Privacy Policy

Last updated: 29 April 2026

This Privacy Policy explains how STUDYDEN LTD ("StudyDen", "we", "us", or "our") collects, uses, discloses, and safeguards your information when you use our website, platform, and services (collectively, the "Service"). It is written for UK families and is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is:

• STUDYDEN LTD, a private limited company registered in England and Wales
• Company number: 17180776
• Registered office: 1 Melbreak Grove, Middlesbrough, TS5 8PP, England
• Contact for data protection matters: support@studyden.co.uk

STUDYDEN LTD is registered with the UK Information Commissioner's Office (ICO) under registration number ZC135433.

2. Information We Collect

• Account information: when a parent or guardian signs up, we collect name, email address, and password. For child accounts, we collect the child's first name and year group as provided by the parent or guardian.
• Profile and usage data: lesson progress, quiz and assessment results, preferences, and activity logs.
• Payment information: if you subscribe, payment details are processed securely by Stripe. We do not store your full payment card details on our servers.
• Communications: if you contact us, we collect your email address and any other information you provide.
• Cookies and analytics: we use cookies and similar technologies to operate the Service, remember your preferences, and analyse usage. We may use third-party error monitoring tools (such as Sentry) to improve performance and security.
• AI interactions: when a child uses the Luna AI assistant, the messages and related lesson context are processed by our AI provider (Anthropic) to generate responses. See Section 7 below.

3. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR Article 6:

• Contract — to deliver the Service you have subscribed to (account management, lesson delivery, progress tracking, billing).
• Legitimate interests — to keep the Service secure, prevent abuse, and improve our product. Where we rely on legitimate interests, we have balanced these against your rights and freedoms.
• Consent — for non-essential cookies and any optional marketing communications. You can withdraw consent at any time.
• Legal obligation — to retain billing records for UK tax law (HMRC).

Special category data (UK GDPR Article 9). StudyDen offers educational content as a curriculum, including subjects such as Islamic Religious Education and other Religious Education. We do not collect or seek information about your or your child's religious or philosophical beliefs. However, where you choose to enable a subject whose subject matter relates to religion (such as Islamic RE), your selection of that subject may indirectly indicate religious or philosophical context. To the extent any such processing falls within Article 9 UK GDPR, we rely on your explicit consent under Article 9(2)(a), given when you enable that subject for your child and accept this Privacy Policy. You can withdraw this consent at any time by removing the subject from your child's profile or by contacting us.

4. How We Use Your Information

• To provide, operate, and maintain the Service
• To personalise the experience and adapt content for each child
• To process payments and manage subscriptions
• To communicate with you about your account, updates, and support
• To monitor, analyse, and improve the Service
• To ensure the safety and security of users, including children
• To comply with legal obligations

5. Sub-processors

We use the following sub-processors to deliver the Service. Each is bound by a data processing agreement and processes your data only on our instructions.

We may add or change sub-processors as the Service evolves. Material changes will be reflected in this page and the "Last updated" date.

6. Children's Data and Parental Consent

StudyDen is designed for primary-age children using the Service under parental supervision. We take the protection of children's data seriously and apply additional safeguards in line with UK GDPR Article 8 and the ICO's Age Appropriate Design Code (the "Children's Code").

• Parental control: only a parent or legal guardian (aged 18 or over) may create a StudyDen account and set up child profiles. The parent is the account holder and exercises data rights on behalf of any child under 13.
• Source of children's data: in line with UK GDPR Article 14, we let you know that a child's personal data is provided to us by the parent or guardian who creates and supervises the account, not by the child directly.
• Minimal data: for each child we collect only what is needed to deliver lessons — first name and year group. We do not collect a child's email, address, phone number, or photo.
• No advertising: we do not show advertising to children, and we do not sell or share children's data for marketing purposes.
• No profiling for marketing: we do not build behavioural profiles of children for advertising or commercial purposes. Lesson personalisation is used only to adapt the next lesson's content and pace.
• Safeguarding: Luna AI interactions are filtered in real time for inappropriate content (both child input and AI output). We have processes in place to respond to concerns raised by parents.
• Data Protection Impact Assessment: we maintain a Data Protection Impact Assessment (DPIA) for the Service in line with Standard 2 of the Children's Code, which we keep under review as the Service evolves.

