Privacy Policy

1. Introduction

Welcome to BrainBuzz ("we," "our," or "us"). We operate www.brainbuzz.co.uk and are committed to protecting the privacy of all our users, especially children. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

Data Controller: BrainBuzz is the data controller responsible for your personal data.

Contact: For privacy questions or concerns, email us at [email protected]

2. Information We Collect

BrainBuzz is designed with privacy in mind. We collect minimal information to provide our educational services.

2.1 Information Stored Locally on Your Device

Game Progress & Scores: When pupils play activities, their progress and scores are saved directly to their device's local storage (browser storage). This data:

• Never leaves the device
• Is not sent to our servers
• Can be deleted at any time by clearing browser data
• Allows pupils to track their personal improvement
• Contains no personally identifiable information

2.2 Mailing List Subscriptions

If you voluntarily subscribe to our mailing list, we collect:

• Email Address: Required for sending updates
• First Name: Optional, used for personalization
• Subscription Date: When you signed up

Purpose: We use mailing list data solely to:

• Send notifications about new activities and features
• Share updates about BrainBuzz
• Communicate important information about the service

Your Rights: You can unsubscribe at any time using the link in any email, or by contacting us at [email protected]. We will delete your information within 48 hours of your request.

2.3 Cookies and Analytics

We use cookies and similar technologies to improve your experience:

Essential Cookies: Required for the website to function properly, including:

• Cookie consent preferences
• Session management
• Security features

Analytics Cookies: With your consent, we use analytics services to understand how visitors use our site:

• Pages visited and time spent
• Device type and browser information
• General geographic location (country/region only)
• Referral sources

Analytics data is anonymized and helps us improve BrainBuzz. You can manage cookie preferences at any time through our cookie settings.

2.4 Advertising Data

We may display advertisements through third-party advertising networks. These services may use cookies to:

• Serve age-appropriate advertisements
• Measure ad effectiveness
• Prevent excessive ad repetition

We ensure all advertisements displayed on BrainBuzz are:

• Appropriate for children and families
• Comply with COPPA and other child protection regulations
• Do not collect personal information from children
• Screened for educational appropriateness

Advertising partners have their own privacy policies. We recommend reviewing their policies to understand how they handle data.

2.5 Mental Maths — Teacher Registration & Subscription

Access to BrainBuzz Mental Maths requires schools and individuals to register for a paid annual subscription. When you register and subscribe, we collect:

Data	Required?	Why we collect it
First name & surname (admin)	Yes	To identify the account administrator and personalise your experience
Admin email address	Yes	Login credential for the admin dashboard; used for account and subscription communications
School name	Yes (schools) / No (individuals)	Identifies the subscribing organisation; used on invoices
School email domain	Yes (schools)	Used to prevent duplicate school registrations
Billing email address	Yes	The email address Stripe invoices are sent to (may be a bursar or finance contact)
Teacher seat names & email addresses	No	Added voluntarily by the school admin; used to send login notifications to individual teachers
Number of seats purchased	Yes	Determines the invoice amount and access limit
Subscription status & dates	Automatic	Used to control access and send renewal invoices
Terms acceptance date & version	Automatic	Records that the account holder agreed to these Terms and Conditions
Test usage logs	Automatic	Records which tests were run and when, to support usage reporting and service improvement
Registration date & last login	Automatic	Account management and security

Lawful basis: Processing is necessary to perform the subscription contract (Article 6(1)(b) UK GDPR). Usage logging is based on our legitimate interests in improving the platform (Article 6(1)(f)). Terms acceptance recording is based on our legitimate interest in demonstrating compliance.

Payment processing: Payments are handled by Stripe, Inc. BrainBuzz does not store card details or bank account information. When an invoice is paid, Stripe notifies us and we activate your subscription. Stripe's privacy policy is available at stripe.com/gb/privacy.

What we do not do: We will never sell, share, or rent your registration data to any third party. It is used solely to provide and improve the Mental Maths service.

How teacher sessions are stored: When a teacher logs in via their OTP email link, their seat ID is saved in the browser's local storage. This means they stay logged in on that device without re-entering their email each visit. It contains no passwords. It can be cleared at any time by clearing the browser's local storage.

Data retention: Subscription and account data is retained for as long as the account is active, and for up to 24 months after expiry or cancellation for legal and accounting purposes. You may request earlier deletion by emailing [email protected] with the subject line "Delete My Account". We will confirm deletion within 48 hours, subject to any legal retention obligations.

