Q-GenQ-GenSign in

Policies

Privacy Policy

How GoStudious collects, uses, stores, shares and protects your personal information across the United Kingdom and Zimbabwe.

Last reviewed July 2026 · Version 1.1

1. Introduction

Welcome to GoStudious. We are committed to protecting your privacy and ensuring a safe, secure educational experience for all users — including students, tutors, teachers, schools, and parents. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our platform and services (the "Service").

Because GoStudious serves students — including children and young people — we take your privacy especially seriously. We want you to understand exactly what information we collect, why we collect it, and the rights you have over that information. Younger users may wish to read this with a parent or guardian.

By creating an account or using the Service, you agree to the terms of this Privacy Policy. If you are a parent or guardian registering on behalf of a minor, you also agree to this Policy on their behalf.

2. Definitions

The following terms are used throughout this Privacy Policy:

  • GoStudious / Company: GoStudious Ltd, operating in the United Kingdom and Zimbabwe. References to "we", "us", and "our" refer to GoStudious.
  • Data Controller: For the purposes of UK GDPR, GoStudious Ltd is the Data Controller — the organisation that determines how and why personal data is processed.
  • Personal Data: Any information that relates to an identified or identifiable individual, such as a name, email address, location data, or online identifier.
  • Usage Data: Data collected automatically when you use the Service, such as pages visited, time spent, and device information.
  • Service Provider: Third-party companies or individuals who process data on our behalf to facilitate the Service.
  • Child / Minor: Any individual under the age of 18. For data protection purposes, a "child" under applicable law refers to those under 13 (UK) or the applicable age of digital consent in your jurisdiction.
  • School Account: An account created or managed by an educational institution for the purpose of student learning.
  • You / User: The individual accessing or using the Service, or the parent, guardian, or school acting on behalf of a student.

3. Account Types

GoStudious offers four types of accounts, each with different roles and permissions:

  • Student — Learners aged 13 and above who access educational content, communicate with tutors and teachers, and track their learning progress.
  • Tutor — Qualified individuals who provide instruction and coaching to students through the platform.
  • Teacher / School — School staff or educational institutions that manage student learning, assign content, and monitor academic progress.
  • Parent / Guardian — Adults who register to oversee their child's account and monitor their learning activity on the platform.

4. Information We Collect

We collect different types of information depending on your account type and how you use our Service.

4.1 Personal Data You Provide

When you register for or use GoStudious, we may ask you to provide:

  • First name and last name
  • Email address
  • Date of birth or age range
  • Educational information (subjects, exam board, year group)
  • School name (if using a School Account)
  • Username and password
  • Account role (student, tutor, teacher, or parent)

4.2 Payment Information

For paid subscriptions and services, we collect:

  • Billing name and address
  • Payment method details (processed securely through third-party payment providers)
  • Transaction history and subscription details

GoStudious does not store full payment card details. All payment processing is handled by PCI-DSS compliant third-party providers (including Stripe). Stripe's own privacy policy applies to payment data.

4.3 Learning Activity and Progress

  • Lessons completed, assessments taken, and scores achieved
  • Individual revision guides and flashcards accessed
  • Tests and activities started or completed
  • Learning goals and subject preferences
  • Session history with tutors or teachers
  • Feedback and ratings submitted by or for users

We only collect detailed usage data (such as individual content viewed) when you have enabled personalisation in your account settings. You can change your personalisation settings at any time.

4.4 Communications

  • Chat messages and communications between students, tutors, and teachers within the platform
  • Support enquiries and correspondence with GoStudious staff

Communications on the platform may be monitored for safety and quality assurance purposes, particularly where users include minors.

4.5 Location Data

  • General location (country and region) to provide region-appropriate content and comply with local laws
  • IP address and approximate location derived from it

We do not collect precise real-time GPS location data.

4.6 Device and Usage Data (Collected Automatically)

When you use GoStudious, we automatically collect:

  • Device information (device type, operating system, browser type and version)
  • Pages visited, features used, and time spent on the platform
  • Time and date of your visits
  • Unique device identifiers and diagnostic data

4.7 Information From Other Sources

We may receive information about you from:

  • Your school or teacher, when a School Account is set up on your behalf
  • A parent or guardian, when setting up a child's account
  • Third-party services you choose to connect (e.g. single sign-on via Google Classroom.

