Privacy Policy

Blank Academy, operated by Bidileci Holdings, is the data controller for the personal data described here. Contact us about anything in this policy at hello@blankacademy.co.uk.

Much of the data we hold is about children, and we take that seriously: we collect the minimum we need to run lessons safely, we do not use children's data for marketing, and we never sell personal data to anyone.

• Account details: name, email address and a password (stored only as a secure hash, we cannot read it).
• Student profiles: name, school year group, exam board, subjects and learning goals, provided by the parent or student at signup.
• Lesson activity: bookings, attendance, cancellations, lesson notes written by tutors, homework set and submitted, and files uploaded with it.
• Messages: conversations between families, tutors and our team on the platform.
• Payment records: which credit bundles you bought and when. Card details go directly to Stripe, our payment processor; we never see or store them.
• Tutor applications: qualifications, experience and references for people applying to teach.
• Technical records: server logs and a login session cookie, used to keep the service secure and working.

Video lessons run in our own lesson rooms and are not recorded.

• To provide the service you signed up for (legal basis: performance of a contract), running accounts, bookings, lessons, homework, messaging and payments.
• To keep students safe and the platform honest (legitimate interests, and in some cases legal obligation) , vetting tutors, moderating messages, investigating safeguarding concerns, preventing fraud and abuse.
• To tell you things about the service (legitimate interests), emails about your lessons, bookings, messages and account. These are service emails, not marketing; we currently send no marketing.
• To meet legal duties (legal obligation), tax and accounting records for payments, and responding to lawful requests from authorities.

Tutors see the profile, homework and messages of the students they teach, that is what makes tuition work. Parents can see their own children's activity. Our small team can access data where needed to run the platform, support you and keep students safe.

We also use a few carefully chosen service providers:

• Stripe: payment processing and tutor payouts.
• Resend: delivering our emails to you.
• Contabo: hosting, on servers in the European Union (Germany). Our video lesson rooms run on our own server there too; lessons do not pass through third-party video services.
• Discord: a daily internal operations summary for our team (for example, lesson counts and account balances).

Where a provider processes data outside the UK (Stripe, Resend and Discord are US companies), the transfer is protected by recognised safeguards such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement. Data hosted in the EU is covered by the UK's adequacy decision. We never sell personal data, and we do not use advertising or analytics trackers.

We keep your data while your account is open. When an account is closed, we delete or anonymise personal data within a reasonable period, except what we must keep longer: payment and tax records (up to 6 years), and records connected to a safeguarding matter, which we keep as long as guidance requires. Encrypted backups age out automatically on a rolling basis.

You can ask us for a copy of the personal data we hold about you or your child, ask us to correct it, delete it, restrict how we use it, or object to a use based on legitimate interests. Email hello@blankacademy.co.uk and we will respond within a month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.

All traffic to the platform is encrypted (HTTPS). Passwords are hashed, access to production data is restricted, uploaded files are only ever served to the people entitled to see them, and the database is backed up automatically. No system is perfectly secure, but if a breach ever put your rights at risk we would tell you and the ICO as the law requires.

We set exactly one cookie: the session cookie that keeps you signed in. It is strictly necessary for the service, which is why there is no cookie banner. We use no advertising, analytics or tracking cookies of any kind.

If we change this policy in a way that matters, we will tell you by email or a notice on the platform. See also our Terms of Service and Safeguarding Statement.