Privacy Notice
Summary
- We collect the least we can. Your name, email, date of birth, year group, exam boards, and the work you do here.
- We do not sell anything about you, and we run no advertising and no tracking of any kind.
- The AI does not know who you are. Your messages go to Anthropic to get a reply, but they are never told your name, your email or your school.
- Your work is not used to train AI.
- You can ask to see everything we hold, or to delete it. Email us and it is done within a month, usually the same week.
- We can read what you write here. Your chats, quiz answers and messages to us are stored, and the person who runs Bluebell can read them, to check the tutor is teaching well and to keep you safe. Nobody else can.
- A few words we watch for. If you write something suggesting you are in danger, it puts your conversation in a list for a person here to read. We would rather tell you that than have you find out later. How that works.
Anything here you are unsure about, ask a parent or a teacher — or email us at raunaq@bluebellai.org and we will answer in plain English.
1. Who is responsible for your data
The data controller is Bluebell AI Ltd, a company registered in England and Wales, company number 17183714.
We are registered with the Information Commissioner's Office under registration number ZC217996.
We have not appointed a statutory Data Protection Officer, as we are not required to under Article 37 UK GDPR. Privacy questions and requests go to raunaq@bluebellai.org, which reaches the person responsible for data protection at Bluebell.
Where a school provides Bluebell to its pupils under a school code, the school and Bluebell are independent controllers for their own purposes: the school decides which pupils are offered access, and we decide how the service itself operates. We are not a processor acting on the school's instructions.
2. What personal data we collect
2.1 Data you give us
| Data | When |
|---|---|
| Username, display name, email address | At sign-up |
| Password, stored only as a bcrypt hash — never in a readable form | At sign-up |
| Date of birth | At sign-up, to check age (see section 8) |
| School code, where you have one | At sign-up |
| Year group, stage, exam boards, subject confidence, tier and study preferences | During set-up and in settings |
| Your name, email and message if you use the contact form; for a school enquiry, also your role, school and rough student numbers | When you contact us |
2.2 Data created as you use Bluebell
| Data | Notes |
|---|---|
| Your conversations with the tutor | Both what you write and what the tutor replies |
| Images you attach to a message | Not stored. The image is sent to Anthropic with your message so the tutor can read it, and is not kept by Bluebell — see section 6 |
| Quiz answers, marks, topics covered, XP and streaks | How progress pages are built |
| Interview and UCAT practice attempts, answers and scores | Pro features |
| Counts of AI requests | Used to apply your weekly allowance |
| A one-way salted hash of your IP address, and a random device marker | At sign-up only, to spot one person opening many free accounts. The IP address itself is never stored |
2.3 Payment data
Payments are taken by Stripe. Card numbers never reach Bluebell's servers and we never see or store them. We keep the payer's email address, the Stripe customer and subscription identifiers, the plan and the renewal date.
2.4 Special category data
We do not ask for health, ethnicity, religion or any other special category data. Two routes bring it to us anyway, and we would rather name them than pretend otherwise:
- You may type it. A student explaining that they are dyslexic, or that they have been ill, has given us health data inside an ordinary tutoring message.
- Safeguarding. A message that matches one of a small number of phrases about self-harm or being at risk is put in a queue for a person to read. That is data concerning health, and we process it under the safeguarding condition in Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018. Our safeguarding statement explains what happens, and what does not.
3. Why we process it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, and providing tutoring, quizzes and progress tracking | Contract — Article 6(1)(b). Where a parent or school arranged the account, our basis for the child's data is legitimate interests — Article 6(1)(f) — in delivering the service they arranged |
| Taking payment and managing subscriptions | Contract — Article 6(1)(b) |
| Keeping accounting and tax records | Legal obligation — Article 6(1)(c) |
| Checking age at sign-up | Legitimate interests — Article 6(1)(f), our interest in keeping under-13s off a service not designed for them, as data protection law expects |
| Security, rate limiting, and stopping one person opening many free accounts | Legitimate interests — Article 6(1)(f). Our interest is keeping the service available and affordable; the data used is minimal and hashed |
| Safeguarding review of flagged messages | Legitimate interests — Article 6(1)(f), and vital interests — Article 6(1)(d) — where there is a risk to life. For the special category element, DPA 2018 Schedule 1, Part 2, paragraph 18 |
| Answering your messages and providing support | Legitimate interests — Article 6(1)(f) |
We do not rely on consent for any of the above, which matters for a service used by children: a child under 13 cannot give valid consent to an online service on their own behalf, so a service that depended on it would be on weak ground. You can ask us to stop processing based on legitimate interests at any time — see section 9.
We do not use your data for marketing, we do not sell or rent it, and we do not share it with data brokers or advertisers.
4. Who else receives your data
We use a small number of suppliers. Each is bound by a written contract to process data only on our instructions, and none of them may use it for their own purposes.
| Who | What they receive | Where |
|---|---|---|
| Anthropic AI model provider |
Your message, any image attached, the topic, and your year group, stage and exam board. Never your name, email, username or school. | United States |
| Stripe Payments |
The payer's email and card details, which they collect directly | Ireland and United States |
| Railway Hosting |
Everything, as the infrastructure the database and application run on | Netherlands (EU) |
| Resend Transactional email |
Your email address and the contents of account emails, such as a password reset | United States |
4.1 Content loaded from other websites
Some pages load fonts and stylesheets from Google Fonts, jsDelivr and unpkg. When your browser fetches those files it connects directly to those services, which means your IP address is disclosed to them. They are not our processors and we have no contract with them covering this. They are used only to deliver fonts and stylesheets, not to track you, and we are working to serve these files from our own servers so that the disclosure stops.