4.8 AI Interaction Data

Where you use AI-enabled features on GoStudious (see Section 15), we may collect:

  • Prompts, questions, and inputs you submit to AI-powered tools or tutors
  • AI-generated responses, feedback, and content provided to you
  • Metadata about AI interactions, such as timestamps, session duration, and feature used
  • Corrections, ratings, or feedback you provide on AI-generated content

This data may be used to provide and improve AI-enabled features, personalise your learning experience, and monitor for safety and appropriate use, particularly where users include minors. AI interaction data may be processed by third-party AI service providers on our behalf, subject to the safeguards described in Section 8 (Sharing Your Information) and Section 10 (Data Storage and International Transfers).

5. Cookies and Tracking Technologies

GoStudious uses browser local storage and cookies to store certain information on your device. We do not use tracking technologies for advertising purposes.

Necessary / Essential

Type: Persistent Cookies

Administered by: Us

Purpose: These Cookies are essential to provide you with services available through the Website and to enable you to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services you have requested cannot be provided, and we use them solely to provide those services.

5.2 Functional Cookies

Type: Persistent Cookies

Administered by: Us

Purpose: These Cookies allow us to remember choices you make when you use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide you with a more personalised experience and to prevent you from having to re-enter your preferences every time you use the Website.

5.3 Third-Party Services

Certain third-party services we use may set their own cookies:

  • YouTube (Google/Alphabet): Some video content is hosted on YouTube, which may use cookies to track views. We use YouTube's privacy-enhanced mode where possible.
  • Stripe: Payment processing is handled by Stripe, which may use session cookies. Stripe's own privacy policy applies to this data. Processed in the UK and Zimbabwe.
  • Supabase: Our backend database and authentication infrastructure is provided by Supabase. Processed in the UK and Zimbabwe.
  • Google/Gemini: Certain AI-enabled features (see Section 4.8 and Section 15) are powered by Google's Gemini models, which may process user inputs and interaction data to generate responses. Processed in the UK and Zimbabwe.
  • Vercel: Our platform is hosted and served via Vercel, which may process technical and log data as part of delivering the Service. Processed in the UK and Zimbabwe.

No tracking technologies are used for targeted advertising anywhere on the GoStudious platform.

6. How We Use Your Information

We use the information we collect for the following purposes:

  • To create and manage your account and verify your identity
  • To provide, personalise, and improve our educational services
  • To connect students with appropriate tutors and teachers
  • To process payments and manage subscriptions
  • To enable communication between users on the platform
  • To allow parents and teachers to monitor student learning activity and progress
  • To send service-related notifications (e.g. session reminders, account alerts) you can opt out at any time
  • To analyse platform performance and develop new educational features
  • To respond to enquiries and provide customer support
  • To comply with legal obligations under UK and Zimbabwean law
  • To investigate misuse, fraud, or violations of our Terms of Service

We may use de-identified, anonymised, or aggregated data (which cannot be linked back to you) for research, analytics, and demonstrating the educational impact of our Service.

We do not sell your personal information to third parties. We do not display third-party advertising on GoStudious.

7. Legal Basis for Processing

7.1 United Kingdom (UK GDPR)

For users in the United Kingdom, we process your personal data under the following legal bases, as set out in Article 6(1) of the UK GDPR:

  • Consent where you have given clear consent, for example, to receive marketing emails or enable personalised content (Article 6(1)(a) UK GDPR)
  • Performance of a contract where processing is necessary to deliver the Service you have signed up for (Article 6(1)(b) UK GDPR)
  • Legitimate interests to improve the platform, ensure security, personalise the educational experience, and prevent fraud, provided these interests do not override your rights (Article 6(1)(f) UK GDPR)
  • Legal obligation where we are required to process your data to comply with applicable UK law (Article 6(1)(c) UK GDPR)
  • Public task where we process data to fulfil an educational purpose in the public interest (Article 6(1)(e) UK GDPR)

