Privacy Policy

Who we are

SATs & Sorcery (satsrevision.com) is operated by StationX Limited, a company registered in England and Wales (Company Number: 3773082). Our registered address is Emstrey House, Shrewsbury Business Park, Sitka Drive, Shrewsbury, SY2 6LG, United Kingdom.

For data protection queries, contact us at [email protected].

What data we collect

For parents/guardians: name, email address, password (stored as a cryptographic hash, never in plain text).

For children (students): first name only, a system-generated display name, password (hashed), year group, and learning progress data (answers to practice questions, scores, mastery levels, XP points).

We do NOT collect: children’s email addresses, dates of birth, phone numbers, photographs, location data, or any other personal information beyond what is listed above.

For school staff: name, email address, password (hashed), school name.

Why we collect it

We collect data solely to provide and improve the SATs revision service. Specifically:

• To authenticate users and maintain secure sessions
• To track learning progress and provide personalised practice recommendations
• To display progress to parents and teachers
• To operate gamification features (XP, companions, leaderboards)

We do not use data for advertising, profiling, or any purpose other than providing the service.

Legal basis

Adults (parents, teachers, school admins): Legitimate interest in providing the service you have signed up for.

Children under 13: Parental consent, obtained either through the parent creating the child’s account (home flow) or through the school’s existing data processing agreements with parents (school flow), in accordance with the UK Data Protection Act 2018 Section 9.

Who can see the data

• Students see their own progress, leaderboard display names (not real names), and class members’ display names
• Parents see their linked child’s progress
• Teachers see their class members’ names and progress
• School admins see teachers and class overviews within their school

We do not sell, share, or disclose personal data to any third parties. No data is used for advertising or marketing.

Where data is stored

All data is stored on servers located in Germany (Hetzner Online GmbH, Nuremberg data centre), within the European Economic Area. Germany provides an adequate level of data protection as recognised by UK law.

How long we keep data

Student accounts inactive for 24 months are automatically deleted. Teacher and parent accounts inactive for 6 months are automatically deleted. You can request deletion at any time by contacting us.

Your rights

Under UK GDPR, you have the right to:

• Access your data (or your child’s data)
• Correct inaccurate data
• Request deletion of your data
• Request data portability
• Object to processing

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Children’s privacy

We are committed to protecting children’s privacy in accordance with the ICO Age Appropriate Design Code (Children’s Code). We apply high privacy settings by default, collect the minimum data necessary, and never use children’s data for purposes they would not expect.

Display names are system-generated to protect children’s identities. Children are never asked to provide their email address, date of birth, or other sensitive personal information.

Cookies

We use essential cookies only to maintain your login session. We do not use tracking cookies, analytics cookies, or advertising cookies. No third-party cookies are set.

Changes to this policy

We may update this policy from time to time. Significant changes will be communicated via the platform. The latest version is always available at this page.

Complaints

If you are unhappy with how we handle your data, you can contact the Information Commissioner’s Office (ICO) at ico.org.uk or call 0303 123 1113.