4.2 Others we may disclose to
- A parent or guardian exercising rights on behalf of their child, once we are satisfied who they are.
- A school, about a pupil using that school's code, where the school asks and it is appropriate.
- The police, social services or another authority, if we are legally required to disclose, or where there is a serious risk to someone's safety.
- A buyer, if Bluebell is ever sold or reorganised. You would be told before your data was transferred.
5. Sending data outside the UK
Our database is stored in the Netherlands, in the European Union, which UK law recognises as protecting personal data adequately. Anthropic, Stripe and Resend process data in the United States. Those transfers are made under the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, which is the safeguard provided for in Article 46 UK GDPR. We hold a copy of each agreement and will provide it on request.
6. A specific word about photographs
You can attach a photograph to a message — usually a picture of a page of working. A photograph taken in a bedroom often contains more than the page: faces, a room, a name on a book. Before a photograph is sent we remove its hidden data, including the location it was taken at. It is then sent to Anthropic with your message so the tutor can read it. Bluebell does not store photographs: once the tutor has replied, the photograph is gone, and only your words and the tutor’s reply stay in the conversation.
Send a photograph of the work rather than of yourself, and crop out anything you would not want the tutor to see.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account details, conversations, quizzes and progress | As long as the account is open, and deleted when it is closed. An account nobody has used for two years, and nobody is paying for, is deleted automatically |
| Photographs attached to a message | Not stored. Used for the tutor’s reply and then discarded. The words of the message stay |
| Records of payments and subscriptions | Six years after the end of the financial year they relate to, as company and tax law requires |
| Records of how many AI requests were made | Kept indefinitely for cost accounting, but unlinked from you when your account is deleted, so they no longer identify anyone |
| Safeguarding review records | Deleted with the account. We are not a school and hold no safeguarding record that outlives it |
| Contact form messages | 12 months, then deleted automatically |
| Backups | A copy of the database is taken every day and each copy is deleted after 14 days, so deleted data has left every backup within 14 days |
8. Children
Bluebell is designed for students aged 13 and over, and we follow the ICO's Age Appropriate Design Code.
- We ask for a date of birth at sign-up. If you are under 13 we do not create the account, and we ask a parent, guardian or teacher to set it up instead. We store the date of birth so we can treat you appropriately for your age rather than asking again.
- Nothing about you is public. There are no profiles, no messaging between students, and nothing you write is ever shown to another user.
- Privacy settings start at the most protective option, and there is no setting that makes you more visible, because there is nothing to be visible to.
- We do not profile you or use nudge techniques to keep you on the site longer. Streaks and XP exist to help you revise consistently, and nothing is lost by ignoring them.
- A parent or guardian can ask for anything in section 9 on your behalf.
9. Your rights
Under UK data protection law you have the right to:
- Be told what we hold and why — this notice.
- See a copy of your personal data.
- Have mistakes corrected.
- Have it deleted. This right is stronger for children: if you gave us data as a child, you can ask for it to be erased later even if you are an adult by then.
- Restrict what we do with it while a dispute is sorted out.
- Object to processing we base on legitimate interests.
- Receive it in a portable form, or have it sent to another service.
How to ask. Email raunaq@bluebellai.org. There is currently no button in settings that deletes an account, so a request has to come to us by email — we are adding one. We reply within one month as the law requires, and in practice usually within a few days. It is free.
Complaints. If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.
10. Automated decisions and AI
The tutor's replies are generated by an AI model, so in that sense the service is automated throughout. But no decision is made about you that produces a legal or similarly significant effect: we do not grade your coursework, predict your results, report on you to anyone, or decide anything about your education. Article 22 UK GDPR — the right not to be subject to solely automated decisions — is therefore not engaged.
Your work is not used to train AI models. Our AI policy sets out which model is used, what is sent to it, and what is not.
11. Cookies
We run no analytics and no advertising trackers of any kind — no Google Analytics, no Meta pixel, nothing. That is why you have never seen a cookie banner: there is nothing to ask you about.
| Cookie | Purpose | Lasts |
|---|---|---|
session | Keeps you logged in | 7 days |
csrf_token | Stops forged form submissions | Session |
admin_session | Staff access only | 12 hours |
bb_device | A random marker so we can see one browser opening many free accounts. It identifies a browser, not a person, and is never used for advertising | 1 year |
bb_age | Set only if a sign-up is refused on age, so the date cannot simply be retyped | 30 days |
We also store your light or dark theme choice, and which tab you last used, in your browser's local storage. That never reaches our servers.
12. How we protect it
- Everything travels over HTTPS, and the site refuses to load over an unencrypted connection.
- Passwords are stored as bcrypt hashes. We cannot read your password, and neither can anyone who obtained the database.
- Session cookies cannot be read by JavaScript, so a scripting flaw cannot steal a login.
- IP addresses are hashed with a secret before storage. The address itself is never written down.
- Access to the administrative view is restricted and separately authenticated.
No system is perfectly secure. If a breach ever affects your rights and freedoms we will tell the ICO within 72 hours, and we will tell you directly where the law requires it.
13. Changes to this notice
The date at the top is when this was last changed. If we ever change something significant — a new supplier receiving your data, a new purpose, a new lawful basis — we will say so on the site before it takes effect rather than quietly updating the page.
14. Getting in touch
raunaq@bluebellai.org for anything in this notice, or the contact page for anything else. If it is about a child's safety, say so in the subject line and we will read it the same day.