Prep Hub

Legal

Privacy Policy

Last updated: 23 July 2026

11+ Prep Hub ("we", "us", "our") provides an online 11+ exam-preparation service for children, managed by a parent or guardian. This policy explains what personal data we collect, why, how we protect it, and the rights you and your child have. We are committed to the UK GDPR, the Data Protection Act 2018, and the ICO's Age Appropriate Design Code ("Children's Code").

Children's privacy first. Children never hold their own account or log in independently — a parent or guardian is always the account holder and controls the child's profile. We collect the minimum needed to run the learning experience, never use a child's personal data for marketing or profiling, and never expose children to open-ended AI chat.

1. Who is responsible for your data

11+ Prep Hub is the data controller for personal data processed through this service. For any privacy question or to exercise your rights, contact us at contact@prephub.uk.

The service is operated by PREPHUB LTD, a company registered in England and Wales, company number 17379765, registered office 3 Brandon Avenue, Manchester, England, M22 4BF.

Where an organisation (for example a school or charity) provides access to families under a group licence, PREPHUB LTD acts as a processor for any personal data that organisation is responsible for, and a separate data processing agreement applies. In all other cases we are the controller, as described above.

2. The data we collect

Parent / guardian (account holder)

  • Name and email address (to create and secure the account)
  • A parent PIN you set (to gate the parent area)
  • Billing information — handled by our payment processor Stripe. We do not store your full card details on our servers.
  • Communications you send us (e.g. contact-form messages)

Child (created and managed by the parent)

  • A display name (a first name or nickname — no full name required), date of birth or year group, and target school(s)
  • Learning preferences and accessibility needs you choose to set (e.g. narration, extra time)
  • Learning activity: questions attempted, answers, scores, progress and time spent — used to personalise practice and show you progress

We ask you not to enter any sensitive personal data about your child beyond what the service needs.

3. How we use it, and our legal bases

  • To provide the service (accounts, lessons, practice, progress tracking) — legal basis: performance of our contract with you.
  • To personalise learning to your child's level and needs — legal basis: contract / your instruction as account holder.
  • To take payment and manage subscriptions — legal basis: contract.
  • To keep the service secure and prevent abuse — legal basis: our legitimate interests.
  • Optional analytics cookies — legal basis: your consent (you can decline).

4. AI features and your child's data

Some features use AI (provided by Anthropic) — for example the child's single-shot "Show me how" explanations and the parent-facing progress analysis and coaching. These are designed to be privacy-protective:

  • The child-facing AI is single-shot help on a fixed question — there is no open-ended chat aimed at a child.
  • We send the AI only what it needs to help (such as the question and a general learning level) — we do not send a child's name or contact details.
  • AI usage is metered and capped per account.

5. Who we share data with (our processors)

We use a small number of trusted providers who process data on our behalf under contract:

  • Supabase — database, authentication and hosting (EU region)
  • Vercel — website hosting / content delivery
  • Stripe — payment processing
  • Anthropic — AI explanations and analysis (see section 4)
  • Resend — transactional and report emails
  • Cloudflare — spam protection on our contact form

We do not sell your or your child's personal data, and we never will.

6. International transfers

Some providers (such as our AI provider) may process data outside the UK/EU. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

7. How long we keep it

We keep your account and learning data for as long as your account is active. When you delete your account, we permanently erase your data (and your children's) from our systems, and instruct our processors to do the same, except where we must retain limited records for legal or accounting reasons (e.g. proof of a transaction).

8. Your rights

You can, at any time: access your data, correct it, delete it, export it, restrict or object to certain processing, and withdraw consent for optional cookies. We have built these controls into the app:

  • Export — download all of your and your child's data from parent Settings.
  • Delete — permanently delete your account and all associated data from parent Settings.

You can also email contact@prephub.uk. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use essential cookies to make the site work (e.g. keeping you signed in) and, only with your consent, optional analytics cookies to understand how the site is used. You can decline optional cookies via our cookie banner without losing access to the service.

10. Security

We protect data with access controls, encryption in transit, row-level security on our database, and a parent PIN gating the parent area. No system is perfectly secure, but we take reasonable and proportionate measures to keep your family's data safe.

11. Changes to this policy

We may update this policy from time to time. We'll change the "last updated" date above and, for significant changes, let you know in the app or by email.

Terms of Service · Contact us