You have the right to withdraw consent at any time where processing is based on consent (Article 7(3) UK GDPR). We will always tell you which legal basis we rely on for any specific processing activity if you ask us, in line with our transparency obligations under Article 13 and Article 14 UK GDPR

7.2 Zimbabwe

For users in Zimbabwe, we process your personal data in compliance with the Cyber and Data Protection Act [Chapter 12:07] and applicable Zimbabwean regulations. We process your personal data under the following legal bases:

Consent where you have given clear consent, for example, to receive marketing communications or enable personalised features

Contractual necessity where processing is necessary to perform our obligations under the Service you have signed up for

Legal obligation where we are required to process your data to comply with applicable Zimbabwean law, including obligations under the Cyber and Data Protection Act

Legitimate interests to maintain the security of the platform, prevent fraud, and improve our educational services, provided this does not unjustifiably infringe your rights

Where we process data relating to a child in Zimbabwe, we take into account the heightened protections the Act affords to data subjects who are minors, and where required, we seek consent from a parent or guardian

You have the right to withdraw consent at any time where processing is based on consent. If you have questions about which legal basis we rely on for a specific processing activity, you can contact us using the details in Section 18 (Contact: support@gostudious.co.uk)

The Cyber and Data Protection Act [Chapter 12:07] also established a Data Protection Authority in Zimbabwe responsible for oversight and enforcement. Should you have concerns about our processing of your personal data that we have not resolved, you may have the right to lodge a complaint with that Authority

8. Sharing Your Information

GoStudious does not sell your personal information. We may share your data only in the following limited circumstances:

  • With tutors and teachers to facilitate learning sessions and track student progress as part of the Service
  • With parents or guardians, where a parent account is linked to a student account, to support learning oversight
  • With schools, where a student is enrolled under a School Account, including progress, results, and homework submissions
  • With service providers trusted third parties (e.g. cloud hosting, payment processing, analytics) who process data strictly on our behalf and under our instructions, bound by confidentiality obligations
  • For legal compliance where required by law, court order, or to protect the safety and rights of users or the public
  • In business transactions, if GoStudious is involved in a merger, acquisition, or asset sale, we will provide advance notice, and your data may be transferred as part of that transaction
  • With your consent, we may share information with third-party applications or services that you explicitly choose to connect to

When we share your data with any third party, they are required to keep it safe and may only use it as we specify.

Refer to Gostudious GDPR Policy

9. Data Retention

We retain your personal data only for as long as is necessary to provide the Service and fulfil the purposes described in this Privacy Policy. Specifically:

  • Account data is retained for the duration of your account and for a reasonable period after deletion, as required by law
  • Payment records are retained for a minimum of 6 years in compliance with UK financial regulations
  • Learning activity data may be retained to support ongoing educational records
  • Communications may be retained for safeguarding and dispute resolution purposes

When we no longer have a legitimate reason to retain your personal data, we will delete or anonymise it. If you delete your account, your personal data will be removed from our active systems and any remaining data anonymised. We may retain anonymised, de-identified data for longer periods for research and analytical purposes.

10. Data Storage and International Transfers

GoStudious operates in both the United Kingdom and Zimbabwe. Your personal data may be stored and processed in either or both of these locations.

For UK users, your personal information is primarily processed and stored within the United Kingdom and European Economic Area (EEA), using secure cloud infrastructure. Where data is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements, such as standard contractual clauses or equivalent protections.

For Zimbabwean users, your data is processed in compliance with the Cyber and Data Protection Act. Where data is transferred internationally, we ensure equivalent protections are applied.

No transfer of your personal data will take place to an organisation or country unless adequate controls are in place.

11. Security of Your Information

The security of your personal data is important to us. We implement commercially reasonable technical and organisational measures to protect your data, including:

  • Encryption of personal data at rest and during transmission (SSL/TLS)
  • Secure storage of passwords using industry-standard hashing
  • Access controls limiting who within GoStudious can access personal data
  • Regular security reviews and updates
  • Stuff training

We also encourage you to:

  • Create a username - first name and last name are required
  • Use a strong, unique password for your account
  • Keep your login credentials confidential and do not share them with others

11.1 Data Breach Notification

Please be aware that no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data using appropriate technical and organisational measures, we cannot guarantee absolute security.

