For adults: parents, carers, teachers and anyone learning on their own.
Privacy notice
For children and young people: Your privacy
The short version
- We keep as little as we can. We never ask for a date of birth, a photo, a home address, or anything about health or special needs.
- If you use Edlumo through a school or a tutor, they are in charge of your data. We look after it for them and follow their instructions.
- If you use Edlumo as a family, or on your own, we are in charge of your data.
- We never sell data and never show adverts. No other company may use it to train AI.
- We may learn from results with every name and detail taken out, so nobody can be identified, to make Edlumo better.
- Most data is kept in the UK. Some services we use keep data in the European Union or the United States, under safeguards UK law approves.
- You can see, download, correct or delete your data. Write to contact@edlumo.co.uk.
Who we are
Edlumo is a place for children to learn and practise, and for schools, teachers and guardians to help them.
In this notice, "we" and "us" mean Edlumo. You can write to us about anything in it at contact@edlumo.co.uk.
There is a shorter version for children and young people: privacy for young people.
Who is in charge of your data
The law calls the organisation in charge of personal data the "controller". The one that looks after it on their behalf is the "processor". Who is in charge depends on how you use Edlumo.
| How you use Edlumo | Who is in charge | What we are |
|---|---|---|
| Through a school or a group of schools | The school or the trust | Their processor |
| Through a tutor | The tutor | Their processor |
| As a family, with a parent’s account | Edlumo | The controller |
| On your own, aged 18 or over | Edlumo | The controller |
| On our waiting list or contact form | Edlumo | The controller |
If a school or a tutor is in charge, their own privacy notice comes first. Ask them about your data. If you ask us, we pass the question to them and tell you we have.
What we keep
About a child who practises:
- their first name and the first letter of their surname (the full surname only if their school chooses that)
- their school year, and their class if they are in one
- a username, and a PIN that we keep scrambled so nobody can read it, us included
- any changes that help them, such as larger text or a calmer screen. We keep the change, never the reason for it
- every answer they give, every mark, and which topics they have mastered
- if they are 13 or over and use their own sign-in: their email address and a scrambled password
About an adult: your name, email address, a scrambled password, your role (teacher, parent, tutor), and when you signed in.
About a teacher or a tutor, if you choose to answer: about how many hours a week marking, setting homework and recording marks took, before Edlumo and each week since. Your school’s leaders see only the total across everybody who answered, never split by person.
About someone who pays: the name and email address on the order, and what was bought. Stripe, the card company, holds the card. We never see the card number.
About someone on our waiting list or who uses our contact form: your email address, and anything else you choose to tell us — your name, your school, your message.
About every visit: the address of the page, your IP address and your browser. We use this to keep the service running and safe.
What we never keep
We do not ask for, and have nowhere to store: a date of birth, a photo, a home address, a pupil number from the school’s records, special educational needs, free school meals, health, ethnicity, religion, or anything else the law calls "special category" data.
When we ask for an age, we ask for the year you were born. We check it and throw it away. We only keep the fact that you said you were old enough, and when.
Children cannot send messages to anyone, and nobody can send messages to them. There is no chat, no public profile, and no place to post anything.
Why we use your data, and the law that allows it
Data protection law lets an organisation use personal data only for a reason the law accepts. The law calls this a "lawful basis". These are ours.
If you use Edlumo through a school or a tutor, they choose the lawful basis, because they are in charge of your data. For a school it is usually its public task of educating children. We use the data only as they tell us to.
If you use Edlumo as a family, on your own, or through our website, these are the reasons and the lawful basis for each:
| What we do | Why | Lawful basis |
|---|---|---|
| Make and run accounts, and let people sign in | So you can use what you asked for | Contract: the agreement you made with us when you opened the account |
| Give questions, mark answers, choose what comes next, and show progress | That is the service | Contract |
| Let a child under 13 practise in a parent’s or carer’s account | So the child can practise at home | Contract with the parent or carer, and their consent for the child |
| Let a young person aged 13 or over sign in with their own email address | So they can practise on their own | Their own consent, inside the account their parent or carer made |
| Take payment, and send receipts | To sell what you asked for | Contract |
| Send emails about your account, such as a sign-in link or a change to these terms | So you can use the service and know what changes | Contract |
| Book a session with a tutor | So you can have the help you asked for | Contract |
| Keep records of payments | Tax law says we must | Legal obligation |
| Answer you when you write to us | Because you asked | Legitimate interests: answering the people who contact us |
| Write to you from our waiting list | To tell you when we open for you | Consent, which you can take back at any time |
| Keep a record of visits, stop attacks and fix faults | To keep the service working and safe | Legitimate interests: keeping the service secure |
| Turn results into statistics that identify nobody, to improve questions, explanations and how we choose what comes next | To make Edlumo better for everyone who uses it | Legitimate interests: improving the service. Once the data identifies nobody, it is no longer personal data |
| Keep information we need if there is a dispute | To protect our rights and yours | Legitimate interests, or legal obligation |
Where we rely on legitimate interests, we have checked that our reason does not outweigh your rights. We never rely on it to decide anything about a child.
