The Revision Wizard ("we," "our," or "us") is committed to protecting your privacy and handling personal data responsibly. This Privacy Policy explains how we collect, use and protect personal data when you use our websites and mobile applications (the "Service").
The Service is based in the UK and designed primarily for UK users, though it is accessible worldwide. We provide gamified learning games for children, managed by an adult account holder, and we process data relating to those users and their interactions with the Service.
2. Who We Are (Data Controller)
This service is operated by Paul Elderton t/a The Revision Wizard, a sole trader in England, United Kingdom. Paul Elderton is the data controller responsible for your personal data under the UK GDPR. Our postal address is Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA.
For any privacy question, or to exercise your rights, contact us at [email protected].
3. Information We Collect
3.1 Information you provide
Admin Users: when you subscribe, we collect your name and email address. Payment details are collected and processed directly by Stripe (or, in the App, by Apple or Google); we do not store full card details.
Child Users: Admin Users create child accounts with a username. Usernames are stored in our Cloudflare database, and authentication is managed by Auth0. We ask Admin Users not to use a child's full real name.
Newsletter subscribers: if you opt in to our newsletter, we collect your email address (processed via Mailchimp).
Free practice pack: if you ask us to send you the free pack, we collect your email address. It is added to our newsletter list (Mailchimp), and the pack itself is emailed to you via Brevo. Spam protection is by Google reCAPTCHA. You can also download the pack without giving us an email address at all.
Contact form: if you contact us, we collect your name, email address and message (delivered via Brevo, with spam protection by Google reCAPTCHA).
3.2 Information collected automatically
We use Cloudflare for hosting, security and database services. Technical data such as IP address and device information may be processed for security and operational purposes.
Game-related data — including progress, scores and in-game activity — is stored in our database and associated with the relevant user account.
We use privacy-focused analytics to understand website performance (see section 8).
3.3 Mobile app data
Push notifications: if you enable notifications (for example, daily practice reminders), we process a device push token so we can deliver them. You can turn notifications off at any time in your device settings.
Device information: we may process device type, operating system version and app version for support, security and to improve the App.
Purchases: in-app purchases are processed by Apple or Google; we receive confirmation of your subscription status but not your payment card details.
4. How We Use Your Information
Service provision: to provide the learning games and manage subscriptions and accounts.
Authentication and security: to verify and secure access via Auth0 and to protect the Service.
Payment processing: to take and manage subscription payments.
Communication: to send service-related emails and, where you have opted in, newsletters.
Improvement: to monitor, analyse and improve the Service.
5. Legal Basis for Processing
Contractual necessity: to provide the subscribed Service.
Legitimate interests: for security, fraud prevention and improving the Service, balanced against your rights.
Consent: for marketing emails, newsletters and non-essential cookies.
Legal obligation: to comply with applicable laws.
6. Data Sharing and Third Parties
We do not sell your personal data. We share data with the following processors and partners only as needed to run the Service:
Provider
Purpose
Stripe
Subscription payments (web)
Apple App Store / Google Play
In-app purchases and subscriptions (App)
Auth0 (Okta)
Authentication and account security
Cloudflare
Hosting, security, database and web analytics
Brevo
Transactional email and email drips
Mailchimp
Newsletter and free-pack sign-up, and delivery (opt-in only)
Google
reCAPTCHA (spam protection on our contact and free-pack forms) and Google Analytics
Legal authorities
Where required by law
7. Shared Leaderboards Between Groups
The Service lets Admin Users connect their Groups using share codes so children can appear on shared leaderboards. Where an Admin User chooses to use this feature, a Child User's username and progress statistics may be visible to the other connected Group(s). No contact details or account credentials are shared.
Admin Users decide whether to create, share, accept, reject or block these connections and can revoke them at any time. If you would like a connection removed, an Admin User can do this in the Service, or you can contact us.
8. Cookies and Analytics
We use a small number of cookies and similar technologies. Essential cookies are needed for the Service to work (for example, keeping you signed in via Auth0). Non-essential cookies — including Google Analytics and Google reCAPTCHA — are used only with your consent, and you can manage your choices via your browser settings or any cookie controls we provide.
Google Analytics helps us understand how the website is used so we can improve it. It may set cookies and process a truncated IP address and usage data.
Cloudflare Web Analytics is a privacy-first, cookieless measurement tool that collects aggregated, anonymised traffic data and does not track individuals.
Google reCAPTCHA protects our contact and free-pack forms from abuse and is subject to Google's privacy policy.
9. Fonts and External Resources
Our websites use Google Fonts to display custom fonts. When your browser requests a font, Google may receive your IP address and technical details. No tracking cookies are set for font delivery. See Google's privacy policy for more.
10. Data Storage and Security
We apply appropriate technical and organisational measures to protect personal data. Authentication credentials are managed securely by Auth0, and other data is stored in Cloudflare's infrastructure with access controls and protections in place.
11. Data Retention
Account information: retained while your subscription is active and for a limited period afterwards to meet legal, accounting and security obligations.
Game data: retained while the account is active and for a limited period afterwards, then deleted or anonymised.
Newsletter subscriptions: retained until you unsubscribe.
You can request deletion of an account and its associated data at any time (see section 12).
12. Your Rights
As a UK/EU user, you have rights under the UK GDPR and the Data Protection Act 2018, including the right to:
Access — request a copy of your personal data.
Rectification — request correction of inaccurate data.
Erasure — request deletion of your data where applicable.
Restriction / Objection — restrict or object to certain processing.
Portability — request transfer of your data to another service.
Withdraw consent — unsubscribe from marketing at any time.
To exercise any right, email [email protected]. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
13. Children's Privacy
The Service is used by children, but child accounts are created and managed by adult Admin Users (parents, guardians or educators), who are responsible for the accounts they set up. We limit the personal data associated with child accounts to what is needed to run the learning games — principally a username and in-game progress — and we do not knowingly collect contact details directly from children.
We design the Service with children's best interests in mind and take account of the ICO's Age Appropriate Design Code (Children's Code). An Admin User can review, correct or delete a child's account and data at any time, or contact us for help.
14. International Data Transfers
Some of our providers (for example Stripe, Auth0/Okta, Cloudflare, Brevo, Mailchimp and Google) may process data outside the UK. Where data is transferred internationally, we rely on appropriate safeguards — such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses — to ensure your data remains protected.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for significant changes, notify users through the Service or by email.
16. Contact Us
For any question about this Privacy Policy or your personal data, contact us at [email protected].