2.6 Data Processing Agreement — Schools

Where a school subscribes to BrainBuzz Mental Maths and provides personal data about teachers (names and email addresses) for allocation to seats, BrainBuzz acts as a data processor on behalf of the school, which is the data controller. This section constitutes the Data Processing Agreement (DPA) required under Article 28 of the UK GDPR.

Subject matter: Processing of teacher personal data (names, email addresses, login activity) to provide the Mental Maths subscription service.

Duration: For the duration of the subscription and up to 24 months thereafter for legal and accounting purposes.

Nature and purpose of processing: Storing teacher names and email addresses against subscription seats; sending login notification emails to teachers; recording test usage against seat IDs; enabling teacher login via OTP email.

Types of personal data: First name, surname, email address, last login date, test usage records.

Categories of data subjects: Employed teaching staff at the subscribing school.

BrainBuzz's obligations as data processor:

• Process personal data only on documented instructions from the school (i.e. data entered into the admin dashboard by the school admin)
• Ensure that all staff with access to personal data are subject to confidentiality obligations
• Implement appropriate technical and organisational security measures
• Not engage sub-processors without informing the school. Current sub-processors: Brevo SAS (transactional email delivery) and Stripe, Inc. (payment processing). Both are bound by GDPR-compliant data processing agreements
• Assist the school in responding to data subject rights requests
• Delete or return all personal data on termination of the subscription (subject to legal retention requirements)
• Make available all information necessary to demonstrate compliance with Article 28

School's obligations as data controller:

• Ensure there is a lawful basis for sharing teacher personal data with BrainBuzz (typically legitimate interests or performance of an employment contract)
• Inform teachers that their name and email address will be used for BrainBuzz Mental Maths access
• Only enter accurate, current data for teachers who are employed by the school
• Remove teacher seat data promptly when a teacher leaves the school

To exercise data subject rights, raise a DPA query, or request deletion of data, email [email protected] with the subject line "DPA Request".

3. What We Don't Collect

To protect children's privacy, we explicitly do not collect:

• Names of pupils using the activities
• Ages or dates of birth
• School or home addresses
• Phone numbers
• Photographs or videos
• Precise geolocation data
• Social media profiles
• Any other personally identifiable information from children

Note: Teachers who register for Mental Maths access do provide personal details (see section 2.5). Pupils using any BrainBuzz activity are never asked to provide personal information.

4. How We Use Information

We use the limited information we collect to:

• Provide Services: Enable pupils to use activities and track their personal progress locally
• Improve BrainBuzz: Understand usage patterns to enhance activities and features
• Send Updates: Notify mailing list subscribers about new activities and features
• Ensure Security: Protect against misuse and maintain website security
• Legal Compliance: Meet our legal obligations including COPPA and GDPR
• Display Advertising: Show age-appropriate advertisements to support the free service

5. Data Sharing and Disclosure

We do not sell, rent, or trade any user information. We may share data only in these limited circumstances:

5.1 Third-Party Service Providers

We work with trusted third-party services that help us operate BrainBuzz:

• Stripe, Inc. — Payment processing for Mental Maths subscriptions. Stripe handles all card and bank payment data. BrainBuzz does not receive or store payment card details. See Stripe's Privacy Policy.
• Brevo SAS (formerly Sendinblue) — Transactional email delivery (subscription invoices, teacher login notifications, renewal reminders). See Brevo's Privacy Policy.
• Analytics Services: To understand website usage and improve our service (anonymised data only)
• Advertising Networks: To display child-appropriate advertisements on the free areas of the site
• Hosting Providers: To maintain our website infrastructure

These providers are bound by confidentiality obligations and data processing agreements, and may only use data to provide services to us.

5.2 Legal Requirements

We may disclose information if required by law or to:

• Comply with legal obligations or court orders
• Protect our legal rights
• Prevent fraud or security issues
• Protect the safety of children or others

6. Data Security

We take security seriously and implement appropriate measures to protect your information:

• Secure HTTPS encryption for all website traffic
• Regular security updates and monitoring
• Access controls limiting who can view data
• Secure data storage and transmission
• Regular security assessments

While we strive to protect your data, no internet transmission is 100% secure. We cannot guarantee absolute security but maintain industry-standard protections.

