Privacy Policy

This page explains how Numera Maths ("we", "us") processes personal data on the Numera platform. It is maintained by the platform owner and is intended to satisfy the transparency requirements of UK GDPR, the Data Protection Act 2018, and the ICO's Age Appropriate Design Code (Children's Code).

1. Who we are

Numera Maths is the data controller for personal data processed through the Numera platform. To contact our data protection lead, email privacy@numeramaths.com.

2. What we collect

To deliver our service, we collect the following types of information:

• Account data: Name, email, role (student, parent, tutor, admin).
• Learning data: Worksheet assignments generated by the tutor, student attempts, answers, scores, and proficiency bands (the Mastery Matrix).
• Scheduling data: Availability slots, lesson bookings, and tutoring session notes.
• Billing data: Subscription plan, billing status, and Stripe customer/subscription references (we never see or store full payment card details).
• Operational data: Sign-in timestamps, IP address used for authentication requests, and basic device metadata to ensure service security.

3. Lawful basis

We process your data under the following lawful bases:

• Contract: For delivering the practice platform and progress tracking to the parent and student.
• Legitimate interests: For platform security, debugging, and fraud prevention.
• Consent: For processing the learning data of students under 18, and for any marketing emails sent to parents or tutors.
• Legal obligation: For tax, VAT, and accounting records relating to subscription payments.

4. Students and Parental Consent

Numera Maths is used by KS3 and KS4 pupils, the majority of whom are under the age of 18.

No Student Billing: Students cannot create billing accounts. All billing and parent account setups must be completed by an adult (parent or guardian).

Account Linking: A parent creates or approves their student's profile, linking it directly to their parent dashboard. By linking a student's profile, the parent provides consent for Numera Maths to process the student's learning data.

Withdrawing Consent: Parents can withdraw their consent at any time by emailing privacy@numeramaths.com. Upon request, we will deactivate the student's account and permanently delete their personal data in accordance with Section 8.

5. How Data is Protected and Shared

We enforce strict technical boundaries to keep student data private:

• Transit Security: All traffic is encrypted in transit over HTTPS/TLS 1.2+.
• At-Rest Security: Data is encrypted at rest by our database provider.
• Authentication Security: Passwords are never stored in plain text. They are salted and hashed with bcrypt by our authentication provider, and new passwords are automatically checked against the Have I Been Pwned breach database.
• Row-Level Security (RLS): Our database uses strict RLS policies. A student's records are strictly private and are only visible to:
  • The student themselves.
  • Their linked parent.
  • Their assigned tutor (who generates and reviews their worksheets).
  • Platform administrators (solely for essential technical support).
• Real-time Channels: Real-time sync channels require an active, authenticated user session.

6. Where Data is Stored

Personal data is stored in a managed PostgreSQL database hosted in the European Union (EU) by our infrastructure provider. Daily automated backups are taken and retained for 7 days, with point-in-time recovery available for the most recent 24 hours. Backups are encrypted at rest and stored in the same secure region as the primary database.

7. Sub-processors

We work with a select group of trusted sub-processors to run Numera Maths:

• Supabase (Hosting, database, and authentication) — EU Region.
• Stripe (Payment gateway) — Used securely to bill parent subscriptions.
• Cloudflare (Edge delivery, caching, and DDoS protection).
• Resend (Transactional email delivery for sign-ins, system notifications, and parent reports).

8. Your Rights

Under UK GDPR, parents, tutors, and students (or parents on behalf of their students) can exercise the following rights at any time:

• Access: Request a copy of all personal data we hold about you or your student ("subject access request").
• Rectify: Correct inaccurate or outdated data via your account settings.
• Erase: Request the permanent deletion of your account and all associated student data.
• Object/Restrict: Object to or restrict specific types of data processing.
• Withdraw Consent: Withdraw any previously given consent (e.g., for parents withdrawing consent for their student's account, or unsubscribing from marketing emails).
• Complain: Lodge a formal complaint with the UK Information Commissioner's Office (ico.org.uk).

To submit an export or deletion request, go to Settings → Privacy inside your dashboard. All requests are actioned within 30 days.

9. Retention

• Active Accounts: We retain your account and learning data while your account is active.
• Inactive Accounts: Accounts that show zero sign-in activity for 24 consecutive months are automatically and permanently deleted.
• Billing Records: In accordance with UK tax laws, billing and financial records are retained for 7 years after an account is closed, after which they are deleted.

10. Cookies

Numera Maths uses only essential cookies and local storage entries required to keep you signed in, secure your session, and keep the app working. We do not use advertising, tracking, or third-party analytics cookies.