What the public website knows—and what it does not.

Current free lessons

The manual and technique lesson player keeps a content-free checkpoint in this browser tab using session storage. It includes the chosen method, age-instruction band, step, answer mode and practice outcomes, but no typed answers or schoolwork. It can restore your place for two hours. Finishing, ending a lesson or closing the tab removes it. If storage is unavailable you can continue in memory. This is the same player used by accounts; free practice does not save an account history.

1. Who is responsible?

The data controller is ECOMMERCE ONLINE LTD, company number 12568562. How2Revise is its product and trading name. Our registered office is 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX.

For a privacy question or request, email privacy@how2revise.com. For ordinary help, email support@how2revise.com. Please do not email passwords, full payment-card details, schoolwork or unnecessary information about a pupil.

2. Information used on the public service

Information kept only in your browser

Earlier versions of the free Revision Reset could remember the age-instruction band, material type, task route, revision need, time choice, taught/readiness and checking-source choices, short target, method-action confirmations, attempt/check/retry outcomes, up to three return questions, return choice, timer and current step in local storage on your device. The draft also stores a random document coordination identifier and revision count used inside coordinated saves to reject a stale change. Supported browsers serialize local draft reads and saves with an exclusive Web Lock. The current page-history entry can carry the same non-personal identifier so its own reload can be recognised; it contains no pupil text. If that lock or browser storage is unavailable, persistence fails closed: the Reset remains usable in memory while the page stays open, but it does not load or write an unlocked, restorable draft. The Reset does not request an upload or a subject answer, but a saved draft contains whatever the pupil types in the target and return-question fields. Do not type an answer, name or private detail there. Neither the draft nor the page-history identifier is sent to How2Revise. The draft can be reopened for 24 hours from creation. How2Revise clears it at that deadline while the site is running, or on the next How2Revise visit if the browser was closed or suspended. Completion, our cookie and local-storage controls or your browser settings remove it sooner.

Do not type a name, school, address, phone number, health information or another private detail into the reset. A short observable target such as “explain one taught process” is enough.

Guided Biology practice

The guided practice displays original Biology material and uses fixed, human-written checks supplied by How2Revise. The feedback names the ideas that matched and those still missing or confused. A typed attempt is compared with those checks by code running in the open browser tab. The attempt is held only in page memory: it is not included in a network request, browser storage, analytics or a pupil profile, and refreshing or closing the page discards it. With the real-upload gate closed, the practice renders no file input, receives no image or PDF, performs no OCR and calls no analysis or AI provider.

Essential hosting and security information

When a browser requests a page, our hosting and security systems may receive the IP address, date and time, requested address, browser/device information, referring page and technical response or error. We use this limited information to deliver the site, keep it secure, investigate faults and prevent misuse.

Optional beta diagnostics

Invited beta families can separately opt in to first-party testing diagnostics in the parent dashboard. Pupils choose whether to share each session and can stop sharing. The developer can see approved page names, lesson steps, labelled controls, active time, repeated-click and error signals. We do not collect screenshots, pointer paths, keystrokes, answers, photos, passwords or PINs. Diagnostics are linked to the invited family account and are visible only to the verified master administrator. Sessions are retained for up to 30 days and deleted when the parent withdraws consent. Declining does not affect learning access. Beta learning accounts close when their access expires or the programme closes; privacy and deletion controls remain available.

Optional analytics

Google Analytics is disabled in this release and cannot be enabled from any page. The integration will remain closed until a separately reviewed adult-only consent flow, its exact review-contract marker and a verified analytics identifier are all released. If activated later, Google could receive page and interaction information, browser/device details, approximate location derived by Google and its own identifiers. Advertising personalisation and Google Signals would remain disabled. We would not send a reset target, schoolwork or a pupil profile to analytics.

You can refuse or withdraw this choice without losing the public service. See Cookies and local storage for the current inventory and controls. Google explains its handling in its privacy policy.

Correspondence you choose to send

If you email us, we receive the address, message, attachments and delivery information you choose to provide. We use correspondence to answer the request, protect the service, resolve a complaint or meet a legal duty. A safeguarding message is restricted to people who need it, but How2Revise is not an emergency service. Call 999 or 112 if someone is in immediate danger.