7. Children's Privacy (COPPA Compliance)

BrainBuzz is designed to be safe for children aged 5 and above. We take extra care to protect young users:

• No Personal Information: We never ask children for names, addresses, phone numbers, or other personal details
• No User Accounts: Pupils can use all features without creating accounts or profiles
• Local Storage Only: Game progress is saved on the device, never on our servers
• No Social Features: No commenting, messaging, or interaction with other users
• Appropriate Content: All activities and advertisements are suitable for children
• Educational Focus: Purely educational content with no commercial solicitation to children
• Parental Control: Parents can delete all local data by clearing browser storage

8. Parental Rights Under COPPA & UK GDPR

Even though we collect minimal personal data, parents and legal guardians have the following rights:

Your Rights Include:

• Right to Information: This privacy policy explains how we handle data
• Right of Access: Request information about any data we hold
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of data (e.g., mailing list subscriptions)
• Right to Object: Object to processing of data
• Right to Withdraw Consent: Change cookie preferences or unsubscribe from emails anytime
• Right to Portability: Receive your data in a portable format

How to Exercise Rights:

• Email: [email protected]
• Subject: "COPPA Parent Request" or "Privacy Rights Request"
• Include: Your relationship to the child (if applicable) and specific request
• Response time: Within 48 hours

For Local Storage: Parents can delete their child's game progress anytime by clearing browser data through browser privacy settings. This data is stored only on the device and is not accessible to us.

Verification: To protect children's privacy, we may ask parents to verify their identity before responding to requests.

9. International Users

BrainBuzz is operated from the United Kingdom and welcomes families worldwide:

• US Families: Full COPPA compliance for children under 13
• EU Families: GDPR compliance including enhanced protections for children
• UK Families: UK GDPR and Data Protection Act 2018 compliance
• Other Countries: We apply the highest applicable privacy standards

Third-party services (analytics, advertising) have their own international privacy policies. You retain privacy rights regardless of location.

10. Data Retention

We retain different types of data for different periods:

• Local Storage: Remains on device until user clears browser data
• Teacher & School Subscription Data: Retained for as long as the account is active, and for up to 24 months after expiry or cancellation for legal and accounting purposes
• Billing & Invoice Records: Retained for 7 years in accordance with UK accounting and tax law (HMRC requirements)
• Teacher Usage Logs: Records of which tests were run are retained for 24 months, then deleted
• Mailing List Data: Retained until you unsubscribe or request deletion
• Analytics Data: Anonymised and retained according to service provider policies (typically 26 months)
• Cookie Data: Retained according to cookie type (see Cookie Policy for details)

We delete or anonymise data when it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.

11. Third-Party Links

BrainBuzz may contain links to external websites (e.g., curriculum resources). We are not responsible for the privacy practices of these sites. We recommend parents review the privacy policies of any external sites their children visit.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect:

• Changes in how we operate BrainBuzz
• Updates to data protection laws including COPPA and GDPR
• New features or services we offer
• Feedback from users and parents

When we make significant changes:

• We'll update the "Last updated" date at the top of this policy
• We'll notify users through a prominent notice on our website
• For material changes affecting COPPA compliance, we will provide additional notice
• The policy will remain easily accessible from our homepage

We encourage you to review this policy periodically to stay informed about how we protect privacy.

13. Contact Information

14. Data Protection Authorities

If you're not satisfied with how we handle your data, you have the right to lodge a complaint with the relevant authority:

UK Data Protection:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113

US COPPA Enforcement:
Federal Trade Commission
Website: ftc.gov
For COPPA-related complaints

EU Data Protection:
Contact your national data protection authority
Directory: edpb.europa.eu

15. Summary

Key Points:

• BrainBuzz collects minimal personal information from general visitors
• Game progress is saved locally on your device, not on our servers
• Mailing list subscriptions are voluntary and can be cancelled anytime
• We never ask pupils for personal information
• We use cookies for essential functions, analytics, and advertising (with your consent)
• All advertisements are child-appropriate and COPPA-compliant
• BrainBuzz Mental Maths is a paid annual subscription service for schools and individuals
• Payments are processed securely by Stripe — we never see your card details
• Schools acting as data controllers are covered by the Data Processing Agreement in section 2.6
• You have full rights to access, correct, or delete your data
• We are fully compliant with UK GDPR, the Data Protection Act 2018, COPPA, and international privacy laws
• Parents and schools can contact us anytime with privacy concerns

Thank you for trusting BrainBuzz with your child's educational journey. We are committed to providing a safe, private, and effective learning environment.