

• students who create a Revizona account;
• parents and guardians who buy or manage a subscription for a student;
• visitors to our website and free blog, who do not need an account;
• anyone who contacts us for support, to complain or to exercise their rights, including rights holders who send a copyright notice and people who report a security issue.

It does not apply to websites or services run by others, even if we link to them. Our payment provider may process your data under its own privacy notice when you pay (see section 7).

3. The data we collect

We collect personal data in three ways: you give it to us, it is created when you use Revizona, or it comes from a provider that works for us (for example, confirmation that a payment succeeded). We do not buy personal data or collect it from social networks or data brokers.

Where we rely on legitimate interests, we have balanced our interests against yours, giving extra weight to the interests of students under 18. Where a parent holds the contract for a student, we process the student’s data on the basis of our legitimate interests in providing the service the parent has bought for them.

We do not ask for, and ask you not to give us, special category data (such as health, religion, ethnicity or biometrics) or criminal records data. Please do not put personal details in your answers. If you do, we treat them as learning data.

If you don’t give us data. We need account data, and for students under 18 a parent’s details, to provide the service. You can read the free blog without giving us any personal data beyond the technical data every website receives.

4. Children’s data

Most Revizona students are teenagers. We follow the ICO’s Age Appropriate Design Code (the “Children’s Code”) for every student under 18.

4.1 Age rules

• You must be at least 13 to use Revizona (13 is the UK age of digital consent under section 9 of the Data Protection Act 2018). We do not knowingly allow children under 13 to register. If we learn that a child under 13 has an account, we close it and delete their data.
• Students aged 13 to 17 may use Revizona, but a parent or guardian must buy the subscription and agree to the Terms of Service for them. A student’s account is not activated until this is done. If it is not done within 14 days of sign-up, we delete the pending registration. [CONFIRM: parent sign-up flow at launch]

4.2 How we treat children’s data

• High privacy by default. Under-18 accounts start on the most private settings. There are no public profiles, no leaderboards showing names, no chat and no user-to-user messaging. Students cannot see or contact each other.
• No profiling for advertising. We do not show ads, build advertising or marketing profiles, or share data with advertisers.
• No geolocation. We do not collect precise location. We may infer a country from an IP address for security and to show prices correctly; we do not store a location history.
• No nudge techniques. We do not use design tricks to push children to share more data, weaken their privacy settings or spend more time or money. Study reminders are off by default for under-18s.
• No marketing to children. We do not send marketing to students under 18.
• Age-appropriate information. Our Children & Parents page explains this policy in plain words for students.
• Data protection impact assessment. We assess the risks of processing children’s data before launch and keep it under review [CONFIRM: DPIA completed before launch].

4.3 What parents and guardians can see and do

A linked parent or guardian can:

• view the student’s progress, marks and topic mastery;
• ask for a copy of the student’s data, ask us to correct it or delete it, where acting for the student is appropriate (see section 11.3);
• cancel the subscription or close the student’s account.

Parents can do this from their parent account [CONFIRM: parent dashboard features available at launch] or by emailing [email protected].

Parents cannot see the content of support messages a student sends us about a safety concern if sharing it would put the student at risk. In that case we act in the student’s best interests.

4.4 Turning 18

When a student turns 18, the account becomes theirs alone. We tell the student and the parent in advance by email. From that date the parent’s access ends and the student manages their own data and settings. If a parent pays for the subscription, billing continues until either of them changes or cancels it.

