Privacy Policy

Who we are

Passmate (“we”, “us”) operates the website and service at passmate.ai. We are the data controller for the personal data described in this policy. You can reach us through the contact page.

Who this policy covers

• Parents and guardians who create an account, set up a child and read reports.
• Tutors who create an account, link to a family and read briefings.
• Children who practise on Passmate. A child never creates their own account. A parent or guardian sets them up and gives them access.
• Visitors to passmate.ai who have not signed up.

What we collect

From parents and tutors

• Account details: your email address and name. If you sign in with Google we receive your name, email address and Google account identifier from Google. We never see your password. Email sign-in uses a one-time link, so there is no Passmate password at all.
• Billing: if you subscribe, payment is taken by Stripe. Stripe holds your card details. We keep only your subscription status, plan and Stripe customer reference.
• Messages: anything you send us through the contact form or by email.

About a child

We collect the minimum needed to make practice useful and age-appropriate:

• First name (or a nickname), month and year of birth, and optionally the exam date and target schools the parent enters.
• Practice activity: which questions were shown, the answers given, how long each took, and how many attempts were needed.
• How they felt: the quick mood check at the start and end of a session.
• A PIN the child uses to open Passmate on their device.

We do not collect a child’s surname, email address, phone number, photo, school name or precise location. Children never see scores, and we do not show them advertising.

Automatically

• Cookies for signing in: essential cookies that keep you signed in. These cannot be switched off while using the service.
• Analytics: we use Google Analytics on the public website to understand how visitors use it, with IP addresses anonymised. We do not run analytics inside a child’s practice session.
• Error reports: if something breaks, a technical error report (page, browser type, and the error) is sent to Sentry so we can fix it.

How we use it

• To run practice sessions that adapt to the child’s level.
• To produce the reports and briefings that parents and tutors read, including the free insight report after the first session.
• To send account emails: sign-in links, child sign-in links, weekly reports.
• To take payment and manage subscriptions.
• To answer your messages.
• To keep the service secure and to fix problems.
• To improve Passmate. We look at practice data in aggregate to understand which questions work well and which do not.

We do not sell personal data. We do not send marketing to children. We only send marketing to parents and tutors who have agreed to it, and every email has an unsubscribe link.

Reports written with AI

The narrative in a child’s report is generated by an AI model from their practice data. To do this we send the model the child’s first name, age band and their answers and timings. We use Anthropic as our AI provider. Anthropic processes this data on our behalf under a data processing agreement and does not use it to train its models. We do not send the model any parent or tutor contact details.

Our legal basis

Under UK GDPR we rely on:

• Contract: providing the service you signed up for, including the practice sessions and reports.
• Legitimate interests: keeping the service secure, fixing errors, understanding how it is used and improving the questions. We have balanced these interests against the rights of children and the parents who use Passmate.
• Consent: marketing emails. You can withdraw consent at any time.
• Legal obligation: keeping billing records.

A parent or guardian must be 18 or over to create an account and is responsible for any child they add.

Who we share it with

We use a small number of trusted providers to run Passmate. Each processes data only on our instructions:

• Supabase for our database and sign-in.
• Vercel for hosting.
• Stripe for payments.
• Resend for sending email.
• Google for Google sign-in and website analytics.
• Anthropic for generating report narratives.
• Sentry for error monitoring.

Tutors and family. If a parent links a tutor to their child, the tutor can see that child’s practice data and briefings. Parents can remove a tutor at any time. If a parent shares a report using a share link, anyone who has the link can read that report.

Some of these providers store data outside the UK, mainly in the United States. Where that happens we rely on the UK International Data Transfer Addendum or the provider’s UK-approved safeguards.

We will disclose data if the law requires us to.

How long we keep it

• Account and child data: for as long as the account is open. If you delete your account, or ask us to, we delete the child’s profile and practice history within 30 days.
• Free-report accounts that never subscribe are deleted after 12 months of inactivity.
• Billing records: 6 years, as required by UK tax law.
• Messages to us: up to 2 years.

We may keep anonymised practice statistics (which say nothing about an individual child) indefinitely to improve the questions.

Your rights

You can ask us to show you the personal data we hold about you or your child, to correct it, to delete it, to restrict how we use it, or to give you a copy in a portable format. You can object to processing based on legitimate interests and withdraw consent at any time. Use the contact page and we will respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

Security

Data is encrypted in transit and at rest. Access inside Passmate is limited to the people who need it to run the service. Children sign in with a PIN on a link that only their parent has, and child accounts cannot be reached from the public website.

Changes

If we make a significant change to this policy we will email account holders before it takes effect. Minor changes will be reflected in the date at the top of this page.

Contact

Questions about privacy: use the contact page.