What the public website knows—and what it does not.

1. Who is responsible?

The data controller is ECOMMERCE ONLINE LTD, company number 12568562. How2Revise is its product and trading name. Our registered office is 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX.

The branded email inboxes are not active yet. For a privacy request, write to ECOMMERCE ONLINE LTD, 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX, marking the envelope “Privacy”. Include only the minimum information needed and do not post passwords, full payment-card details or schoolwork.

2. Information used on the public service

Information kept only in your browser

The free Revision Reset can remember the material type you chose, your short target, confidence choice, three return questions, retry outcome, return choice, timer and current step in local storage on your device. That draft is not sent to How2Revise. It can be reopened for 24 hours from creation. How2Revise clears it at that deadline while the site is running, or on the next How2Revise visit if the browser was closed or suspended. Completion, our cookie and local-storage controls or your browser settings remove it sooner.

Do not type a name, school, address, phone number, health information or another private detail into the reset. A short target such as “explain photosynthesis” is enough.

Essential hosting and security information

When a browser requests a page, our hosting and security systems may receive the IP address, date and time, requested address, browser/device information, referring page and technical response or error. We use this limited information to deliver the site, keep it secure, investigate faults and prevent misuse.

Optional analytics

Google Analytics loads only after an adult affirmatively chooses optional analytics and only where the deployment has a verified analytics identifier. It can receive page and interaction information, browser/device details, approximate location derived by Google and its own identifiers. Advertising personalisation and Google Signals are disabled. We do not send a reset target, schoolwork or a pupil profile to analytics.

You can refuse or withdraw this choice without losing the public service. See Cookies and local storage for the current inventory and controls. Google explains its handling in its privacy policy.

Correspondence you choose to send

The current site has no contact form and its branded inboxes are not active. If you write to the registered office, we receive the name, address, message and enclosures you choose to provide. We use correspondence to answer the request, protect the service, resolve a complaint or meet a legal duty. A safeguarding message is restricted to people who need it, but How2Revise is not an emergency service. Call 999 or 112 if someone is in immediate danger.

3. What we do not collect in this public phase

How2Revise does not currently create or process:

• pupil or parent accounts, profiles, login details or saved progress;
• pupil names, email addresses, exact dates of birth, schools or locations;
• subscriptions, payment-card information, invoices or billing histories;
• uploaded notes, textbooks, worksheets, images, audio or video;
• free-text AI conversations, AI safety profiles or automated pupil decisions;
• advertising profiles, data-broker information, public pupil profiles or peer messaging; or
• marketing preferences or marketing messages aimed at pupils.

4. Why we use information

Our current UK GDPR purposes and lawful bases are:

• Provide and secure the public website: our legitimate interests in operating a useful, reliable and secure service, balanced against visitors’ rights and a child’s best interests.
• Optional analytics: consent. It stays off unless an adult chooses it and can be withdrawn at any time.
• Answer correspondence or a requested step: legitimate interests, steps requested before any future contract, or legal obligation, depending on the message.
• Deal with a safety, legal or regulatory issue: legal obligation, legitimate interests or another basis available under law. Sensitive information is not requested and receives additional protection if unexpectedly provided.

We do not use public-site information to make a legal or similarly significant decision about anyone.

5. Who receives information?

Limited information may be handled by providers that host, secure or measure the website; professional advisers where genuinely necessary; and a regulator, court, police, social-care body or emergency service where disclosure is lawful and necessary. Optional analytics information goes to Google only after the choice described above.

Some providers may process information outside the UK. Where UK law requires it, we use a recognised safeguard such as an adequacy regulation or approved contractual protection and assess the transfer. Use the postal privacy route above to ask for relevant details.

6. How long do we keep it?

• Local reset draft: available for 24 hours from creation; cleared at that deadline while How2Revise is running, or on the next How2Revise visit after a closed or suspended browser. Completion or manual clearing removes it sooner. How2Revise does not receive it.
• Cookie choice: on your device until you change or clear it. We review the choice version when our storage use changes.
• Hosting, security and error logs: normally no more than 90 days, unless a specific incident or legal duty requires a documented longer hold.
• Optional Google Analytics event-level data: configured to two months when analytics is enabled, with aggregate reports kept only while useful and reviewed.
• Ordinary support correspondence: normally up to 24 months after the matter closes. A complaint, legal or safeguarding record may need a different period based on necessity and professional review.

We delete or irreversibly anonymise information when its purpose ends, subject to limited backup cycles and a documented legal hold.

7. Children’s information

Children have their own data-protection rights. The current public experience is designed not to require an identity or account. A pupil can read the guidance and run the reset without giving How2Revise their target or schoolwork. Optional analytics should be decided by an adult.

If we later open child accounts or AI, we will first publish age-appropriate notices, complete the Children’s Code assessment and explain exactly what a parent can and cannot see. The ICO provides further information about children and the UK GDPR.

8. Your choices and rights

Depending on the circumstances, UK data-protection law may let you:

• ask for a copy of your personal information;
• correct inaccurate information;
• ask for deletion or restriction;
• object to processing based on legitimate interests;
• withdraw consent without affecting earlier lawful use;
• receive certain information in a portable form; and
• complain about how we handle information.

Write to the registered office above, marking the envelope “Privacy”. We may ask for proportionate evidence so information is not given to the wrong person. The rights belong to the child where the information is theirs; we consider a child’s competence, authority and best interests before giving it to another person.

You can also complain to the Information Commissioner’s Office. We would appreciate the opportunity to put things right first, but you do not have to contact us before the ICO.

9. Changes to this notice

We will update the date and explain material changes here. We will replace this Lane-A notice before enabling an account, payment, subscription, upload or free-text AI feature. Archived versions can be requested through the postal privacy route above.