Privacy Policy

Last updated: May 2026

1. Who we are

11+PracticeHub ("we", "us") provides an adaptive 11+ exam-preparation platform for children. Parent accounts are held by adults; children's profiles are attached to those accounts.

2. Data we collect

• Parent account data: email address and bcrypt-hashed password.
• Child profile data: first name or nickname, year of birth, target exam year.
• Learning data: question answers, time taken per question, session scores, and adaptive-learning metrics (mastery estimates, performer band).
• Technical data: server logs (IP address, timestamp, HTTP method) retained for up to 30 days for security purposes.

We do not collect full names, postal addresses, phone numbers, or payment information.

3. How we use data

• To personalise your child's practice sessions using our adaptive-learning engine.
• To display progress reports to the parent account holder.
• To maintain account security (rate-limiting, session management).

We do not sell data. We do not use learning data for advertising.

4. Children's privacy (COPPA / UK GDPR)

Child profiles are created and managed exclusively by parent account holders. We do not knowingly collect data directly from children under 13 without verifiable parental consent. The parent or legal guardian who creates the account provides consent on behalf of their child.

Under UK GDPR / the Children's Code we apply privacy-by-default to child data: it is not shared with third parties, is not used for profiling beyond educational adaptive learning, and is stored only for as long as the account is active.

5. Data sharing

We do not share personal data with third parties except where required by law or to operate essential infrastructure (e.g. hosting provider). Any processors we use are bound by data-processing agreements.

6. Data retention & deletion

Account and learning data are retained for as long as your account is active. You may request deletion of your account and all associated child data by emailing us. We will process deletion requests within 30 days.

7. Security

Passwords are hashed with bcrypt (cost factor 12). Sessions use short-lived, HTTP-only, Secure, SameSite=Strict cookies. We use TLS for all data in transit.

8. Your rights

Under UK GDPR you have the right to access, rectify, erase, and port your data. To exercise these rights please contact us. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

9. Contact

Questions about this policy? Email us at privacy@11pluspracticehub.com.