5. AI marking

Revizona uses a rule-based marker for short, objective answers and an AI model to help mark written answers. When the AI model marks your answer:

• What is sent: the question, the mark scheme or marking guidance, and your answer (including any image of working you upload, where available), with a random internal reference so we can match the result to your attempt.
• What is not sent: your name, email address, date of birth, parent details or payment details.
• To whom: our AI provider, [AI PROVIDER], which processes the data in [AI PROVIDER LOCATION] on our behalf under a written contract.
• No training: our contract with the provider does not allow it to use our data to train or improve its models. It may keep inputs and outputs for a short period for abuse monitoring and security only.
• Human review: AI marks are estimates and can be wrong. You (or your parent) can ask for a human review of any AI mark using “report a mark” in the app or by emailing [email protected]. A member of our team with subject knowledge reviews it, normally within 5 working days, and we correct the mark if it is wrong.
• No automated decisions with significant effects: AI marks are study feedback only. They are not official exam results and do not predict grades. We do not use them for any decision with legal or similarly significant effects on you (UK GDPR Art 22), such as access to the service or pricing.

More detail is in our AI Marking page.

6. Other uses of data

6.1 Checking and improving our marking

To keep marking accurate, we look at answers, AI marks and human reviews together, for example to find a mark scheme that causes errors or to test a change before release. We use de-identified data wherever possible, and the results stay within Revizona.

We do not use students’ answers or other learning data to train or fine-tune any AI model, ours or a provider’s. If we ever want to, we will ask for separate, optional consent first (from the parent for students under 18), and saying no will not affect the service.

6.2 Compatible purposes

We also use personal data where compatible with the purposes above: to keep records the law requires, to protect users’ safety and our systems, and to establish, exercise or defend legal claims. If we want to use data for a new, incompatible purpose, we will tell you first and ask for consent where the law requires.

No sale of data. No ads. We do not sell, rent or trade personal data, show advertising, use advertising cookies or allow third-party trackers.

7. How we share data

7.1 Service providers (processors)

Our providers act only on our instructions under written data processing agreements, must keep data secure and confidential, and may not use it for their own purposes.

We will update this table before a new provider starts processing personal data, and tell you about significant changes as described in section 14.

Payments. [PAYMENT PROVIDER] collects your card or payment details directly. We never see or store full card numbers. For some activities (such as its own anti-fraud and anti-money-laundering duties) the payment provider is an independent controller under its own privacy notice.

7.2 Legal requests and safety

We disclose personal data to courts, regulators, police or other public authorities only where the law requires it or a request is lawful and properly made. We disclose only what is necessary and, where the law allows, tell the person affected. We may also share data where needed to protect someone’s life or safety, including where we believe a child is at risk of harm.

7.3 Business transfers

If Revizona Ltd is involved in a merger, acquisition, restructuring or sale of all or part of its business, personal data may transfer to the new owner. We will tell you before this happens, and the new owner must keep protecting your data under this policy or tell you about any changes and your choices.

7.4 Other sharing

We share data with professional advisers (such as lawyers, accountants and auditors) under duties of confidentiality, where needed. Otherwise we share personal data only if you, or for under-18s your parent, ask us to.

8. International transfers

Some of our providers process data outside the UK: our database host is in Singapore, and some providers process data in the US and other countries where their networks operate. When personal data leaves the UK, we protect it by:

• relying on UK adequacy regulations where they apply (for example, for the EU, and for US providers certified under the UK–US data bridge); or otherwise
• using the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment; and
• requiring security measures such as encryption in transit and access controls.

You can ask for details of the safeguards for a particular transfer by emailing [email protected].

9. Security

We protect personal data with measures appropriate to the risk, including:

• encryption in transit (HTTPS/TLS) and at rest by our database host;
• passwords stored only as secure hashes;
• access control on every request, so users see only their own data and parents only their linked student’s data;
• least-privilege staff access and multi-factor authentication on administrative accounts;
• logging and monitoring of security events;
• regular review of our providers and our own practices;
• staff confidentiality obligations and data protection training.

No system is completely secure. If you think you have found a security issue, see our Security page or email [email protected].

9.1 Personal data breaches

If a breach happens, we contain it, assess the risk and fix the cause. Where the law requires, we report it to the ICO within 72 hours of becoming aware of it, and tell affected people without undue delay if it is likely to result in a high risk to them. If a student under 18 is affected, we also tell their parent. We keep a record of every breach, reported or not.

