Last updated: August 2026
iggylearn ("we", "us", "our") is an online educational platform providing worksheets, AI-assisted marking, and progress tracking for students in the United Kingdom. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), iggylearn is the data controller.
Questions or requests: hello@iggylearn.com. We aim to respond within 30 days.
| Category | Data collected | Who it relates to |
|---|---|---|
| Account data | Name, email address, hashed password, account role, date created | Owners, students, parents |
| Student profile | Year group, key stage, target grade, coin balance, streak, friend code | Students |
| Progress data | Worksheet scores, topics completed, time per session, dates of activity | Students |
| Written task data | Written answers, AI-generated marks and feedback, targets, follow-up tasks | Students |
| Payment data | Subscription status, plan type, Stripe customer ID. Card details are handled entirely by Stripe and never stored by iggylearn. | Owners |
| Communications | Email address used to send verification, password resets, and weekly reports | Owners, parents |
| Usage data | Server-side request logs (timestamps, endpoint). No third-party analytics used. | All users |
We do not collect sensitive personal data (UK GDPR Article 9) such as ethnicity, health information, religion, or political views.
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing the Service — accounts, login, worksheets, progress tracking | Contract |
| AI-assisted marking of written tasks | Contract |
| Weekly progress report emails to parents/carers | Legitimate interests |
| Account verification and password reset emails | Contract |
| Processing payments via Stripe | Contract |
| Security monitoring and fraud prevention | Legitimate interests |
| Complying with legal obligations (e.g. tax records) | Legal obligation |
Student accounts are created by the account holder (owner or tutor) on behalf of the student. By creating a student account, the account holder confirms they have obtained any consent required for that student's participation.
We do not use personal data for advertising, profiling, or any unrelated commercial purpose.
When a student submits a written task, the following data is sent to Anthropic's Claude API for marking purposes only:
No name, email address, or other identifying information is included. Anthropic acts as a data processor on our instructions. See Anthropic's privacy policy for how they handle API data. AI-generated results are stored on our servers and shown to the student and account owner only.
| Third party | Purpose | Privacy policy |
|---|---|---|
| Stripe | Payment processing. Stripe is an independent data controller for card data. | stripe.com/gb/privacy |
| Anthropic | AI marking via Claude API (data processor) | anthropic.com/privacy |
| Resend | Transactional email delivery (data processor) | resend.com/privacy |
| Railway | Cloud hosting and database infrastructure (data processor) | railway.app/legal/privacy |
We do not sell personal data. We do not share data for marketing. We do not use third-party analytics tools. We may disclose data where required by law or regulatory authority.
Some processors may transfer data outside the UK or EEA (for example, Anthropic's infrastructure is US-based). Where this occurs, we rely on Standard Contractual Clauses, the UK's International Data Transfer Agreement (IDTA), or adequacy decisions from the ICO. Contact us for details of the specific safeguards in place.
| Data type | Retention period |
|---|---|
| Account data | Active account duration + 2 years after closure |
| Student progress and worksheet data | Subscription duration + 1 year |
| Written task answers and AI feedback | Subscription duration + 1 year |
| Payment and subscription records | 7 years (HMRC / UK tax law) |
| Server logs | 90 days |
After the relevant retention period, data is securely deleted or anonymised. You may request earlier deletion — see Section 9.
Under UK GDPR, you have the right to:
To exercise any right, email hello@iggylearn.com with your name, registered email, and the right you wish to exercise. We will respond within 30 days and may need to verify your identity.
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. We would welcome the opportunity to address concerns before you contact the ICO.
To request deletion of your iggylearn account and all associated personal data, email hello@iggylearn.com with the subject "Account deletion request". We will process your request within 30 days.
Note: some data may be retained beyond deletion where required by law (e.g. payment records — see Section 8). Deleting an owner account will also delete all associated student accounts and data. We recommend saving any records you need before requesting deletion.
iggylearn does not use tracking cookies, advertising cookies, or third-party analytics cookies.
We use browser sessionStorage solely to maintain your login session while using the app. This is stored in your browser only, is never transmitted to third parties, and is cleared automatically when you close your browser tab.
Google Fonts (used for typography) may set functional cookies. These are not used for tracking or advertising.
In the event of a data breach likely to risk your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay.
iggylearn serves students of various ages. Student accounts are always created by an adult owner or tutor, never directly by the student. If you believe any student data has been collected without appropriate authority or consent, contact us at hello@iggylearn.com and we will address it promptly.
We may update this policy from time to time. Material changes will be communicated by email to account holders at least 14 days before they take effect. The "last updated" date above always reflects the most recent revision. Continued use after the effective date constitutes acceptance.
Email: hello@iggylearn.com
We aim to respond to all privacy-related queries within 30 days.