Privacy Policy

1. Introduction and Data Controller

Welcome to Sumly. We are committed to protecting the privacy of every person who uses our service — particularly children. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Sumly

Contact: privacy@sumly.app

2. What Data We Collect

Parent and Teacher Accounts

When you register as a parent or teacher, we collect:

• First name
• Email address
• Password (stored as a secure hash via AWS Cognito — we never store your plain-text password)

Student Accounts

Student profiles are created by a parent or teacher on behalf of a child. We collect:

• First name
• Year group
• Age

Practice Data

As a student completes practice sessions, we record:

• Answers submitted
• Scores and performance metrics
• Difficulty level of questions
• Timestamps of sessions

AI Question Generation

Questions are generated using AWS Bedrock. When a question is generated, we send only:

• The student's year group
• The selected maths topic

No names, email addresses, or other personal data are ever sent to the AI model.

Analytics Data (Optional)

If you give your consent, we use Google Analytics to collect anonymised usage data such as pages visited and session duration. This data is linked to a randomly assigned identifier, not to your name or email. You can withdraw consent at any time via the cookie banner.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Generating practice questions — to produce maths questions appropriate to the student's year group and chosen topic.
• Tracking progress — to record scores and performance over time so students and parents can monitor improvement.
• Generating progress reports — to produce readable summaries of a student's strengths and areas for improvement.
• Account management — to authenticate users and manage account access securely.
• Improving the service — to understand how Sumly is used (via aggregated, anonymised analytics) and to fix bugs or improve features.

We rely on the following legal bases under UK GDPR:

• Contract — processing necessary to provide the service you have registered for.
• Legitimate interests — improving and securing our service, where these interests are not overridden by your rights.
• Consent — for optional analytics cookies (see Section 4).

Where we process a child's data, we do so on the basis that the parent or teacher has provided consent on behalf of the child when creating the student profile.

4. Cookies and Local Storage

Essential Storage

Sumly stores the following data in your browser's localStorage:

• Authentication tokens — issued by AWS Cognito after login, used to keep you signed in. These are not HTTP cookies and are not transmitted to third parties.
• Cookie consent preference — your choice about analytics cookies, so we do not ask again on every visit.

This storage is essential for the service to function and does not require your consent under UK GDPR.

Analytics Cookies (Optional)

With your consent, we enable Google Analytics, which sets cookies to collect anonymised information about how visitors use Sumly. No personally identifiable information is shared with Google via Analytics. You can accept or decline analytics cookies using the banner shown on your first visit, and you may change your preference at any time.

5. Children's Data

Sumly is designed for use by children and we take our responsibilities under the UK Age Appropriate Design Code (Children's Code) very seriously. The following principles guide how we handle children's data:

• Minimal data collection — we collect only what is necessary to provide the educational service (first name, year group, and age).
• No advertising or profiling — we do not use children's data for advertising, behavioural profiling, or any commercial purpose beyond delivering the practice service.
• No social features — Sumly has no public profiles, social feeds, or features that expose children's data to other users outside their family or class.
• Parental consent — student accounts can only be created by a parent or teacher who has registered and agreed to this Privacy Policy on behalf of the child.
• No AI profiling of children — as noted in Section 2, only year group and topic are sent to the AI model; no personal data about the child is shared.

6. Data Sharing

We do not sell your personal data. We do not share it for marketing purposes. We share data only with the following third-party processors, under strict data processing agreements:

• Amazon Web Services (AWS) — provides cloud infrastructure including authentication (Cognito), database storage (DynamoDB), and AI question generation (Bedrock). Data is processed in the EU (see Section 9).
• Google Analytics — if you have consented to analytics cookies, Google will process anonymised usage data. See Section 4 for details.

We may disclose data if required to do so by law or in response to a valid request from a public authority.

7. Data Retention

We retain personal data for as long as your account is active. If you delete your account — or request erasure — we will delete your personal data and all associated student profiles and practice records within a reasonable timeframe (typically 30 days).

To request deletion of your account and data, please email privacy@sumly.app.

8. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) — you can ask us to delete your personal data in certain circumstances.
• Right to restriction — you can ask us to restrict how we process your data in certain circumstances.
• Right to data portability — you can request your data in a structured, machine-readable format.
• Right to object — you can object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent (e.g. analytics cookies), you can withdraw at any time without affecting lawfulness of prior processing.
• Right to complain — you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

To exercise any of these rights, please contact us at privacy@sumly.app. We will respond within one calendar month.

Parents and teachers may exercise rights on behalf of the children whose accounts they manage.

9. International Data Transfers

Your data is stored and processed on AWS infrastructure in the eu-north-1 (Stockholm, Sweden) region, which is within the European Economic Area (EEA). The UK has recognised the EEA as providing an adequate level of data protection, so no additional transfer safeguards are required for this processing.

If you consent to Google Analytics, data may be processed by Google on servers outside the UK/EEA. Google relies on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal mechanism for such transfers. For further information, see Google's Privacy Policy.

10. Security

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

• HTTPS — all data in transit is encrypted using TLS.
• Encryption at rest — data stored in DynamoDB and other AWS services is encrypted at rest.
• Password hashing — passwords are never stored in plain text; AWS Cognito handles authentication with industry-standard hashing algorithms.
• Access controls — access to production data is restricted to authorised personnel only.

Despite these measures, no system is completely secure. If you believe your account has been compromised, please contact us immediately at privacy@sumly.app.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page will always reflect when it was last revised.

For any material changes — such as collecting new categories of data or processing data for new purposes — we will notify registered users by email before the changes take effect.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your data, please get in touch:

Email: privacy@sumly.app

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):