If you believe a child has provided us with personal information without parental consent, please contact us at support@studyden.co.uk and we will delete it.

7. Luna AI — How Children's Inputs Are Processed

Luna is the in-lesson AI helper provided by StudyDen. When a child sends a message to Luna:

• The child's message and minimal lesson context (e.g. which lesson is open) are sent to Anthropic, our AI provider, for processing in the United States.
• Per Anthropic's commercial API terms, this data is not used to train Anthropic's AI models.
• Anthropic may retain interaction data for a short period in line with their then-current API data-handling policies for trust-and-safety and abuse-monitoring purposes only, after which it is deleted from their systems. Anthropic's current policy is published at privacy.claude.com.
• We log Luna conversations in our own database for safeguarding purposes and so that parents can request to see what their child has asked. To request a copy of your child's Luna conversations, email support@studyden.co.uk. These logs are deleted when an account is deleted (see Section 9).
• We do not use Luna conversations for advertising, profiling, or training third-party models.

8. International Data Transfers

Most of your data is stored in the United Kingdom (Supabase, London region). Some processing takes place outside the UK — in particular, AI processing by Anthropic and parts of payment and hosting infrastructure (United States). Where personal data is transferred outside the UK, we rely on lawful transfer mechanisms approved by the UK government, primarily the European Commission Standard Contractual Clauses together with the UK Information Commissioner's International Data Transfer Addendum. Where a sub-processor is certified under the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework), that certification may also apply. In each case we apply appropriate technical and contractual safeguards.

9. How Long We Keep Your Data (Retention)

• Active accounts: we retain your account and child data for as long as the account is active.
• After cancellation or deletion: we delete personal data associated with the account within 30 days of cancellation or a verified deletion request, except where we are legally required to retain certain records.
• Billing and tax records: we retain a minimum set of billing records for 6 years to comply with UK tax law (HMRC).
• Backups: deleted data may persist in encrypted backups for a short additional period before being overwritten on the standard backup rotation.
• Anonymised data: we may retain fully anonymised, aggregated data (which cannot be linked back to you or your child) indefinitely for product improvement.

10. Data Security

We implement appropriate technical and organisational measures to protect your information, including encryption in transit (TLS), encryption at rest, access controls, and audit logging. However, no system is completely secure. We encourage you to use a strong password and keep your login credentials confidential.

11. Your Rights

Under UK GDPR you have the following rights. You can exercise any of these by emailing support@studyden.co.uk. We will respond without undue delay and in any event within one month, as required by Article 12(3) UK GDPR.

• Access — request a copy of the personal data we hold about you or your child.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — ask us to delete your account and associated data. On a verified request we run our automated deletion process, which removes account, child, lesson progress, Luna conversation, and subscription data, and cancels any active Stripe subscription. Deletion completes within 30 days, subject to the legal retention exceptions in Section 9.
• Restriction — ask us to limit how we use your data in certain circumstances.
• Portability — request a machine-readable copy of data you have provided to us.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where we rely on consent (e.g. marketing emails or special-category subjects under Section 3), you can withdraw it at any time.
• Lodge a complaint — you have the right to complain to the UK Information Commissioner's Office (see Section 15).

Parents and guardians may exercise any of these rights on behalf of their child.

Automated decision-making. We do not make decisions about you or your child that produce legal or similarly significant effects based solely on automated processing within the meaning of Article 22 UK GDPR. Lesson personalisation adapts the next lesson's content but does not produce such effects.

12. Cookies

We use cookies and similar technologies for essential functionality, to remember your preferences, and to analyse usage. You can control cookies through your browser settings or our cookie banner. Disabling essential cookies may affect your experience.

13. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. Please review their privacy policies before providing any information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

15. How to Complain

If you have a concern about how we handle your data, please contact us first at support@studyden.co.uk so we can try to put it right. You also have the right to complain to the UK supervisory authority:

• Information Commissioner's Office (ICO)
• Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk

16. Contact Us

For any questions about this Privacy Policy or your data, please contact us at support@studyden.co.uk.