Privacy policy

1. PRIVACY POLICY

1.1 About this policy

This Privacy Policy explains how learnwhatyouwant.co.uk, trading as Learn What You Want, collects, uses, stores and protects personal information.

In this policy, “Learn What You Want”, “we”, “us” and “our” refer to:

For the purposes of UK data-protection law, we are normally the data controller for the personal information described in this policy.

1.2 The information we collect

Depending on how you use the platform, we may collect:

Account information

This may include:

• your name
• email address
• username and account identifiers
• password information in encrypted or hashed form
• age or age-range information
• account type
• communication preferences
• profile settings

Subscription and transaction information

This may include:

• your subscription plan
• billing address
• payment status
• transaction references
• subscription start, renewal and cancellation dates
• refunds and account credits
• the last four digits or other limited details relating to your payment method

Complete payment-card information is normally processed directly by our payment provider and is not stored by us.

Course and learning information

This may include:

• subjects and topics you ask to learn about
• prompts, questions and instructions you submit
• selected education or difficulty levels
• generated course outlines, lessons, quizzes and explanations
• course progress
• quiz answers and scores
• bookmarks, notes and saved courses
• completion information
• certificates generated through the platform

Please do not include unnecessary personal, confidential, medical, financial or other sensitive information in course prompts.

Family-account information

Where a family account is used, we may collect:

• the family account holder’s information
• names or nicknames assigned to family profiles
• profile age ranges
• learning preferences
• activity and course progress for each profile
• parental or account-holder settings

Organisation-account information

For organisation subscriptions, we may collect:

• the organisation’s name and business contact information
• administrator details
• employee, student, contractor or member names and email addresses
• seat allocation information
• usage and account activity
• course assignments
• progress and completion information
• communications between us and the organisation

The organisation may act as a separate data controller for information it enters into or obtains from the platform. Organisations are responsible for providing appropriate privacy information to their users.

Technical information

This may include:

• IP address
• browser and device information
• operating system
• approximate location derived from an IP address
• login records
• security logs
• cookie identifiers
• pages viewed
• features used
• error reports
• performance and diagnostic information

Communications

We may retain emails, support requests, survey responses, complaints and other communications you send to us.

1.3 How we obtain personal information

We obtain information:

• directly from you
• from a family or organisation account holder
• automatically when you use the platform
• from payment and authentication providers
• from cookies and similar technologies
• from service providers that help us detect fraud, maintain security or operate the platform

1.4 How and why we use personal information

We may use personal information to:

• create and administer accounts
• provide subscriptions and generated learning content
• personalise course difficulty, format and recommendations
• process payments, renewals, cancellations and refunds
• track progress and issue completion certificates
• administer family and organisation accounts
• provide customer support
• send service, security and subscription notices
• detect fraud, misuse and security incidents
• enforce our Terms and Conditions
• maintain, test and improve the platform
• comply with legal, accounting and regulatory obligations
• establish or defend legal claims
• send marketing where permitted by law

1.5 Our lawful bases

We rely on one or more of the following lawful bases:

Contract

We process information where it is necessary to create your account, provide your subscription, generate requested content or otherwise perform our contract with you.

Legal obligation

We process information where necessary to comply with tax, accounting, consumer-protection, law-enforcement or other legal obligations.

Legitimate interests

We may process information where it is necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights.

These interests may include:

• securing and maintaining the platform
• preventing fraud and misuse
• improving our services
• understanding general platform usage
• handling complaints and disputes
• managing our business
• creating and reusing anonymised course-outline information

Consent

We rely on consent where required, including for certain cookies and electronic marketing. You may withdraw consent at any time, although this will not affect processing that took place before withdrawal.

1.6 AI-generated content and prompts

The platform uses artificial-intelligence systems to generate course outlines, lessons, quizzes, explanations, images and other educational material.

Your prompts and relevant account settings may be transmitted to AI and infrastructure providers acting on our behalf. We take reasonable steps to limit the personal information included in these requests.

You must not submit:

• confidential information belonging to another person or organisation
• personal information you are not authorised to provide
• passwords or security credentials
• payment-card information
• detailed medical records
• government identification numbers
• information whose disclosure could cause harm

AI-generated content may occasionally be inaccurate, incomplete, outdated or unsuitable. Prompts and generated material may be reviewed through automated processes and, where reasonably necessary, by authorised personnel for safety, support, quality assurance or abuse prevention.

1.7 Public reuse of anonymised generated course outlines

We may reuse, display, publish, index or incorporate generated course outlines into our public course library where those outlines have been anonymised or otherwise separated from identifiable account information.

For example, we may publish a generic outline entitled “Introduction to Roman History” without identifying the user who originally requested it.

Before publicly reusing an outline, we will take reasonable steps to remove:

• names
• email addresses
• account identifiers
• private notes
• organisation-specific information
• identifiable personal circumstances
• other information that could reasonably identify a user

We will not intentionally publish your private prompts, personal learning history, quiz responses or identifiable account information as part of this process.