3. The no-account public practice

The no-account public practice does not request or receive the following. Controlled tester accounts and the separately activated photo-lesson and tutor routes described above have different processing:

• pupil or parent accounts, profiles, login details or saved progress;
• pupil names, email addresses, exact dates of birth, schools or locations;
• subscriptions, payment-card information, invoices or billing histories;
• real uploaded notes, textbooks, worksheets, images, PDFs, audio or video;
• free-text AI conversations, AI safety profiles or automated pupil decisions;
• advertising profiles, data-broker information, public pupil profiles or peer messaging; or
• marketing preferences or marketing messages aimed at pupils.

The target and return-question fields are stored only in the browser draft described above. If a pupil types a name, location, answer or other private detail there despite the warning, that entry remains on that device until the draft is completed, cleared or reaches its deadline; it is not sent to How2Revise.

4. Why we use information

Our current UK GDPR purposes and lawful bases are:

• Provide and secure the public website: our legitimate interests in operating a useful, reliable and secure service, balanced against visitors’ rights and a child’s best interests.
• Optional analytics: consent. It stays off unless an adult chooses it and can be withdrawn at any time.
• Answer correspondence or a requested step: legitimate interests, steps requested before any future contract, or legal obligation, depending on the message.
• Deal with a safety, legal or regulatory issue: legal obligation, legitimate interests or another basis available under law. Sensitive information is not requested and receives additional protection if unexpectedly provided.

We do not use public-site information to make a legal or similarly significant decision about anyone.

5. Who receives information?

Limited information may be handled by providers that host, secure or measure the website; professional advisers where genuinely necessary; and a regulator, court, police, social-care body or emergency service where disclosure is lawful and necessary. Optional analytics information goes to Google only after the choice described above.

Some providers may process information outside the UK. Where UK law requires it, we use a recognised safeguard such as an adequacy regulation or approved contractual protection and assess the transfer. Ask privacy@how2revise.com for relevant details.

6. How long do we keep it?

• Local reset draft: available for 24 hours from creation; cleared at that deadline while How2Revise is running, or on the next How2Revise visit after a closed or suspended browser. Completion or manual clearing removes it sooner. How2Revise does not receive it.
• Cookie choice: on your device until you change or clear it. We review the choice version when our storage use changes.
• Hosting, security and error logs: normally no more than 90 days, unless a specific incident or legal duty requires a documented longer hold.
• Optional Google Analytics event-level data: configured to two months when analytics is enabled, with aggregate reports kept only while useful and reviewed.
• Ordinary support correspondence: normally up to 24 months after the matter closes. A complaint, legal or safeguarding record may need a different period based on necessity and professional review.

We delete or irreversibly anonymise information when its purpose ends, subject to limited backup cycles and a documented legal hold.

7. Children’s information

Children have their own data-protection rights. The current public experience is designed not to require an identity or account. A pupil can read the guidance and run the reset without giving How2Revise their target or schoolwork. Optional analytics should be decided by an adult.

Before we widen controlled parent-owned profiles or AI processing to public access, we must publish age-appropriate notices, complete the Children’s Code assessment and explain exactly what a parent can and cannot see. Pupils will not create direct accounts. The ICO provides further information about children and the UK GDPR.

Clearly labelled parent account and child privacy notice candidates are available for professional and comprehension review. They have no effective dates, are excluded from search indexing and do not authorise a pupil profile or real scan.

8. Your choices and rights

Depending on the circumstances, UK data-protection law may let you:

• ask for a copy of your personal information;
• correct inaccurate information;
• ask for deletion or restriction;
• object to processing based on legitimate interests;
• withdraw consent without affecting earlier lawful use;
• receive certain information in a portable form; and
• complain about how we handle information.

Email privacy@how2revise.com. We may ask for proportionate evidence so information is not given to the wrong person. The rights belong to the child where the information is theirs; we consider a child’s competence, authority and best interests before giving it to another person.

You can also complain to the Information Commissioner’s Office. We would appreciate the opportunity to put things right first, but you do not have to contact us before the ICO.

9. Changes to this notice

We will update the date and explain material changes here. We will replace the public-launch account policy bundle before opening general registration, real-money checkout or public AI access. Archived versions can be requested from privacy@how2revise.com.