10. Retention summary

We keep personal data only as long as we need it for the purposes in this policy or the law requires:

• Account, parent and learning data: while the account is open. When an account is closed, we delete or anonymise this data within 30 days; backups are overwritten within a further 35 days.
• Record of a parent’s agreement to the Terms: 3 years after the student’s account closes.
• Payment and tax records: 6 years after the end of the relevant financial year.
• Support and complaints: 2 years after closure; rights-request records 3 years.
• Logs and error reports: up to 30 and 90 days.
• Inactive accounts: if an account has no sign-ins and no active subscription for 24 months, we email the account holder (and the parent, for under-18s) and, if they do not respond within 30 days, close the account and delete the data.

We may keep data longer if needed for a legal claim, an investigation or a regulator’s request, and only while that need lasts. Aggregated statistics that do not identify anyone may be kept longer.

11. Your rights

11.1 What you can ask for

Under UK GDPR you have the right to:

1. Be informed about how we use your data (this policy).
2. Access your data and get a copy.
3. Rectification: correct inaccurate or incomplete data.
4. Erasure: have your data deleted.
5. Restriction: limit processing in certain circumstances, for example while we check a correction.
6. Data portability: receive your data in a structured, machine-readable format, or have it sent to another controller where technically feasible.
7. Object to processing based on legitimate interests, and to direct marketing at any time.
8. Rights about automated decisions: not to be subject to decisions based solely on automated processing with legal or similarly significant effects. We do not make such decisions (section 5), and you can always ask for a human review of any AI mark.
9. Withdraw consent at any time where we rely on consent, without affecting processing already done.

11.2 How to exercise them

• Use your account settings (for example, to download your data or delete your account).
• Email [email protected], or [email protected] if you are a parent or guardian.
• Write to Revizona Ltd, [REGISTERED OFFICE ADDRESS].

Requests are free. We may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and we will explain why.

11.3 Verification, and requests about students

We need to confirm that a request comes from you or someone with authority to act for you. Usually we ask you to send it from the email address on the account or to confirm it while signed in. We ask only for what we need and delete it once verification is complete.

Students aged 13 to 17 can exercise their own rights. A parent or guardian can act for a student where that is appropriate, for example where the student agrees or it is clearly in the student’s best interests. Where a parent and student disagree, we act in the student’s best interests.

11.4 Response times

We respond within one month of receiving a request (or of verifying your identity, if we need to). For complex or numerous requests we may extend this by up to two further months; if so, we tell you within the first month and explain why. If we cannot fully meet a request (for example, because we must keep payment records by law), we explain why.

12. Complaints

If you are unhappy with how we handle personal data, please complain to us first so we can put it right:

1. Revizona: email [email protected] or [email protected], or follow our Complaints procedure. We acknowledge complaints within 2 working days and aim to resolve them within 14 days.
2. The Information Commissioner’s Office (ICO): if you are not satisfied with our response, you can complain to the ICO at ico.org.uk or on 0303 123 1113.

You can also seek a remedy through the courts, including compensation for loss caused by a breach of data protection law.

13. Marketing

Under PECR, we send marketing emails only to adults (including parents) who have opted in, and every message has an unsubscribe link. We never send marketing to students under 18. Service messages such as receipts, renewal reminders, security alerts and policy changes are not marketing.

14. Changes to this policy

The “updated” date at the top shows when this policy last changed. If we make a significant change, such as a new purpose, a new category of data or a new type of recipient, we will tell account holders (and parents of under-18 students) by email or in the app at least 30 days before it takes effect, unless a shorter time is needed by law or to address a security risk. Where a change needs new consent, we will not apply it to you until we have it.

15. Contact us

• Data requests: [email protected]
• Data Protection Officer: [DPO NAME], [email protected]
• Parents and child safety: [email protected]
• General support: [email protected]
• Post: Revizona Ltd, [REGISTERED OFFICE ADDRESS]

Related pages: Terms of Service, Cookie Policy, Children & Parents, AI Marking, Security, Complaints.