Privacy Policy

This privacy policy explains how Not The 11 Plus collects and uses personal information when parents, guardians, and children use our 11 Plus practice platform.

Not The 11 Plus is operated by [Company Name], registered in England and Wales under company number [Company Number], with its registered office at [Registered Address]. For privacy questions or data rights requests, contact notthe11plus@gmail.com.

1. Who this policy is for

Parents and legal guardians create and manage accounts. Children use the service as learners under the parent or guardian's account. Where we refer to “you”, we usually mean the parent or guardian account holder. Where we process information about a child learner, we explain that separately.

2. Information we collect

We collect the information needed to run the service, manage subscriptions, and keep accounts secure.

• Account information such as your email address, name, login details, and account preferences.
• Child learner information such as child account names and practice activity.
• Practice information such as generated tests, answers, scores, timestamps, completed tests, and question history used to avoid showing the same child the same question again.
• Billing information such as Stripe customer and subscription identifiers, plan status, invoices, and limited payment method details made available by Stripe. We do not store full card numbers.
• Technical information such as IP address, browser and device information, session timestamps, and security logs.
• Support information you send us if you contact us for help.

3. How we use information

We use personal information for the following purposes:

• to create and manage parent accounts and child learner profiles;
• to provide AI-generated 11 Plus practice tests and save progress;
• to keep each child's question history fresh and avoid repeated practice questions;
• to manage subscriptions, payments, billing support, and access to paid features;
• to provide support and respond to account, billing, or technical requests;
• to prevent misuse, account sharing, scraping, fraud, and unauthorised access;
• to understand service reliability and improve the product; and
• to meet legal, tax, accounting, and regulatory obligations.

4. Lawful bases

Under UK data protection law, we rely on different lawful bases depending on the purpose.

• Contract: to provide the service you sign up for, including accounts, practice tests, subscriptions, and support.
• Legitimate interests: to keep the service secure, prevent abuse, improve reliability, and understand how the product is used in a proportionate way.
• Legal obligation: to keep records needed for tax, accounting, dispute handling, and compliance.
• Consent: where we ask for optional consent, such as for non-essential cookies or marketing messages.

5. Children's information

The service is designed for parent-led 11 Plus practice. Parents or legal guardians are responsible for creating child learner profiles and deciding whether a child should use the service.

We ask for minimal child information. A child profile can use a first name, nickname, or other label chosen by the parent. We use child learner data to provide practice tests, track progress, keep question history unique to that child, and support parent-managed account access.

6. Account sharing and abuse prevention

Each subscription is for the parent or guardian and their child learner account use only. To protect the service, we record technical signals with test sessions, including IP address, browser or device information, and timestamps. We use this information to review unusual patterns such as multiple locations, round-the-clock activity, high-frequency use, scraping, or other misuse.

7. Where information is stored

Not The 11 Plus is hosted using Vercel and Supabase. Our Vercel application hosting and Supabase database are configured for UK hosting. We use Stripe for payments. Stripe may process payment and billing information in line with its own global infrastructure and legal safeguards.

Some suppliers may provide support, security, logging, or operational services from outside the UK. Where personal information is transferred internationally, we expect appropriate safeguards such as UK-approved contractual protections or equivalent measures.

8. Who we share information with

We do not sell personal information. We share information only where needed to run the service.

• Supabase, for authentication, database, and account storage.
• Vercel, for application hosting and delivery.
• Stripe, for checkout, subscriptions, invoices, and payment processing.
• Professional advisers, regulators, courts, or law enforcement where legally required.
• Support, security, or operations tools if we add them and they are needed to provide the service.

9. Cookies

We use essential cookies and similar storage to keep users signed in, maintain child sessions, remember sign-in preferences, and protect the service. These are needed for the service to work.

We do not currently use optional analytics or marketing cookies. If we add non-essential cookies, we will update this policy and ask for consent where required.

10. How long we keep information

We keep information only for as long as needed for the purposes in this policy, unless we need to keep it longer for legal, accounting, security, or dispute reasons.

• Account and child learner records are kept while the account is active.
• Practice history is kept while needed to provide progress tracking and question freshness.
• Billing and subscription records are kept as needed for tax, accounting, and dispute purposes.
• Security and anti-abuse records are kept while needed to protect the service and investigate misuse.
• Support messages are kept while needed to respond and maintain a record of the issue.

11. Your rights

Depending on the situation, you may have the right to access, correct, delete, restrict, object to, or receive a copy of your personal information. You may also withdraw consent where we rely on consent.

To make a request, contact notthe11plus@gmail.com. We may need to verify your identity before acting on a request, especially where the request relates to a child learner.

12. Complaints

Please contact us first if you have a concern, so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint/.

13. Changes to this policy

We may update this policy as the service changes. If we make a material change, we will take reasonable steps to tell account holders, such as by email or an in-product notice.