Privacy Policy

What we collect

When you use Revision Aurora, we collect:

• Account data: your email address and password (password is stored by our authentication provider, Supabase, and never seen by us in plain text).
• Child profile data: your child's first name and exam year, which you enter yourself.
• Uploaded photos: pictures of your child's marked exam papers, including any correct/incorrect marks a parent has already made on them.
• Data derived from those photos: transcribed question text, which questions were marked wrong, and the knowledge points our AI suggests (and you confirm) for each one.
• Practice activity: AI-generated practice questions, your child's answers, and whether each was marked correct.
• Billing data: your subscription plan and status, handled by Stripe — we do not store your card details ourselves.
• Support data: anything you send us through the in-app feedback button, plus an optional contact detail if you choose to give one.
• Basic usage counts: how many uploads and AI regenerations your account has used in a given month, so we can apply plan limits fairly.

Why we process it, and on what legal basis

We process this data to provide the service you've signed up for: recognising marked mistakes in a photo, suggesting knowledge points, generating practice questions, tracking mastery over time, and billing your subscription. Our legal basis for this is that it's necessary to perform our contract with you (our Terms of Service), or — for basic anti-abuse and service-reliability checks — our legitimate interest in keeping the service usable and its running costs bounded.

We do not use your or your child's data for advertising, and we do not sell personal data to third parties.

How we use AI to process your data

When you upload a photo, we send it to Anthropic's Claude API to transcribe the marked questions and suggest knowledge points; when you request practice questions, we send the transcribed question text (not the photo) to the same API to generate them. Under Anthropic's standard commercial API terms, inputs submitted through the API are not used to train Anthropic's models unless a customer opts in — we have not opted in.

AI-generated content (knowledge point suggestions, practice questions and their answers) can be wrong. A parent confirms or corrects the suggested knowledge points before they're saved, and we recommend treating generated practice questions the same way — check them against what your child is actually expected to know.

Who else sees your data (subprocessors)

We share data with the following service providers, each acting as a data processor under our instructions, only to the extent needed to run the service:

• Supabase — hosts our database, file storage and login system. Data region: West EU.
• Anthropic — processes uploaded photos and question text through the Claude API, as described above.
• Stripe — processes subscription payments and stores your payment method; we never see your full card number.
• Resend — sends us (the operator) an email notification when you submit in-app feedback.
• Vercel — hosts the app and provides cookieless, aggregate usage analytics.

Some of these providers may process data outside the UK. Where that happens, we rely on legally recognised safeguards for the transfer, such as the UK's International Data Transfer Addendum or Standard Contractual Clauses.

How long we keep it

We keep your account's data for as long as your account is active. Uploaded photos are automatically deleted from storage 30 days after upload — the transcribed question text, knowledge-point links, mastery progress, generated practice questions and answer history aren't affected and stay in place, so long-term progress tracking keeps working after the photo itself is gone.

If you delete your account (Settings → Delete my account), we delete your uploaded photos (whether or not they've already passed the 30-day mark) and your account record straight away, which cascades the deletion of every record tied to it — children's profiles, uploads, transcribed questions, knowledge-point progress, generated practice questions, answer history, subscription and feedback records.

We don't currently have an automatic deletion schedule for the rest of an account's data when the account stays open but goes unused — if you'd like your data removed sooner than that, deleting your account (or emailing us) does it immediately.

Your rights

Under UK GDPR, you have the right to:

• Access a copy of the personal data we hold about you and your child.
• Correct inaccurate data — most of it (child's name, exam year) you can edit yourself in Settings.
• Erase your data — delete your account at any time from Settings; this removes everything, immediately and permanently.
• Receive your data in a portable, machine-readable format — the account-deletion flow in Settings offers to download a copy before you confirm, or you can email us to request one without deleting your account.
• Object to or restrict certain processing, and lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) if you think we've got something wrong.

To exercise any of these rights, use the relevant control in Settings, or email us at support@revisionaurora.co.uk.

Children's data

Revision Aurora is a tool for parents, not a service children sign up for themselves. A parent or guardian creates the account and enters their child's information; children do not create their own login or agree to these terms. We collect the minimum needed to run the service (first name and exam year — no date of birth, school name, or other identifying detail is required), don't use children's data for marketing or profiling beyond the mastery-tracking the service exists to do, and default every account to private, parent-only access (the optional parent PIN in Settings adds a further layer before answers can be checked).

Cookies and similar technologies

We use strictly necessary cookies/local storage for signing you in and remembering basic preferences (like your selected child and language). Our usage analytics (Vercel Analytics) is cookieless and doesn't track you individually. Because we don't use any non-essential tracking cookies, we don't show a cookie-consent banner.

Security

Uploaded photos are stored in a private file store that only your account can access. Every table in our database enforces row-level security so one account can never read another's data, even through a bug in our application code. You can also set an optional PIN (Settings) so a child can't see the correct answers before a parent checks their work.

Changes to this policy

We'll update this page if what we collect or how we use it changes, and update the date at the top. Material changes will be flagged in the app.

Contact

Questions about this policy or your data: support@revisionaurora.co.uk.