Our breach response process:

In the event of a personal data breach, we will:

  • Investigate and, where feasible, contain the breach as soon as we become aware of it
  • Assess the likely risk to the rights and freedoms of affected individuals
  • Maintain an internal record of the breach, including its facts, effects, and the remedial action taken

Regulatory notification (United Kingdom):

Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33 UK GDPR. Where notification is not made within 72 hours, we will provide reasons for the delay.

Regulatory notification (Zimbabwe):

Where a breach affects users in Zimbabwe, we will notify the relevant Data Protection Authority in accordance with the timelines and requirements of the Cyber and Data Protection Act [Chapter 12:07].

Notification to affected users:

Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly and without undue delay, in accordance with Article 34 UK GDPR (or the equivalent threshold under Zimbabwean law). This notification will include, where possible:

  • The nature of the breach
  • The categories and approximate number of individuals and records affected
  • The likely consequences of the breach
  • The measures taken or proposed to address the breach and mitigate its effects
  • Contact details for further information (see Section 18, Contact support@gostudiou.co.uk)

Given that GoStudious processes data relating to children, we will treat breaches involving student or minor data as inherently higher risk and will apply a lower threshold for direct notification to affected users, parents, guardians, or schools as appropriate.

12. Your Rights

12.1 UK & EU Users (UK GDPR / EU GDPR)

If you are located in the United Kingdom or European Economic Area, you have the following rights:

  • Right of access request a copy of the personal data we hold about you
  • Right to rectification request correction of inaccurate or incomplete data
  • Right to erasure request deletion of your personal data ('right to be forgotten')
  • Right to restriction ask us to limit how we use your data in certain circumstances
  • Right to data portability receive your data in a structured, machine-readable format for transfer to another provider
  • Right to object object to processing based on legitimate interests, or to direct marketing
  • Right to withdraw consent where we rely on consent, withdraw it at any time without affecting prior lawful processing

You have a right to complain if any of these rights have been violated. Contact complaints@gostudious.uk

You also have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO): www.ico.org.uk. In the EEA, contact your local data protection authority.

12.2 Zimbabwe Users

For users in Zimbabwe, you have the following rights under the Cyber and Data Protection Act [Chapter 12:07]:

  • Right to access personal information we hold about you
  • Right to request correction of inaccurate personal information
  • Right to object to processing in certain circumstances

You may lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) or the relevant data protection authority.

12.3 How to Exercise Your Rights

You can exercise many of your rights directly within your account settings. Where this is not possible, please contact us at privacy@gostudious.com. We will respond as soon as possible and within the timeframes required by applicable law. We may ask you to verify your identity before acting on your request.

13. Children and Minor Users

Protecting the privacy of children and young people is especially important to GoStudious. The platform is available to students aged 13 and above.

We do not knowingly collect personal information from children under the age of 13 without appropriate parental or guardian consent (or, where applicable, school consent on behalf of a parent). Additional protections for child users include:

  • Requiring parental or guardian consent before an account is created for a child under 13
  • Students under 18 should have a parent or guardian who is aware of and consents to their use of the platform
  • Parent accounts can be linked to student accounts to allow parental oversight of learning activity and communications
  • Child accounts are restricted from features that would allow posting or disclosing personal information publicly
  • We do not use tracking technology for advertising on any content directed at children
  • Parents and guardians may review, modify, or request deletion of their child's account at any time
  • Communications involving minor students may be reviewed by authorised GoStudious staff for safety purposes

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at privacy@gostudious.com. We will take steps to remove that information from our systems.

14. School Accounts and Student Data

When GoStudious is used as part of a school's educational programme, we treat student data with additional care and in compliance with applicable education data privacy laws.