Where we rely on consent, you can take it back at any time, in your account or by writing to us. That does not undo what we did before.
How we choose the next question
We use a child’s answers to choose what they should practise next. The law calls this "profiling". We do it because it is what practising here means: without it, every child would get the same worksheet.
- It is worked out by fixed rules, not by AI. The same answers always lead to the same next question, so we can explain any question to a parent or teacher.
- It is only used to choose questions and to show the child and their adults how they are doing.
- It is never used for adverts, never shared, never sold, and never ranks one child against another.
- A teacher or tutor can change it.
- Deleting the child deletes it.
Nothing here makes a decision about a child that has a legal or similar effect on them.
AI
No AI makes or marks questions. Questions are made and marked by fixed rules.
In future, AI may help a teacher mark written answers, and help a teacher plan. A person will always check before anything counts. We will update this notice, and tell schools, before either is switched on.
No company we work with may use anyone’s data to train AI.
We may use results to build and improve our own tools, including our own AI models. We only do this with data that identifies nobody: every name, username, email address and detail that could point to a person is taken out first, and results are grouped so that no single child can be picked out.
For a school or a tutor, we do this only where our agreement with them allows it.
Where it is kept
The app and its databases run in London.
Some services we use keep data elsewhere: our logs are kept in the United States by Better Stack, and card payments are handled in the European Union and the United States by Stripe. The full list is on our page of who helps us.
Some of the companies we use are based in the United States. Where one of them could reach data from outside the UK, we rely on the safeguards UK law approves: the UK–US "data bridge", or the UK’s International Data Transfer Agreement.
How long we keep it
| What | How long |
|---|---|
| A school pupil’s data | As long as the school tells us. When a school deletes a pupil, it is gone for good after 7 days |
| A family’s or a learner’s account | As long as the account is open. When you close it, it is gone for good after 7 days |
| Records of payments | 6 years, as tax law requires. They name nobody once the account is closed |
| A record of visits | 90 days |
| Waiting list and contact form | Until you ask us to remove it, or until we have told you we are open and you have not joined |
| Backups | Up to 7 days after the original is deleted |
When we delete something, we really delete it. We keep only a note that a deletion happened, which names nobody.
How we keep it safe
- Every school has a database of its own. Families and learners share one, with every account walled off from the others.
- Passwords and PINs are scrambled so they cannot be read, even by us.
- Everything travels encrypted.
- Our own staff can only look at a school’s data when the school has a problem we need to fix. Two of us must agree, it ends after a set time, and the school can see every time it happened.
- If something goes wrong that puts your data at risk, we tell the person in charge of it straight away, and the Information Commissioner’s Office within 72 hours when the law says we must.
Your rights
You have the right to:
- ask what we hold about you, and get a copy
- have something wrong put right
- have your data deleted
- ask us to stop using it, or to use it less
- take it with you, in a file another service can read
- object to how we use it
- take back your consent, where we asked for it
A parent or carer can use these rights for their child. A young person can use them for themselves.
Families and learners can download everything and close their account themselves, in Your data in their account.
For anything else, write to contact@edlumo.co.uk. We answer within one month. It is free. If you use Edlumo through a school or a tutor, we pass your request to them, because they decide.
If you are not happy
Tell us first, at contact@edlumo.co.uk. We will say we have received it within 30 days, and try to put it right.
You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, at any time: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this notice
When we change this notice, we change the date at the top. If a change matters to how your data is used, we tell you before it happens: schools by email, and families and learners in their account.
Versions
| Version | In force from | What changed |
|---|---|---|
| 1.2 | 13 October 2026 | Our name is now Edlumo. No company line until the company is registered. |
| 1.1 | 11 October 2026 | Names the hours a teacher or tutor may choose to tell us about their week, and who sees them. |
| 1.0 | 7 October 2026 | First published. |
This page is in English. If it is ever translated, the English version is the one that counts.