You may ask us not to use future outlines associated with your account for public-library purposes by contacting privacy@learnwhatyouwant.co.uk or using any available privacy setting. This will not normally require us to remove an independently created or sufficiently anonymised outline that can no longer reasonably be linked to you.

Information that has been effectively anonymised so that individuals are no longer identifiable is not personal information under data-protection law.

1.8 Family accounts and children

Family accounts must be created and managed by an adult aged 18 or over.

The family account holder is responsible for:

• deciding who may use the account
• creating and supervising child profiles
• ensuring profile information is accurate and appropriate
• reviewing courses generated for children
• ensuring that children do not submit personal or sensitive information
• maintaining the confidentiality of account credentials
• deciding whether generated content is suitable for each family member

Children must not independently purchase subscriptions.

Where a child uses the service through a family account, the account holder authorises the child’s supervised use of the platform and confirms that they have parental responsibility or appropriate authority.

We aim to minimise information collected about children. We do not intend to use children’s learning activity for targeted advertising.

AI-generated courses are not a substitute for parental supervision, a school curriculum, a qualified teacher or professional advice.

1.9 Organisation accounts

An organisation administrator may be able to:

• invite or remove users
• allocate seats
• assign courses
• view account activity
• review progress and completion information
• manage subscription and billing details
• export reports

Users of organisation accounts should understand that their organisation may be able to access information relating to their use of the platform.

The organisation is responsible for ensuring that it has a lawful basis for adding users and accessing their information.

Where we process personal information solely on an organisation’s documented instructions, we may act as its data processor. Separate data-processing terms may apply.

1.10 Who we share information with

We may share information with trusted providers that help us operate the platform, including:

• hosting and cloud-infrastructure providers
• AI-model and content-generation providers
• payment processors
• authentication providers
• email and customer-support providers
• analytics providers
• security, fraud-prevention and monitoring providers
• professional advisers
• insurers
• regulators, courts and public authorities
• prospective purchasers or investors in connection with a business sale, merger or restructuring

Providers may only use information for authorised purposes and must apply appropriate security measures.

We do not sell personal information to advertisers.

1.11 UK hosting and international transfers

Our primary website and application servers are located in the United Kingdom.

Some suppliers, including AI, payment, email, analytics or technical-support providers, may process information outside the United Kingdom.

Where personal information is transferred internationally, we use an approved legal mechanism where required, such as:

• UK adequacy regulations
• the UK International Data Transfer Agreement
• the UK Addendum to the EU Standard Contractual Clauses
• another legally permitted safeguard

1.12 Data retention

We retain information only for as long as reasonably necessary.

Our normal retention approach is:

• active account information: for the life of the account
• account information following closure: normally up to [12/24] months
• invoices and transaction records: normally six years plus the current financial year
• generated courses and progress information: until deleted by the user, the account is closed or the information is no longer required
• customer-support correspondence: normally up to three years after resolution
• security logs: normally between 30 days and 12 months, unless required for an investigation
• marketing preferences: until consent is withdrawn, plus a limited suppression record
• organisation records: for the subscription term and a reasonable period afterwards
• anonymised statistical information: potentially indefinitely

We may retain information longer where required by law, to resolve a dispute or to protect legal rights.

1.13 Security

We use reasonable technical and organisational measures designed to protect information, including access controls, encryption where appropriate, secure hosting, logging, backups and supplier assessments.

No internet-based service can guarantee absolute security. You are responsible for choosing a strong password and keeping login information confidential.

You should notify us promptly at support@learnwhatyouwant.co.uk if you believe an account has been accessed without permission.

1.14 Your rights

Depending on the circumstances, you may have the right to:

• receive information about how your data is used
• obtain a copy of your personal information
• correct inaccurate or incomplete information
• request deletion
• restrict processing
• object to processing based on legitimate interests
• withdraw consent
• receive certain information in a portable format
• challenge certain decisions made solely by automated means

These rights are not absolute and may be subject to legal exceptions.

Requests can be sent to privacy@learnwhatyouwant.co.uk. We may need to verify your identity before responding.

1.15 Marketing

We may send service-related communications that are necessary to operate your account.

We will send promotional emails only where permitted by law. You may unsubscribe through the link in a marketing email or by changing your account preferences.

Unsubscribing from marketing does not prevent us from sending essential account, billing, security or legal communications.

1.16 Cookies

We use necessary cookies to provide login, security, checkout and account functionality.

With consent where required, we may also use analytics, preference or marketing cookies.

More information should be provided in our Cookie Policy and cookie-consent tool.

1.17 Complaints

Please contact us first at privacy@learnwhatyouwant.co.uk so that we can investigate your concern.

You also have the right to complain to the UK Information Commissioner’s Office.

1.18 Changes to this policy

We may update this policy when our services, suppliers or legal obligations change.

The latest version will be published on the website with an updated revision date. Where changes materially affect how we use personal information, we will provide additional notice where appropriate.