14.1 School Account Creation

A School Account is created when:

  • A teacher creates accounts and classes on behalf of students
  • A school integrates GoStudious via a supported single sign-on service (e.g. Google Classroom, Clever, ClassLink)
  • Students create accounts at the direction of their school, using a school email address linked to a class
  • Accounts are created pursuant to a contract between GoStudious and a school or local authority

14.2 Responsibilities of School Personnel

Schools and teachers registering student accounts are responsible for:

  • Obtaining any required parental consent and complying with applicable child protection laws
  • Providing appropriate disclosures to students and their parents regarding use of the Service
  • Notifying GoStudious promptly if a parent withdraws consent for their child's access
  • Ensuring use of the Service is permitted by the institution's own policies

14.3 Use of Student Personal Data

Our collection and use of student personal data is governed by our agreements with schools and applicable privacy law:

  • We only collect student data that is necessary to provide the educational Service
  • We do not use student data for targeted advertising
  • We do not sell students' personal data
  • Student data is not used to build profiles for non-educational purposes
  • We will not make material changes to how we use student data without first notifying the relevant school

Teachers and schools may access student progress, results, and activity within the platform. If you have questions about your child's data held under a School Account, please contact your school directly in the first instance.

15. AI-Enabled Features

Where GoStudious offers AI-powered features (such as tutoring tools, writing assistants, or feedback generators), the following additional terms apply to all users of the platform including students, tutors, teachers, school personnel, and parents/guardians:

  • AI features are designed with data protection principles in mind and, where used by or on behalf of students, to comply with applicable student data privacy laws, including relevant provisions of the UK GDPR, the Data Protection Act 2018, and the ICO's Age Appropriate Design Code (issued under s.123 of the Data Protection Act 2018), and, for Zimbabwean users, the Cyber and Data Protection Act [Chapter 12:07].
  • All users are advised not to include personal information of their own or that of others in inputs submitted to AI features, in line with the data minimisation principle under Article 5(1)(c) UK GDPR.
  • Our agreements with AI model providers do not permit them to use input data submitted by any user, student, tutor, teacher, or parent to train their models. Where AI providers process personal data on our behalf, they act as our processors under Article 28 UK GDPR, and any transfer of data outside the UK is subject to the safeguards described in Section 10 (Data Storage and International Transfers).
  • AI outputs may contain errors, inaccuracies, or incomplete information. All users, including tutors and teachers, relying on AI features for lesson preparation or feedback should not rely solely on AI-generated content without independent verification.
  • Use of AI features by persons under 18 must be supervised by an authorised adult (parent, teacher, or school personnel), consistent with our approach to children's data under Section 13 (Children and Minor Users).
  • Adult users (tutors, teachers, school personnel, and parents/guardians) remain responsible for the appropriateness of their own use of AI features and for ensuring any AI-assisted work product meets their professional or institutional obligations.

School personnel and tutors should apply their own professional judgement and any applicable institutional AI use policies when using AI-enabled features, and should not rely solely on AI outputs to make consequential decisions about students, including decisions relating to assessment, progress, safeguarding, or wellbeing.

For details on what AI interaction data we collect and how it is used, see Section 4.8 (AI Interaction Data).

16. Links to Other Websites

Our Service may contain links to third-party websites or services not operated by GoStudious. If you click on a third-party link, you will be directed to that site and their own privacy policy will apply. We strongly advise you to review the privacy policy of any site you visit.

We have no control over and accept no responsibility for the privacy practices or content of third-party sites or services.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

  • Post the updated policy on this page with a revised "Last Updated" date
  • Notify you by email and/or a prominent notice on the Service before material changes take effect
  • Where changes affect how we use student personal data, notify the relevant school and provide an opportunity to review the changes before they take effect

Your continued use of GoStudious after such changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically to stay informed about how we protect your information.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

GoStudious Privacy Team

Email: privacy@gostudious.co.uk

Website: www.gostudious.co.uk/privacy

Current Operating regions (2026): United Kingdom and Zimbabwe

For UK users, our Data Controller is registered in accordance with UK GDPR requirements. If you are unsatisfied with our response, you have the right to contact the Information Commissioner's Office (ICO) at www.ico.org.uk.

For Zimbabwean users, you may contact the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) if you are dissatisfied with our handling of your data.

We will respond to all requests as promptly as possible and within the timeframes required by applicable law.